Release 1.6.2 (#1289)

* include user teams in user entity
* prevent unauthorized access via API
* improve teamlead permission handling in team timesheets
* add team data to user entity
* add security tests
* highlight menu for invoice template copy
* unified handling of invoice data across all templates
* access to the current users data in invoice templates
* permission improvement in invoice form
* allow to skip record rows
* allow to add new invoice locations without overwriting the global ones
* allow to order user preferences
* change permission for normal users with access to view_other_timesheets
* properly validate invoice template field length
* allow to replace multiple variables in cell values text
* upgraded office invoice template
* doctrine deprecation fix
* upgrade phpoffice/phpword
* fix future begin check for default rounding rules
* dashboard widget counter: respect visibility and teams - fixes #1161
* fix future begin check for default rounding rules
* added new events for pre and post invoice rendering
* fix permission issue for users without team seeing all records
* prevent error in spreadsheet renderer for empty invoices

tests/Controller/ExportControllerTest.php

@@ -9,6 +9,7 @@
 
 namespace App\Tests\Controller;
 
+use App\Entity\Team;
 use App\Entity\Timesheet;
 use App\Entity\User;
 use App\Tests\DataFixtures\TimesheetFixtures;
@@ -35,15 +36,79 @@ class ExportControllerTest extends ControllerBaseTest
         $this->assertHasNoEntriesWithFilter($client);
     }
 
-    public function testIndexActionWithEntries()
+    public function testIndexActionWithEntriesAndTeams()
+    {
+        $client = $this->getClientForAuthenticatedUser(User::ROLE_TEAMLEAD);
+        $em = $client->getContainer()->get('doctrine.orm.entity_manager');
+
+        $teamlead = $this->getUserByRole($em, User::ROLE_TEAMLEAD);
+        $user = $this->getUserByRole($em, User::ROLE_USER);
+        /** @var Team $team */
+        $team = new Team();
+        $team->setName('fooo');
+        $team->setTeamLead($teamlead);
+        $team->addUser($user);
+        $em->persist($team);
+        $em->persist($user);
+        $em->persist($teamlead);
+        $em->flush();
+
+        $user = $this->getUserByRole($em, User::ROLE_USER);
+
+        $begin = new \DateTime('first day of this month');
+        $fixture = new TimesheetFixtures();
+        $fixture
+            ->setUser($user)
+            ->setAmount(20)
+            ->setStartDate($begin)
+            ->setCallback(function (Timesheet $timesheet) use ($team, $em) {
+                $team->addProject($timesheet->getProject());
+                $em->persist($team);
+            })
+        ;
+        $this->importFixture($em, $fixture);
+
+        $teamlead = $this->getUserByRole($em, User::ROLE_TEAMLEAD);
+
+        $fixture = new TimesheetFixtures();
+        $fixture
+            ->setUser($teamlead)
+            ->setAmount(2)
+            ->setStartDate($begin)
+        ;
+        $this->importFixture($em, $fixture);
+        $em->flush();
+
+        $this->request($client, '/export/?preview=');
+        $this->assertTrue($client->getResponse()->isSuccessful());
+
+        // make sure all existing records are displayed
+        $this->assertHasDataTable($client);
+        $this->assertDataTableRowCount($client, 'datatable_export', 22);
+
+        // assert export type buttons are available
+        $expected = ['csv', 'html', 'pdf', 'xlsx'];
+        $node = $client->getCrawler()->filter('#export-buttons button');
+        $this->assertEquals(count($expected), $node->count());
+        /** @var \DOMElement $button */
+        foreach ($node->getIterator() as $button) {
+            $type = $button->getAttribute('data-type');
+            $this->assertContains($type, $expected);
+        }
+    }
+
+    public function testIndexActionWithEntriesForTeamleadDoesNotShowUserWithoutTeam()
     {
         $client = $this->getClientForAuthenticatedUser(User::ROLE_TEAMLEAD);
         $em = $client->getContainer()->get('doctrine.orm.entity_manager');
 
         $begin = new \DateTime('first day of this month');
+        $user = $this->getUserByRole($em, User::ROLE_USER);
+
+        // these should be ignored, becuase teamlead and user do NOT share a team!
         $fixture = new TimesheetFixtures();
         $fixture
-            ->setUser($this->getUserByRole($em, User::ROLE_USER))
+            ->setUser($user)
             ->setAmount(20)
             ->setStartDate($begin)
         ;
@@ -52,9 +117,25 @@ class ExportControllerTest extends ControllerBaseTest
         $this->request($client, '/export/?preview=');
         $this->assertTrue($client->getResponse()->isSuccessful());
 
+        // make sure all existing records are displayed
+        $this->assertHasNoEntriesWithFilter($client);
+
+        $teamlead = $this->getUserByRole($em, User::ROLE_TEAMLEAD);
+
+        $fixture = new TimesheetFixtures();
+        $fixture
+            ->setUser($teamlead)
+            ->setAmount(2)
+            ->setStartDate($begin)
+        ;
+        $this->importFixture($em, $fixture);
+
+        $this->request($client, '/export/?preview=');
+        $this->assertTrue($client->getResponse()->isSuccessful());
+
         // make sure all existing records are displayed
         $this->assertHasDataTable($client);
-        $this->assertDataTableRowCount($client, 'datatable_export', 20);
+        $this->assertDataTableRowCount($client, 'datatable_export', 2);
 
         // assert export type buttons are available
         $expected = ['csv', 'html', 'pdf', 'xlsx'];
@@ -102,7 +183,7 @@ class ExportControllerTest extends ControllerBaseTest
 
     public function testExportAction()
     {
-        $client = $this->getClientForAuthenticatedUser(User::ROLE_TEAMLEAD);
+        $client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
         /** @var EntityManager $em */
         $em = $client->getContainer()->get('doctrine.orm.entity_manager');