feat(asset_categories): scope to authority

Author: stakach

shard.lock

@@ -215,15 +215,15 @@ shards:
 
   placeos-frontend-loader:
     git: https://github.com/placeos/frontend-loader.git
-    version: 2.7.1+git.commit.ada234ef40f9c59b10c4427d85204d1fa571f342
+    version: 2.7.1+git.commit.10d4c9de65ee4f9b41c3168fd4c089fc3b11ba9d
 
   placeos-log-backend:
     git: https://github.com/place-labs/log-backend.git
     version: 0.13.0
 
   placeos-models:
     git: https://github.com/placeos/models.git
-    version: 9.100.0
+    version: 9.100.1
 
   placeos-resource:
     git: https://github.com/place-labs/resource.git
@@ -275,7 +275,7 @@ shards:
 
   search-ingest:
     git: https://github.com/placeos/search-ingest.git
-    version: 2.11.3+git.commit.fd285c0ea5a86ddde4132b0f06a068489e59a8ff
+    version: 2.11.3+git.commit.6f2d42f8d93ce280ba4160112476862e4be5b1c0
 
   secrets-env: # Overridden
     git: https://github.com/spider-gazelle/secrets-env.git

spec/controllers/asset_categories_spec.cr

@@ -24,6 +24,55 @@ module PlaceOS::Api
       end
     end
 
+    describe "authority ownership" do
+      it "sets the authority_id from the current authority on create" do
+        body = Model::Generator.asset_category.to_json
+        result = client.post(
+          AssetCategories.base_route,
+          body: body,
+          headers: Spec::Authentication.headers(sys_admin: true, support: false),
+        )
+        result.status_code.should eq 201
+
+        created = Model::AssetCategory.from_trusted_json(result.body)
+        authority = Model::Authority.find_by_domain("localhost").not_nil!
+        created.authority_id.should eq authority.id
+        created.destroy
+      end
+
+      it "rejects updates to a category owned by another authority" do
+        other_authority = Model::Generator.authority(domain: "https://other-asset-cat.example.com").save!
+        asset_category = Model::Generator.asset_category(other_authority).save!
+
+        result = client.patch(
+          path: "#{AssetCategories.base_route}#{asset_category.id}",
+          body: {name: "renamed-#{random_name}"}.to_json,
+          headers: Spec::Authentication.headers(sys_admin: true, support: false),
+        )
+        result.status_code.should eq 403
+
+        asset_category.destroy
+        other_authority.destroy
+      end
+
+      it "adopts a legacy category with no authority on update" do
+        asset_category = Model::Generator.asset_category.save!
+        # simulate a legacy record predating the authority_id column
+        asset_category.update_fields(authority_id: nil)
+
+        result = client.patch(
+          path: "#{AssetCategories.base_route}#{asset_category.id}",
+          body: {name: "renamed-#{random_name}"}.to_json,
+          headers: Spec::Authentication.headers(sys_admin: true, support: false),
+        )
+        result.success?.should be_true
+
+        authority = Model::Authority.find_by_domain("localhost").not_nil!
+        Model::AssetCategory.find!(asset_category.id).authority_id.should eq authority.id
+        asset_category.destroy
+      end
+    end
+
     describe "scopes" do
       Spec.test_controller_scope(AssetCategories)
     end

src/placeos-rest-api/controllers/asset_categories.cr

@@ -72,14 +72,24 @@ module PlaceOS::Api
     @[AC::Route::PUT("/:id", body: :asset_category)]
     def update(asset_category : ::PlaceOS::Model::AssetCategory) : ::PlaceOS::Model::AssetCategory
       current = current_asset_category
+      authority_id = current_authority.as(::PlaceOS::Model::Authority).id
+
+      # A category that already belongs to another authority may not be edited.
+      # Legacy records with no authority get adopted by the current authority.
+      if (existing = current.authority_id) && existing != authority_id
+        raise Error::Forbidden.new("asset category belongs to another authority")
+      end
+
       current.assign_attributes(asset_category)
+      current.authority_id = authority_id
       raise Error::ModelValidation.new(current.errors) unless current.save
       current
     end
 
     # add new asset category
     @[AC::Route::POST("/", body: :asset_category, status_code: HTTP::Status::CREATED)]
     def create(asset_category : ::PlaceOS::Model::AssetCategory) : ::PlaceOS::Model::AssetCategory
+      asset_category.authority_id = current_authority.as(::PlaceOS::Model::Authority).id
       raise Error::ModelValidation.new(asset_category.errors) unless asset_category.save
       asset_category
     end