jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

check customer permissions on invoice api access (#5849)

Browse Source
This commit is contained in:
Kevin Papst
2026-03-01 16:53:49 +01:00
committed by GitHub
parent 5b320bf2ea
commit a0601c8cb2
2 changed files with 63 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

58
tests/API/InvoiceControllerTest.php
View File

@@ -9,8 +9,11 @@
namespace App\Tests\API;
use App\Entity\Customer;
use App\Entity\Invoice;
use App\Entity\Team;
use App\Entity\User;
use App\Repository\TeamRepository;
use App\Tests\DataFixtures\InvoiceFixtures;
use PHPUnit\Framework\Attributes\Group;
@@ -123,4 +126,59 @@ class InvoiceControllerTest extends APIControllerBaseTestCase
{
$this->assertEntityNotFound(User::ROLE_USER, '/api/invoices/' . PHP_INT_MAX);
}
public function testDownloadRespectsCustomerPermission(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_TEAMLEAD);
$invoices = $this->importInvoiceFixtures(1, [Invoice::STATUS_NEW]);
$invoice = $invoices[0];
$customer = $invoice->getCustomer();
self::assertInstanceOf(Customer::class, $customer);
$this->assertAccessIsGranted($client, '/api/invoices/' . $invoice->getId());
$content = $client->getResponse()->getContent();
self::assertIsString($content);
$result = json_decode($content, true);
self::assertIsArray($result);
self::assertApiResponseTypeStructure('Invoice', $result);
$team = new Team('foo');
$team->addTeamlead($this->getUserByRole(User::ROLE_ADMIN));
$team->addCustomer($customer);
$em = $this->getEntityManager();
/** @var TeamRepository $repository */
$repository = $em->getRepository(Team::class);
$repository->saveTeam($team);
$this->assertApiAccessDenied($client, '/api/invoices/' . $invoice->getId());
}
public function testCollectionRespectsCustomerPermission(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_TEAMLEAD);
$invoices = $this->importInvoiceFixtures(1, [Invoice::STATUS_NEW]);
$invoice = $invoices[0];
$customer = $invoice->getCustomer();
self::assertInstanceOf(Customer::class, $customer);
$query = ['customers' => [$customer->getId()]];
$this->assertAccessIsGranted($client, '/api/invoices', 'GET', $query);
$team = new Team('foo');
$team->addTeamlead($this->getUserByRole(User::ROLE_ADMIN));
$team->addCustomer($customer);
$em = $this->getEntityManager();
/** @var TeamRepository $repository */
$repository = $em->getRepository(Team::class);
$repository->saveTeam($team);
$this->request($client, '/api/invoices', 'GET', $query);
$this->assertApiResponseAccessDenied($client->getResponse());
}
}