gitmedia/presseportale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

Optimierung 3.1: Company::scopeAccessibleBy() zentralisiert Firmenzugriff

Browse source 
Die 4x identische Zugriffs-Closure (owner_user_id == me OR whereHas('users',
me)) in CompanyController (index/show), PressReleaseController::
findOwnedCompany und CustomerCompanyContext::accessibleCompanyQuery durch
einen Company::scopeAccessibleBy() ersetzt; das Scope-Verhalten
(withoutGlobalScopes) bleibt beim Aufrufer.

Bewusst unangetastet: User::accessibleCompanyIds() (relationenbasiert MIT
globalen Scopes - anderes Scope-Verhalten) und PressReleaseImageController
(prueft PR-Autorschaft user_id, nicht Firmenzugriff).

Tests: neuer Scope-Test; volle Suite gruen (801 passed, 1 skipped).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Kevin Adametz 2026-06-19 10:23:16 +00:00
parent 6a1240bdfb
commit dba76910ca
5 changed files with 34 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

16
tests/Feature/CompanySearchByTermTest.php
View file

@ -1,6 +1,7 @@
<?php
use App\Models\Company;
use App\Models\User;
test('searchByTerm matches name and slug, ignoring non-matches', function () {
$acme = Company::factory()->create(['name' => 'Acme Industries', 'slug' => 'acme-industries']);
@ -23,3 +24,18 @@ test('searchByTerm strips a trailing portal abbreviation from the term', functio
expect(Company::query()->searchByTerm('Musterfirma (PE)')->pluck('id'))->toContain($company->id);
});
test('accessibleBy includes owned and member companies but excludes others', function () {
$user = User::factory()->create();
$owned = Company::factory()->create(['owner_user_id' => $user->id]);
$member = Company::factory()->create();
$member->users()->attach($user->id, ['role' => 'member']);
$foreign = Company::factory()->create();
$ids = Company::query()->withoutGlobalScopes()->accessibleBy($user)->pluck('id');
expect($ids)->toContain($owned->id)
->toContain($member->id)
->not->toContain($foreign->id);
});