actingAsForApi(User::factory()->create()) ->getJson(route('api.assets.assigned_assets' , Asset::factory()->create())) ->assertForbidden(); } public function test_adheres_to_company_scoping() { $this->settings->enableMultipleFullCompanySupport(); [$companyA, $companyB] = Company::factory()->count(2)->create(); $asset = Asset::factory()->for($companyA)->create(); $user = User::factory()->for($companyB)->viewAssets()->create(); $this->actingAsForApi($user) ->getJson(route('api.assets.assigned_assets', $asset)) ->assertOk() ->assertStatusMessageIs('error') ->assertMessagesAre('Asset not found'); } public function test_can_get_assets_assigned_to_specific_asset() { $unassociatedAsset = Asset::factory()->create(); $asset = Asset::factory()->hasAssignedAssets(2)->create(); $assetsAssignedToAsset = Asset::where([ 'assigned_to' => $asset->id, 'assigned_type' => Asset::class, ])->get(); $this->actingAsForApi(User::factory()->viewAssets()->create()) ->getJson(route('api.assets.assigned_assets', $asset)) ->assertOk() ->assertResponseContainsInRows($assetsAssignedToAsset, 'serial') ->assertResponseDoesNotContainInRows($unassociatedAsset, 'serial'); } }