Kevin Adametz
1ff1cc3626
- User::currentPlan() und hasUnlimitedPressReleaseQuota() pro Request memoisiert. Beide werden je Render mehrfach abgefragt (Status-Widget auf jeder Seite, Buchungsseite, Quota-Methoden) und loesten bisher jeweils eigene subscription-/Plan-/payment-option-Queries aus. fresh() setzt den Cache zurueck. - show.blade.php: getMyPR() war NICHT memoisiert und wurde pro Request bis zu 7x mit voller Eager-Load-Query aufgerufen -> jetzt memoisiert. Firmen- Kennzahlen direkt per withCount() eager geladen statt nachtraeglichem loadCount(). - Dupliziertes Zugriffsmuster (withoutGlobalScopes + user_id/company_id) aus edit/show/index in PressRelease::scopeAccessibleBy(User) zentralisiert (Single Source of Truth fuer Kunden-PM-Zugriff), mit Tests abgesichert. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
73 lines
2.3 KiB
PHP
73 lines
2.3 KiB
PHP
<?php
|
|
|
|
use App\Enums\Portal;
|
|
use App\Models\Company;
|
|
use App\Models\PressRelease;
|
|
use App\Models\User;
|
|
use App\Services\CurrentPortalContext;
|
|
use Database\Seeders\RolesAndPermissionsSeeder;
|
|
use Tests\TestCase;
|
|
|
|
beforeEach(function (): void {
|
|
/** @var TestCase $this */
|
|
$this->seed(RolesAndPermissionsSeeder::class);
|
|
});
|
|
|
|
test('accessibleBy includes a users own authored press release', function () {
|
|
$user = User::factory()->create();
|
|
$pr = PressRelease::factory()->create(['user_id' => $user->id, 'company_id' => null]);
|
|
|
|
$ids = PressRelease::accessibleBy($user)->pluck('id');
|
|
|
|
expect($ids)->toContain($pr->id);
|
|
});
|
|
|
|
test('accessibleBy includes press releases of an assigned company', function () {
|
|
$user = User::factory()->create();
|
|
$company = Company::factory()->presseecho()->create();
|
|
$user->companies()->attach($company->id, ['role' => 'owner']);
|
|
|
|
$other = User::factory()->create();
|
|
$pr = PressRelease::factory()->create([
|
|
'user_id' => $other->id,
|
|
'company_id' => $company->id,
|
|
'portal' => $company->portal->value,
|
|
]);
|
|
|
|
$ids = PressRelease::accessibleBy($user)->pluck('id');
|
|
|
|
expect($ids)->toContain($pr->id);
|
|
});
|
|
|
|
test('accessibleBy excludes press releases of strangers and unrelated companies', function () {
|
|
$user = User::factory()->create();
|
|
$stranger = User::factory()->create();
|
|
$foreignCompany = Company::factory()->presseecho()->create();
|
|
|
|
$foreignPr = PressRelease::factory()->create([
|
|
'user_id' => $stranger->id,
|
|
'company_id' => $foreignCompany->id,
|
|
'portal' => $foreignCompany->portal->value,
|
|
]);
|
|
|
|
$ids = PressRelease::accessibleBy($user)->pluck('id');
|
|
|
|
expect($ids)->not->toContain($foreignPr->id);
|
|
});
|
|
|
|
test('accessibleBy bypasses the portal global scope so own PMs are visible cross-portal', function () {
|
|
$user = User::factory()->create();
|
|
$pr = PressRelease::factory()->create([
|
|
'user_id' => $user->id,
|
|
'company_id' => null,
|
|
'portal' => Portal::Businessportal24->value,
|
|
]);
|
|
|
|
// Simuliert eingeschränkten Portal-Kontext (Presseecho); der Scope muss
|
|
// die eigene PM dennoch finden, weil er die GlobalScopes entfernt.
|
|
CurrentPortalContext::set(Portal::Presseecho);
|
|
|
|
$found = PressRelease::accessibleBy($user)->find($pr->id);
|
|
|
|
expect($found)->not->toBeNull();
|
|
});
|