Kevin Adametz
4fc46b02bf
- PressRelease::scopeOwnedByApiUser() (bewusst eng: nur user_id-Autorschaft, anders als das breitere scopeAccessibleBy) ersetzt die byte-gleiche findOwnedPressRelease-Query in PressReleaseController + ImageController. - apiResourceRelations()-Helfer ersetzt den 5x identischen Eager-Load-Set (company/category.translations/images) in Index/Show/Create/Update/Reclassify. Bewusst NICHT umgesetzt: Slug-Reimplementierung (uniqueSlug) durch HasUniqueSlug ersetzen - der API-Fallback Str::random(8) weicht vom Trait-slugFallback() ab (Verhaltensaenderung bei leer-slugifizierten Titeln). Tests: neuer Scope-Test; volle Suite gruen (802 passed, 1 skipped). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
85 lines
2.9 KiB
PHP
85 lines
2.9 KiB
PHP
<?php
|
|
|
|
use App\Enums\Portal;
|
|
use App\Models\Company;
|
|
use App\Models\PressRelease;
|
|
use App\Models\User;
|
|
use App\Services\CurrentPortalContext;
|
|
use Database\Seeders\RolesAndPermissionsSeeder;
|
|
use Tests\TestCase;
|
|
|
|
beforeEach(function (): void {
|
|
/** @var TestCase $this */
|
|
$this->seed(RolesAndPermissionsSeeder::class);
|
|
});
|
|
|
|
test('accessibleBy includes a users own authored press release', function () {
|
|
$user = User::factory()->create();
|
|
$pr = PressRelease::factory()->create(['user_id' => $user->id, 'company_id' => null]);
|
|
|
|
$ids = PressRelease::accessibleBy($user)->pluck('id');
|
|
|
|
expect($ids)->toContain($pr->id);
|
|
});
|
|
|
|
test('ownedByApiUser matches only the authoring user, not company access', function () {
|
|
$author = User::factory()->create();
|
|
$companyMate = User::factory()->create();
|
|
$company = Company::factory()->create();
|
|
$company->users()->attach($companyMate->id, ['role' => 'member']);
|
|
|
|
$pr = PressRelease::factory()->create(['user_id' => $author->id, 'company_id' => $company->id]);
|
|
|
|
expect(PressRelease::withoutGlobalScopes()->ownedByApiUser($author)->pluck('id'))->toContain($pr->id)
|
|
->and(PressRelease::withoutGlobalScopes()->ownedByApiUser($companyMate)->pluck('id'))->not->toContain($pr->id);
|
|
});
|
|
|
|
test('accessibleBy includes press releases of an assigned company', function () {
|
|
$user = User::factory()->create();
|
|
$company = Company::factory()->presseecho()->create();
|
|
$user->companies()->attach($company->id, ['role' => 'owner']);
|
|
|
|
$other = User::factory()->create();
|
|
$pr = PressRelease::factory()->create([
|
|
'user_id' => $other->id,
|
|
'company_id' => $company->id,
|
|
'portal' => $company->portal->value,
|
|
]);
|
|
|
|
$ids = PressRelease::accessibleBy($user)->pluck('id');
|
|
|
|
expect($ids)->toContain($pr->id);
|
|
});
|
|
|
|
test('accessibleBy excludes press releases of strangers and unrelated companies', function () {
|
|
$user = User::factory()->create();
|
|
$stranger = User::factory()->create();
|
|
$foreignCompany = Company::factory()->presseecho()->create();
|
|
|
|
$foreignPr = PressRelease::factory()->create([
|
|
'user_id' => $stranger->id,
|
|
'company_id' => $foreignCompany->id,
|
|
'portal' => $foreignCompany->portal->value,
|
|
]);
|
|
|
|
$ids = PressRelease::accessibleBy($user)->pluck('id');
|
|
|
|
expect($ids)->not->toContain($foreignPr->id);
|
|
});
|
|
|
|
test('accessibleBy bypasses the portal global scope so own PMs are visible cross-portal', function () {
|
|
$user = User::factory()->create();
|
|
$pr = PressRelease::factory()->create([
|
|
'user_id' => $user->id,
|
|
'company_id' => null,
|
|
'portal' => Portal::Businessportal24->value,
|
|
]);
|
|
|
|
// Simuliert eingeschränkten Portal-Kontext (Presseecho); der Scope muss
|
|
// die eigene PM dennoch finden, weil er die GlobalScopes entfernt.
|
|
CurrentPortalContext::set(Portal::Presseecho);
|
|
|
|
$found = PressRelease::accessibleBy($user)->find($pr->id);
|
|
|
|
expect($found)->not->toBeNull();
|
|
});
|