Stricter FMCS enforcement in API

Author: snipe

app/Http/Controllers/Api/AccessoriesController.php

@@ -14,6 +14,7 @@
 use App\Http\Transformers\SelectlistTransformer;
 use App\Models\Accessory;
 use App\Models\AccessoryCheckout;
+use App\Models\Company;
 use App\Models\User;
 use Carbon\Carbon;
 use Illuminate\Http\JsonResponse;
@@ -155,6 +156,7 @@ public function store(StoreAccessoryRequest $request)
     {
         $accessory = new Accessory;
         $accessory->fill($request->all());
+        $accessory->company_id = Company::getIdForCurrentUser($request->input('company_id'));
         $accessory = $request->handleImages($accessory);
 
         if ($accessory->save()) {
@@ -248,6 +250,7 @@ public function update(ImageUploadRequest $request, $id)
         $this->authorize('update', Accessory::class);
         $accessory = Accessory::findOrFail($id);
         $accessory->fill($request->all());
+        $accessory->company_id = Company::getIdForCurrentUser($request->input('company_id'));
         $accessory = $request->handleImages($accessory);
 
         if ($accessory->save()) {

app/Http/Controllers/Api/ComponentsController.php

@@ -9,6 +9,7 @@
 use App\Http\Transformers\ActionlogsTransformer;
 use App\Http\Transformers\ComponentsTransformer;
 use App\Models\Asset;
+use App\Models\Company;
 use App\Models\Component;
 use Carbon\Carbon;
 use Illuminate\Database\Query\Builder;
@@ -165,6 +166,7 @@ public function store(ImageUploadRequest $request): JsonResponse
         $this->authorize('create', Component::class);
         $component = new Component;
         $component->fill($request->all());
+        $component->company_id = Company::getIdForCurrentUser($request->input('company_id'));
         $component = $request->handleImages($component);
 
         if ($component->save()) {
@@ -205,6 +207,7 @@ public function update(ImageUploadRequest $request, $id): JsonResponse
         $this->authorize('update', Component::class);
         $component = Component::findOrFail($id);
         $component->fill($request->all());
+        $component->company_id = Company::getIdForCurrentUser($request->input('company_id'));
         $component = $request->handleImages($component);
 
         if ($component->save()) {

app/Http/Controllers/Api/ConsumablesController.php

@@ -155,6 +155,7 @@ public function store(StoreConsumableRequest $request): JsonResponse
         $this->authorize('create', Consumable::class);
         $consumable = new Consumable;
         $consumable->fill($request->all());
+        $consumable->company_id = Company::getIdForCurrentUser($request->input('company_id'));
         $consumable = $request->handleImages($consumable);
 
         if ($consumable->save()) {
@@ -194,6 +195,7 @@ public function update(StoreConsumableRequest $request, $id): JsonResponse
         $this->authorize('update', Consumable::class);
         $consumable = Consumable::findOrFail($id);
         $consumable->fill($request->all());
+        $consumable->company_id = Company::getIdForCurrentUser($request->input('company_id'));
         $consumable = $request->handleImages($consumable);
 
         if ($consumable->save()) {

app/Http/Controllers/Api/DepartmentsController.php

@@ -9,6 +9,7 @@
 use App\Http\Requests\StoreDepartmentRequest;
 use App\Http\Transformers\DepartmentsTransformer;
 use App\Http\Transformers\SelectlistTransformer;
+use App\Models\Company;
 use App\Models\Department;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -111,6 +112,7 @@ public function store(StoreDepartmentRequest $request): JsonResponse
     {
         $department = new Department;
         $department->fill($request->validated());
+        $department->company_id = Company::getIdForCurrentUser($request->input('company_id'));
         $department = $request->handleImages($department);
 
         $department->created_by = auth()->id();
@@ -155,6 +157,7 @@ public function update(ImageUploadRequest $request, $id): JsonResponse
         $this->authorize('update', Department::class);
         $department = Department::findOrFail($id);
         $department->fill($request->all());
+        $department->company_id = Company::getIdForCurrentUser($request->input('company_id'));
         $department = $request->handleImages($department);
 
         if ($department->save()) {

app/Http/Controllers/Api/LicensesController.php

@@ -8,6 +8,7 @@
 use App\Http\Transformers\ActionlogsTransformer;
 use App\Http\Transformers\LicensesTransformer;
 use App\Http\Transformers\SelectlistTransformer;
+use App\Models\Company;
 use App\Models\License;
 use App\Models\Setting;
 use Illuminate\Http\JsonResponse;
@@ -179,6 +180,7 @@ public function store(Request $request): JsonResponse
         $this->authorize('create', License::class);
         $license = new License;
         $license->fill($request->all());
+        $license->company_id = Company::getIdForCurrentUser($request->input('company_id'));
 
         if ($license->save()) {
             return response()->json(Helper::formatStandardApiResponse('success', $license, trans('admin/licenses/message.create.success')));
@@ -219,6 +221,7 @@ public function update(Request $request, $id): JsonResponse|array
 
         $license = License::findOrFail($id);
         $license->fill($request->all());
+        $license->company_id = Company::getIdForCurrentUser($request->input('company_id'));
 
         if ($license->save()) {
             return response()->json(Helper::formatStandardApiResponse('success', $license, trans('admin/licenses/message.update.success')));

tests/Feature/Accessories/Api/StoreAccessoryTest.php

@@ -2,6 +2,7 @@
 
 namespace Tests\Feature\Accessories\Api;
 
+use App\Models\Accessory;
 use App\Models\Category;
 use App\Models\Company;
 use App\Models\Location;
@@ -23,27 +24,29 @@ public function test_requires_permission()
 
     public function test_adheres_to_full_multiple_companies_support_scoping()
     {
-        $this->markTestSkipped('This behavior is not implemented');
-
         [$companyA, $companyB] = Company::factory()->count(2)->create();
         $userInCompanyA = User::factory()->for($companyA)->createAccessories()->create();
 
         $this->settings->enableMultipleFullCompanySupport();
 
         // attempt to store an accessory for company B
-        $this->actingAsForApi($userInCompanyA)
+        $response = $this->actingAsForApi($userInCompanyA)
             ->postJson(route('api.accessories.store'), [
                 'category_id' => Category::factory()->forAccessories()->create()->id,
                 'name' => 'My Awesome Accessory',
                 'qty' => 1,
                 'company_id' => $companyB->id,
-            ])->assertStatusMessageIs('error');
+            ])->assertStatusMessageIs('success');
 
+        $accessory = Accessory::withoutGlobalScopes()->findOrFail($response['payload']['id']);
+
+        $this->assertSame($companyA->id, $accessory->company_id);
         $this->assertDatabaseMissing('accessories', [
             'name' => 'My Awesome Accessory',
+            'company_id' => $companyB->id,
         ]);
     }
-    
+
 
     public function test_can_store_accessory()
     {

tests/Feature/Accessories/Api/UpdateAccessoryTest.php

@@ -55,6 +55,40 @@ public function test_adheres_to_full_multiple_companies_support_scoping()
         $this->assertEquals('New Name', $accessoryC->fresh()->name);
     }
 
+    public function test_prevents_cross_tenant_company_reassignment_when_fmcs_enabled()
+    {
+        [$companyA, $companyB] = Company::factory()->count(2)->create();
+        $accessory = Accessory::factory()->for($companyA)->create();
+        $userInCompanyA = User::factory()->for($companyA)->editAccessories()->create();
+
+        $this->settings->enableMultipleFullCompanySupport();
+
+        $this->actingAsForApi($userInCompanyA)
+            ->patchJson(route('api.accessories.update', $accessory), [
+                'company_id' => $companyB->id,
+            ])
+            ->assertStatusMessageIs('success');
+
+        $this->assertSame($companyA->id, $accessory->fresh()->company_id);
+    }
+
+    public function test_allows_superuser_company_reassignment_when_fmcs_enabled()
+    {
+        [$companyA, $companyB] = Company::factory()->count(2)->create();
+        $accessory = Accessory::factory()->for($companyA)->create();
+        $superuser = User::factory()->superuser()->create(['company_id' => null]);
+
+        $this->settings->enableMultipleFullCompanySupport();
+
+        $this->actingAsForApi($superuser)
+            ->patchJson(route('api.accessories.update', $accessory), [
+                'company_id' => $companyB->id,
+            ])
+            ->assertStatusMessageIs('success');
+
+        $this->assertSame($companyB->id, $accessory->fresh()->company_id);
+    }
+
     public function test_can_update_accessory_via_patch()
     {
         [$categoryA, $categoryB] = Category::factory()->count(2)->create();