Apply same team detach sync to permissions

Author: drbyte

src/Traits/HasPermissions.php

@@ -5,6 +5,7 @@
 use BackedEnum;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Relations\BelongsToMany;
+use Illuminate\Database\Eloquent\Relations\Pivot;
 use Illuminate\Support\Arr;
 use Illuminate\Support\Collection;
 use Spatie\Permission\Contracts\Permission;
@@ -385,6 +386,32 @@ private function collectPermissions(...$permissions): array
             }, []);
     }
 
+    private function detachPermissions(?array $permissions = null): int
+    {
+        $relation = $this->permissions();
+
+        if (! Config::teamsEnabled() || $this instanceof Role || $relation->getPivotClass() === Pivot::class) {
+            return $relation->detach($permissions);
+        }
+
+        // Custom pivot deletes do not include the team key, so keep deletion on the scoped pivot query.
+        $query = $relation->newPivotQuery();
+
+        if (! is_null($permissions)) {
+            if (empty($permissions)) {
+                return 0;
+            }
+
+            $query->whereIn($relation->getQualifiedRelatedPivotKeyName(), $permissions);
+        }
+
+        $results = $query->delete();
+
+        $relation->touchIfTouching();
+
+        return $results;
+    }
+
     /**
      * Grant the given permission(s) to a role.
      *
@@ -458,7 +485,7 @@ public function syncPermissions(...$permissions): static
                     $this->revokePermissionTo($currentPermissions);
                 }
             } else {
-                $this->permissions()->detach();
+                $this->detachPermissions();
                 $this->setRelation('permissions', collect());
             }
         }
@@ -475,8 +502,9 @@ public function syncPermissions(...$permissions): static
     public function revokePermissionTo($permission): static
     {
         $storedPermission = $this->getStoredPermission($permission);
+        $permissions = $this->collectPermissions($storedPermission);
 
-        $this->permissions()->detach($storedPermission);
+        $this->detachPermissions($permissions);
 
         if ($this instanceof Role) {
             $this->forgetCachedPermissions();

tests/Traits/HasPermissionsTest.php

@@ -1,6 +1,8 @@
 <?php
 
 use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsToMany;
+use Illuminate\Database\Eloquent\Relations\MorphPivot;
 use Illuminate\Support\Facades\Event;
 use Spatie\Permission\Contracts\Permission;
 use Spatie\Permission\Contracts\Role;
@@ -11,6 +13,22 @@
 use Spatie\Permission\Tests\TestSupport\TestModels\SoftDeletingUser;
 use Spatie\Permission\Tests\TestSupport\TestModels\TestRolePermissionsEnum;
 use Spatie\Permission\Tests\TestSupport\TestModels\User;
+use Spatie\Permission\Tests\TestSupport\TestModels\UserWithoutHasRoles;
+use Spatie\Permission\Traits\HasRoles;
+
+class HasPermissionsCustomPivot extends MorphPivot {}
+
+class HasPermissionsCustomPivotUser extends UserWithoutHasRoles
+{
+    use HasRoles {
+        permissions as traitPermissions;
+    }
+
+    public function permissions(): BelongsToMany
+    {
+        return $this->traitPermissions()->using(HasPermissionsCustomPivot::class);
+    }
+}
 
 it('can assign a permission to a user', function () {
     $this->testUser->givePermissionTo($this->testUserPermission);
@@ -52,6 +70,26 @@
     expect($this->testUser->hasPermissionTo($this->testUserPermission))->toBeFalse();
 });
 
+it('can revoke a permission when using a custom pivot class without teams', function () {
+    config()->set('auth.providers.users.model', HasPermissionsCustomPivotUser::class);
+
+    $user = HasPermissionsCustomPivotUser::create(['email' => 'custom-pivot-permissions-without-teams@test.com']);
+
+    $user->givePermissionTo('edit-articles', 'edit-news');
+
+    expect($user->getPermissionNames()->sort()->values())
+        ->toEqual(collect(['edit-articles', 'edit-news']));
+
+    $user->revokePermissionTo('edit-articles');
+
+    expect($user->getPermissionNames()->sort()->values())
+        ->toEqual(collect(['edit-news']));
+
+    $user->syncPermissions([]);
+
+    expect($user->getPermissionNames())->toBeEmpty();
+});
+
 it('can assign and remove a permission using enums', function () {
     $enum = TestRolePermissionsEnum::ViewArticles;
 

tests/Traits/TeamHasPermissionsTest.php

@@ -1,6 +1,8 @@
 <?php
 
 use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsToMany;
+use Illuminate\Database\Eloquent\Relations\MorphPivot;
 use Illuminate\Support\Facades\Event;
 use Spatie\Permission\Contracts\Permission;
 use Spatie\Permission\Contracts\Role;
@@ -11,6 +13,24 @@
 use Spatie\Permission\Tests\TestSupport\TestModels\SoftDeletingUser;
 use Spatie\Permission\Tests\TestSupport\TestModels\TestRolePermissionsEnum;
 use Spatie\Permission\Tests\TestSupport\TestModels\User;
+use Spatie\Permission\Tests\TestSupport\TestModels\UserWithoutHasRoles;
+use Spatie\Permission\Traits\HasRoles;
+
+class TeamHasPermissionsCustomPivot extends MorphPivot {}
+
+class TeamHasPermissionsCustomPivotUser extends UserWithoutHasRoles
+{
+    use HasRoles {
+        permissions as traitPermissions;
+    }
+
+    public function permissions(): BelongsToMany
+    {
+        return $this->traitPermissions()
+            ->withPivot('team_test_id')
+            ->using(TeamHasPermissionsCustomPivot::class);
+    }
+}
 
 beforeEach(fn () => $this->setUpTeams());
 
@@ -756,6 +776,114 @@
         ->toEqual(collect(['edit-articles', 'edit-blog']));
 });
 
+it('can revoke a permission from one team when using a custom pivot class', function () {
+    config()->set('auth.providers.users.model', TeamHasPermissionsCustomPivotUser::class);
+
+    $user = TeamHasPermissionsCustomPivotUser::create(['email' => 'custom-pivot-revoke-permission@test.com']);
+
+    setPermissionsTeamId(1);
+    $user->givePermissionTo('edit-articles', 'edit-news');
+
+    setPermissionsTeamId(2);
+    $user->givePermissionTo('edit-articles', 'edit-blog');
+    $user->load('permissions');
+
+    expect($user->getPermissionNames()->sort()->values())
+        ->toEqual(collect(['edit-articles', 'edit-blog']));
+
+    setPermissionsTeamId(1);
+    $user->load('permissions');
+
+    expect($user->getPermissionNames()->sort()->values())
+        ->toEqual(collect(['edit-articles', 'edit-news']));
+
+    $user->revokePermissionTo('edit-articles');
+
+    expect($user->getPermissionNames()->sort()->values())
+        ->toEqual(collect(['edit-news']));
+
+    setPermissionsTeamId(2);
+    $user->load('permissions');
+
+    expect($user->getPermissionNames()->sort()->values())
+        ->toEqual(collect(['edit-articles', 'edit-blog']));
+});
+
+it('can sync permissions for one team when using a custom pivot class', function () {
+    config()->set('auth.providers.users.model', TeamHasPermissionsCustomPivotUser::class);
+
+    $user = TeamHasPermissionsCustomPivotUser::create(['email' => 'custom-pivot-sync-permissions@test.com']);
+
+    setPermissionsTeamId(1);
+    $user->givePermissionTo('edit-articles', 'edit-news');
+
+    setPermissionsTeamId(2);
+    $user->givePermissionTo('edit-articles', 'edit-blog');
+
+    setPermissionsTeamId(1);
+    $user->syncPermissions('edit-news');
+
+    expect($user->getPermissionNames()->sort()->values())
+        ->toEqual(collect(['edit-news']));
+
+    setPermissionsTeamId(2);
+    $user->load('permissions');
+
+    expect($user->getPermissionNames()->sort()->values())
+        ->toEqual(collect(['edit-articles', 'edit-blog']));
+});
+
+it('can sync permissions with events for one team when using a custom pivot class', function () {
+    Event::fake([PermissionDetachedEvent::class, PermissionAttachedEvent::class]);
+    app('config')->set('permission.events_enabled', true);
+    config()->set('auth.providers.users.model', TeamHasPermissionsCustomPivotUser::class);
+
+    $user = TeamHasPermissionsCustomPivotUser::create(['email' => 'custom-pivot-sync-permissions-events@test.com']);
+
+    setPermissionsTeamId(1);
+    $user->givePermissionTo('edit-articles', 'edit-news');
+
+    setPermissionsTeamId(2);
+    $user->givePermissionTo('edit-articles', 'edit-blog');
+
+    setPermissionsTeamId(1);
+    $user->syncPermissions('edit-news');
+
+    expect($user->getPermissionNames()->sort()->values())
+        ->toEqual(collect(['edit-news']));
+
+    Event::assertDispatched(PermissionDetachedEvent::class);
+
+    setPermissionsTeamId(2);
+    $user->load('permissions');
+
+    expect($user->getPermissionNames()->sort()->values())
+        ->toEqual(collect(['edit-articles', 'edit-blog']));
+});
+
+it('can sync to no permissions for one team when using a custom pivot class', function () {
+    config()->set('auth.providers.users.model', TeamHasPermissionsCustomPivotUser::class);
+
+    $user = TeamHasPermissionsCustomPivotUser::create(['email' => 'custom-pivot-sync-empty-permissions@test.com']);
+
+    setPermissionsTeamId(1);
+    $user->givePermissionTo('edit-articles', 'edit-news');
+
+    setPermissionsTeamId(2);
+    $user->givePermissionTo('edit-articles');
+
+    setPermissionsTeamId(1);
+    $user->syncPermissions([]);
+
+    expect($user->getPermissionNames())->toBeEmpty();
+
+    setPermissionsTeamId(2);
+    $user->load('permissions');
+
+    expect($user->getPermissionNames()->sort()->values())
+        ->toEqual(collect(['edit-articles']));
+});
+
 it('can scope users on different teams', function () {
     $user1 = User::create(['email' => 'user1@test.com']);
     $user2 = User::create(['email' => 'user2@test.com']);

tests/Traits/TeamHasRolesTest.php

@@ -1026,6 +1026,59 @@ public function roles(): BelongsToMany
         ->toEqual(collect(['testRole', 'testRole3']));
 });
 
+it('can sync roles with events for one team when using a custom pivot class', function () {
+    Event::fake([RoleDetachedEvent::class, RoleAttachedEvent::class]);
+    app('config')->set('permission.events_enabled', true);
+    config()->set('auth.providers.users.model', TeamHasRolesCustomPivotUser::class);
+
+    app(Role::class)->create(['name' => 'testRole3', 'team_test_id' => 2]);
+
+    $user = TeamHasRolesCustomPivotUser::create(['email' => 'custom-pivot-sync-roles-events@test.com']);
+
+    setPermissionsTeamId(1);
+    $user->assignRole('testRole', 'testRole2');
+
+    setPermissionsTeamId(2);
+    $user->assignRole('testRole', 'testRole3');
+
+    setPermissionsTeamId(1);
+    $user->syncRoles('testRole2');
+
+    expect($user->getRoleNames()->sort()->values())
+        ->toEqual(collect(['testRole2']));
+
+    Event::assertDispatched(RoleDetachedEvent::class);
+
+    setPermissionsTeamId(2);
+    $user->load('roles');
+
+    expect($user->getRoleNames()->sort()->values())
+        ->toEqual(collect(['testRole', 'testRole3']));
+});
+
+it('can sync to no roles for one team when using a custom pivot class', function () {
+    config()->set('auth.providers.users.model', TeamHasRolesCustomPivotUser::class);
+
+    $user = TeamHasRolesCustomPivotUser::create(['email' => 'custom-pivot-sync-empty-roles@test.com']);
+
+    setPermissionsTeamId(1);
+    $user->assignRole('testRole', 'testRole2');
+
+    setPermissionsTeamId(2);
+    $user->assignRole('testRole');
+
+    setPermissionsTeamId(1);
+    $user->syncRoles([]);
+
+    expect($user->getRoleNames())->toBeEmpty();
+
+    setPermissionsTeamId(2);
+    $user->load('roles');
+
+    expect($user->getRoleNames()->sort()->values())
+        ->toEqual(collect(['testRole']));
+});
+
 it('can scope users on different teams', function () {
     User::all()->each(fn ($item) => $item->delete());
     $user1 = User::create(['email' => 'user1@test.com']);