Merge remote-tracking branch 'origin/develop'

Author: snipe

app/Http/Controllers/Assets/BulkAssetsController.php

@@ -656,6 +656,21 @@ public function storeCheckout(AssetCheckoutRequest $request) : RedirectResponse
                     ->with('error', trans('general.error_assets_already_checked_out'));
             }
 
+            // Prevent checking out assets across companies if FMCS enabled
+            if (Setting::getSettings()->full_multiple_companies_support && $target->company_id) {
+                $company_ids = $assets->pluck('company_id')->unique();
+
+                // if there is more than one unique company id or the singular company id does not match
+                // then the checkout is invalid
+                if ($company_ids->count() > 1 || $company_ids->first() != $target->company_id) {
+                    // re-add the asset ids so the assets select is re-populated
+                    $request->session()->flashInput(['selected_assets' => $asset_ids]);
+
+                    return redirect(route('hardware.bulkcheckout.show'))
+                        ->with('error', trans('general.error_user_company_multiple'));
+                }
+            }
+
             if (request('checkout_to_type') == 'asset') {
                 foreach ($asset_ids as $asset_id) {
                     if ($target->id == $asset_id) {

resources/lang/en-US/general.php

@@ -519,6 +519,7 @@
     'item_notes' => ':item Notes',
     'item_name_var' => ':item Name',
     'error_user_company' => 'Checkout target company and asset company do not match',
+    'error_user_company_multiple' => 'One or more of the checkout target company and asset company do not match',
     'error_user_company_accept_view' => 'An Asset assigned to you belongs to a different company so you can\'t accept nor deny it, please check with your manager',
     'error_assets_already_checked_out' => 'One or more of the assets are already checked out',
     'importer' => [

resources/views/hardware/checkout.blade.php

@@ -94,7 +94,7 @@
                         </div>
 
                         @include ('partials.forms.checkout-selector', ['user_select' => 'true','asset_select' => 'true', 'location_select' => 'true'])
-                        @include ('partials.forms.edit.user-select', ['translated_name' => trans('general.user'), 'fieldname' => 'assigned_user', 'style' => session('checkout_to_type') == 'user' ? '' : 'display: none;'])
+                        @include ('partials.forms.edit.user-select', ['translated_name' => trans('general.user'), 'fieldname' => 'assigned_user', 'style' => (session('checkout_to_type') ?: 'user') == 'user' ? '' : 'display: none;'])
                         <!-- We have to pass unselect here so that we don't default to the asset that's being checked out. We want that asset to be pre-selected everywhere else. -->
                         @include ('partials.forms.edit.asset-select', ['translated_name' => trans('general.select_asset'), 'fieldname' => 'assigned_asset', 'company_id' => $asset->company_id, 'unselect' => 'true', 'style' => session('checkout_to_type') == 'asset' ? '' : 'display: none;'])
                         @include ('partials.forms.edit.location-select', ['translated_name' => trans('general.location'), 'fieldname' => 'assigned_location', 'style' => session('checkout_to_type') == 'location' ? '' : 'display: none;'])

resources/views/partials/forms/checkout-selector.blade.php

@@ -4,22 +4,25 @@
 
         <div class="btn-group" data-toggle="buttons">
             @if ((isset($user_select)) && ($user_select!='false'))
-            <label class="btn btn-default{{ session('checkout_to_type') == 'user' ? ' active' : '' }}">
-                <input name="checkout_to_type" value="user" aria-label="checkout_to_type" type="radio" checked="checked">
+                <label class="btn btn-default{{ (session('checkout_to_type') ?: 'user') == 'user' ? ' active' : '' }}">
+                    <input name="checkout_to_type" value="user" aria-label="checkout_to_type"
+                           type="radio" {{ (session('checkout_to_type') ?: 'user') == 'user' ? 'checked' : '' }}>
                 <x-icon type="user" />
                 {{ trans('general.user') }}
             </label>
             @endif
             @if ((isset($asset_select)) && ($asset_select!='false'))
-            <label class="btn btn-default{{ session('checkout_to_type') == 'asset' ? ' active' : '' }}">
-                <input name="checkout_to_type" value="asset" aria-label="checkout_to_type" type="radio">
+                <label class="btn btn-default{{ session('checkout_to_type') == 'asset' ? ' active' : '' }}">
+                    <input name="checkout_to_type" value="asset" aria-label="checkout_to_type"
+                           type="radio" {{ session('checkout_to_type') == 'asset' ? 'checked': '' }}>
                 <i class="fas fa-barcode" aria-hidden="true"></i>
                 {{ trans('general.asset') }}
             </label>
             @endif
             @if ((isset($location_select)) && ($location_select!='false'))
-            <label class="btn btn-default{{ session('checkout_to_type') == 'location' ? ' active' : '' }}">
-                <input name="checkout_to_type" value="location" aria-label="checkout_to_type" class="active" type="radio">
+                <label class="btn btn-default{{ session('checkout_to_type') == 'location' ? ' active' : '' }}">
+                    <input name="checkout_to_type" value="location" aria-label="checkout_to_type"
+                           type="radio" {{ session('checkout_to_type') == 'location' ? 'checked' : '' }}>
                 <i class="fas fa-map-marker-alt" aria-hidden="true"></i>
                 {{ trans('general.location') }}
             </label>

resources/views/settings/backups.blade.php

@@ -150,7 +150,7 @@ class="btn btn-warning btn-sm restore-backup {{ (config('app.lock_passwords')) ?
       <div class="box-body">
 
         <p>
-          {!! trans('admin/settings/general.backups_path', ['path'=> 'storage/app/backup']) !!}
+          {!! trans('admin/settings/general.backups_path', ['path'=> 'storage/app/backups']) !!}
         </p>
 
         @if (config('app.lock_passwords')===true)

routes/api.php

@@ -583,9 +583,7 @@
     // the model name to be the parameter - and i think it's a good differentiation in the code while we convert the others.
     Route::patch('/hardware/{asset}', [Api\AssetsController::class, 'update'])->name('api.assets.update');
     Route::put('/hardware/{asset}', [Api\AssetsController::class, 'update'])->name('api.assets.put-update');
-
-    Route::put('/hardware/{asset}', [Api\AssetsController::class, 'update'])->name('api.assets.put-update');
-
+    
     Route::resource('hardware',
         Api\AssetsController::class,
         ['names' => [

tests/Feature/Checkouts/Ui/BulkAssetCheckoutTest.php

@@ -4,6 +4,7 @@
 
 use App\Mail\CheckoutAssetMail;
 use App\Models\Asset;
+use App\Models\Company;
 use App\Models\Location;
 use App\Models\User;
 use Illuminate\Support\Facades\Mail;
@@ -122,6 +123,42 @@ function () {
         ];
     }
 
+    #[DataProvider('checkoutTargets')]
+    public function test_adheres_to_full_multiple_company_support($data)
+    {
+        ['type' => $type, 'target' => $target] = $data();
+
+        $this->settings->enableMultipleFullCompanySupport();
+
+        // create two companies
+        [$companyA, $companyB] = Company::factory()->count(2)->create();
+
+        // create an asset for each company
+        $assetForCompanyA = Asset::factory()->for($companyA)->create();
+        $assetForCompanyB = Asset::factory()->for($companyB)->create();
+
+        $this->assertNull($assetForCompanyA->assigned_to, 'Asset should not be assigned before attempting this test case.');
+        $this->assertNull($assetForCompanyB->assigned_to, 'Asset should not be assigned before attempting this test case.');
+
+        // attempt to bulk checkout both items to the target
+        $response = $this->actingAs(User::factory()->superuser()->create())
+            ->post(route('hardware.bulkcheckout.store'), [
+                'selected_assets' => [
+                    $assetForCompanyA->id,
+                    $assetForCompanyB->id,
+                ],
+                'checkout_to_type' => $type,
+                "assigned_$type" => $target->id,
+            ]);
+
+        // ensure bulk checkout is blocked
+        $this->assertNull($assetForCompanyA->fresh()->assigned_to, 'Asset was checked out across companies.');
+        $this->assertNull($assetForCompanyB->fresh()->assigned_to, 'Asset was checked out across companies.');
+
+        // ensure redirected back
+        $response->assertRedirectToRoute('hardware.bulkcheckout.show');
+    }
+
     #[DataProvider('checkoutTargets')]
     public function test_prevents_checkouts_of_checked_out_items($data)
     {