Kevin Adametz
dba76910ca
Die 4x identische Zugriffs-Closure (owner_user_id == me OR whereHas('users',
me)) in CompanyController (index/show), PressReleaseController::
findOwnedCompany und CustomerCompanyContext::accessibleCompanyQuery durch
einen Company::scopeAccessibleBy() ersetzt; das Scope-Verhalten
(withoutGlobalScopes) bleibt beim Aufrufer.
Bewusst unangetastet: User::accessibleCompanyIds() (relationenbasiert MIT
globalen Scopes - anderes Scope-Verhalten) und PressReleaseImageController
(prueft PR-Autorschaft user_id, nicht Firmenzugriff).
Tests: neuer Scope-Test; volle Suite gruen (801 passed, 1 skipped).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
41 lines
1.5 KiB
PHP
41 lines
1.5 KiB
PHP
<?php
|
|
|
|
use App\Models\Company;
|
|
use App\Models\User;
|
|
|
|
test('searchByTerm matches name and slug, ignoring non-matches', function () {
|
|
$acme = Company::factory()->create(['name' => 'Acme Industries', 'slug' => 'acme-industries']);
|
|
$globex = Company::factory()->create(['name' => 'Globex Corporation', 'slug' => 'globex-corp']);
|
|
|
|
$results = Company::query()->searchByTerm('Acme')->pluck('id');
|
|
|
|
expect($results)->toContain($acme->id)
|
|
->not->toContain($globex->id);
|
|
});
|
|
|
|
test('searchByTerm returns the query unchanged for a blank term', function () {
|
|
Company::factory()->count(3)->create();
|
|
|
|
expect(Company::query()->searchByTerm('')->count())->toBe(Company::query()->count());
|
|
});
|
|
|
|
test('searchByTerm strips a trailing portal abbreviation from the term', function () {
|
|
$company = Company::factory()->create(['name' => 'Musterfirma']);
|
|
|
|
expect(Company::query()->searchByTerm('Musterfirma (PE)')->pluck('id'))->toContain($company->id);
|
|
});
|
|
|
|
test('accessibleBy includes owned and member companies but excludes others', function () {
|
|
$user = User::factory()->create();
|
|
|
|
$owned = Company::factory()->create(['owner_user_id' => $user->id]);
|
|
$member = Company::factory()->create();
|
|
$member->users()->attach($user->id, ['role' => 'member']);
|
|
$foreign = Company::factory()->create();
|
|
|
|
$ids = Company::query()->withoutGlobalScopes()->accessibleBy($user)->pluck('id');
|
|
|
|
expect($ids)->toContain($owned->id)
|
|
->toContain($member->id)
|
|
->not->toContain($foreign->id);
|
|
});
|