diff --git a/database/factories/UserFactory.php b/database/factories/UserFactory.php index c82cabcc4959..f30733854f62 100644 --- a/database/factories/UserFactory.php +++ b/database/factories/UserFactory.php @@ -206,6 +206,11 @@ public function checkoutConsumables() return $this->appendPermission(['consumables.checkout' => '1']); } + public function deleteDepartments() + { + return $this->appendPermission(['departments.delete' => '1']); + } + public function viewDepartments() { return $this->appendPermission(['departments.view' => '1']); diff --git a/tests/Feature/Companies/Api/DeleteCompaniesTest.php b/tests/Feature/Companies/Api/DeleteCompaniesTest.php index 7b3224c98781..64421b47d4bc 100644 --- a/tests/Feature/Companies/Api/DeleteCompaniesTest.php +++ b/tests/Feature/Companies/Api/DeleteCompaniesTest.php @@ -2,7 +2,6 @@ namespace Tests\Feature\Companies\Api; -use App\Models\Asset; use App\Models\Company; use App\Models\User; use Tests\Concerns\TestsPermissionsRequirement; diff --git a/tests/Feature/Departments/Api/DeleteDepartmentTest.php b/tests/Feature/Departments/Api/DeleteDepartmentTest.php new file mode 100644 index 000000000000..d8d2045af772 --- /dev/null +++ b/tests/Feature/Departments/Api/DeleteDepartmentTest.php @@ -0,0 +1,65 @@ +create(); + + $this->actingAsForApi(User::factory()->create()) + ->deleteJson(route('api.departments.destroy', $department)) + ->assertForbidden(); + } + + public function testCanDeleteDepartment() + { + $department = Department::factory()->create(); + + $this->actingAsForApi(User::factory()->deleteDepartments()->create()) + ->deleteJson(route('api.departments.destroy', $department)) + ->assertStatusMessageIs('success'); + + $this->assertDatabaseMissing('departments', ['id' => $department->id]); + } + + public function testAdheresToMultipleFullCompanySupportScoping() + { + [$companyA, $companyB] = Company::factory()->count(2)->create(); + + $departmentA = Department::factory()->for($companyA)->create(); + $departmentB = Department::factory()->for($companyB)->create(); + $departmentC = Department::factory()->for($companyB)->create(); + + $superUser = $companyA->users()->save(User::factory()->superuser()->make()); + $userInCompanyA = $companyA->users()->save(User::factory()->deleteDepartments()->make()); + $userInCompanyB = $companyB->users()->save(User::factory()->deleteDepartments()->make()); + + $this->settings->enableMultipleFullCompanySupport(); + + $this->actingAsForApi($userInCompanyA) + ->deleteJson(route('api.departments.destroy', $departmentB)) + ->assertStatusMessageIs('error'); + + $this->actingAsForApi($userInCompanyB) + ->deleteJson(route('api.departments.destroy', $departmentA)) + ->assertStatusMessageIs('error'); + + $this->actingAsForApi($superUser) + ->deleteJson(route('api.departments.destroy', $departmentC)) + ->assertStatusMessageIs('success'); + + $this->assertNotNull($departmentA->fresh(), 'Department unexpectedly deleted'); + $this->assertNotNull($departmentB->fresh(), 'Department unexpectedly deleted'); + $this->assertNull($departmentC->fresh(), 'Department was not deleted'); + } +}