Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updated Company::getIdForCurrentUser() to return null in certain scenarios #15691

Draft
wants to merge 12 commits into
base: develop
Choose a base branch
from

Conversation

marcusmoore
Copy link
Collaborator

Description

This PR fixes a bug in the Company::getIdForCurrentUser() method when full multiple company support was enabled, the acting user was not a super user and didn't have a company_id set the provided input was returned instead of null like expected.

This follows up the fix in #15660 by re-adding the code that was removed in the form request and handling it in the bug in the Company::getIdForCurrentUser() method mentioned above.

This PR is mostly test code testing some, but not all, of the places the method is being used.

Type of change

  • Bug fix (non-breaking change which fixes an issue)

Copy link

what-the-diff bot commented Oct 17, 2024

PR Summary

  • Enhanced Validation in StoreAssetRequest.php

    • The updated logic ensures that the company_id entered is verified as an integer. This enhancement will improve data validity and system robustness, avoiding any possible errors or mismatches.
  • Behavior Consistency in Company.php

    • Now, whenever there is no associated company for a non-super user, the system will return null instead of returning inconsistent values. This feature ensures that the system remains predictable and maintains its consistency.
  • Introduction of Test Files for Accessory Creation Functionality

    • The new test file CreateAccessoryWithFullMultipleCompanySupportTest.php assesses how the accessory creation functionality performs when there is support from multiple companies. This measure would ensure the smoother and efficient functioning of this feature.
  • Improvements in StoreAssetTest.php

    • The inclusion of an external issue's comment aids in understanding why it is necessary for company_id to be confirmed as an integer, providing insight into the design decision.
  • Comprehensive Tests for Multiple Company Support

    • The PR introduces several new test files. These particularly test an asset's storage functionality with full multi-company support, spanning components, consumables, and licenses. The thorough testing will reinforce the system's reliability and stability.
  • Introducing a Support Trait for Testing

    • ProvidesDataForFullMultipleCompanySupportTesting.php has been added, providing common test data for multiple company support testing scenarios across the platform.
  • Refined Test Function Naming in GetIdForCurrentUserTest.php

    • A test function has been renamed for improved clarity, accurately reflecting an updated behavior that returns null for non-super users without any associated companies.

Copy link
Contributor

@Toreg87 Toreg87 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is wrong and reintroduces the bug that with FullMultipleCompanySupport a normal user can create assets with arbitrary company_id.

is_int checks the type of the variable. But the default behaviour of postman seems to be that the values are strings. I tested this further with a simple python requests and can confirm that when I create the payload values as integer the code works as expected. But when I create the payload values as strings, the code happily accepts every existing company_id.

So the correct behaviour should be to look at the value of the company_id, not the type. is_numeric seems to be the right function here.

@marcusmoore marcusmoore marked this pull request as draft October 19, 2024 02:19
@marcusmoore
Copy link
Collaborator Author

Thanks for the review @Toreg87. I moved this back to draft to review and address your comments.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants