From 92ae06962942f985822f2ba888cfabbb70f74223 Mon Sep 17 00:00:00 2001 From: snipe Date: Tue, 7 May 2024 12:06:35 +0100 Subject: [PATCH 01/14] Disable button in UI if user cannot be deleted Signed-off-by: snipe --- resources/views/users/view.blade.php | 67 ++++++++++++++++++++++++---- 1 file changed, 58 insertions(+), 9 deletions(-) diff --git a/resources/views/users/view.blade.php b/resources/views/users/view.blade.php index 3dbd9ff53..7a9d0f579 100755 --- a/resources/views/users/view.blade.php +++ b/resources/views/users/view.blade.php @@ -91,7 +91,7 @@ @if ($user->managedLocations()->count() >= 0 )
  • - +
  • @endif - @can('update', $user) + @if ($user->managesUsers()->count() >= 0 ) +
  • + + + +
  • + @endif + + + @can('update', $user) - @if ($user->managedLocations()->count() >= 0 ) + @if ($user->managedLocations->count() >= 0 )
  • @endif - @if ($user->managesUsers()->count() >= 0 ) + @if ($user->managesUsers->count() >= 0 )
  • + From 386b2839e860e3e5de22154a02b804e3faf145c7 Mon Sep 17 00:00:00 2001 From: snipe Date: Tue, 7 May 2024 18:59:24 +0100 Subject: [PATCH 13/14] Added tests Signed-off-by: snipe --- tests/Feature/Api/Users/UsersDeleteTest.php | 42 +++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 tests/Feature/Api/Users/UsersDeleteTest.php diff --git a/tests/Feature/Api/Users/UsersDeleteTest.php b/tests/Feature/Api/Users/UsersDeleteTest.php new file mode 100644 index 000000000..cbdba8327 --- /dev/null +++ b/tests/Feature/Api/Users/UsersDeleteTest.php @@ -0,0 +1,42 @@ +create(['first_name' => 'Manager', 'last_name' => 'McManagerson']); + User::factory()->create(['first_name' => 'Lowly', 'last_name' => 'Worker', 'manager_id' => $manager->id]); + $this->actingAs(User::factory()->deleteUsers()->create())->assertFalse($manager->isDeletable()); + } + + public function testDisallowUserDeletionIfStillManagingLocations() + { + $manager = User::factory()->create(['first_name' => 'Manager', 'last_name' => 'McManagerson']); + Location::factory()->create(['manager_id' => $manager->id]); + $this->actingAs(User::factory()->deleteUsers()->create())->assertFalse($manager->isDeletable()); + } + + public function testAllowUserDeletionIfNotManagingLocations() + { + $manager = User::factory()->create(['first_name' => 'Manager', 'last_name' => 'McManagerson']); + $this->actingAs(User::factory()->deleteUsers()->create())->assertTrue($manager->isDeletable()); + } + + public function testDisallowUserDeletionIfNoDeletePermissions() + { + $manager = User::factory()->create(['first_name' => 'Manager', 'last_name' => 'McManagerson']); + Location::factory()->create(['manager_id' => $manager->id]); + $this->actingAs(User::factory()->editUsers()->create())->assertFalse($manager->isDeletable()); + } + + +} From 8c327e6523fe170606124b823abdcbe85e92b41a Mon Sep 17 00:00:00 2001 From: snipe Date: Tue, 7 May 2024 19:16:56 +0100 Subject: [PATCH 14/14] Handle user not found properly Signed-off-by: snipe --- app/Http/Controllers/Api/UsersController.php | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/app/Http/Controllers/Api/UsersController.php b/app/Http/Controllers/Api/UsersController.php index f2f2f28b8..0faa54124 100644 --- a/app/Http/Controllers/Api/UsersController.php +++ b/app/Http/Controllers/Api/UsersController.php @@ -416,11 +416,14 @@ class UsersController extends Controller $this->authorize('view', User::class); $user = User::withCount('assets as assets_count', 'licenses as licenses_count', 'accessories as accessories_count', 'consumables as consumables_count', 'managesUsers as manages_users_count', 'managedLocations as manages_locations_count'); - $user = Company::scopeCompanyables($user)->find($id); - $this->authorize('view', $user); + if ($user = Company::scopeCompanyables($user)->find($id)) { + $this->authorize('view', $user); + return (new UsersTransformer)->transformUser($user); + } + + return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/users/message.user_not_found', compact('id')))); - return (new UsersTransformer)->transformUser($user); }