diff --git a/app/Livewire/Team/AuditLog.php b/app/Livewire/Team/AuditLog.php index 53cb203eff..9cf3ada8c8 100644 --- a/app/Livewire/Team/AuditLog.php +++ b/app/Livewire/Team/AuditLog.php @@ -22,7 +22,9 @@ class AuditLog extends Component public function boot(): void { - abort_unless(auth()->user()->isAdminOfTeam(currentTeam()->id), 403); + $team = currentTeam(); + + abort_unless($team && auth()->user()->isAdminOfTeam($team->id), 403); } public function updatedSearch(): void diff --git a/tests/Feature/TeamAuditLogWithoutSessionTeamTest.php b/tests/Feature/TeamAuditLogWithoutSessionTeamTest.php new file mode 100644 index 0000000000..2d861d0fb6 --- /dev/null +++ b/tests/Feature/TeamAuditLogWithoutSessionTeamTest.php @@ -0,0 +1,48 @@ + InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0])); + + $this->team = Team::factory()->create(); + $this->secondTeam = Team::factory()->create(); + $this->user = User::factory()->create(); + $this->team->members()->attach($this->user->id, ['role' => 'admin']); + $this->secondTeam->members()->attach($this->user->id, ['role' => 'owner']); + $this->actingAs($this->user); + session(['currentTeam' => $this->team]); +}); + +test('the audit log is forbidden when the session has no team', function () { + session()->forget('currentTeam'); + + Livewire::test(AuditLog::class)->assertForbidden(); +}); + +test('an open audit log is forbidden after the session team is removed from the user', function () { + $component = Livewire::test(AuditLog::class)->assertOk(); + + $this->team->members()->detach($this->user->id); + auth()->setUser($this->user->fresh()); + + $component->set('search', 'deployment')->assertForbidden(); +}); + +test('team admins can still open the audit log', function () { + Livewire::test(AuditLog::class)->assertOk(); +}); + +test('team members cannot open the audit log', function () { + $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']); + auth()->setUser($this->user->fresh()); + + Livewire::test(AuditLog::class)->assertForbidden(); +});