Fixed RB-21869 - gate activity report types

tests/Feature/Checkouts/Api/CheckoutRequestCounterTest.php

@@ -0,0 +1,99 @@
+<?php
+
+namespace Tests\Feature\Checkouts\Api;
+
+use App\Models\Asset;
+use App\Models\User;
+use Illuminate\Support\Facades\Notification;
+use Tests\TestCase;
+
+class CheckoutRequestCounterTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Notification::fake();
+    }
+
+    public function test_cancel_without_active_request_returns_404_and_does_not_touch_counter()
+    {
+        // Reg-test for the cancel-request counter drift: hitting the cancel
+        // endpoint when the caller has no active CheckoutRequest used to
+        // unconditionally decrement requests_counter, which drove the
+        // counter negative and misrepresented pending admin work.
+        $asset = Asset::factory()->requestable()->create(['requests_counter' => 0]);
+        $user = User::factory()->create();
+
+        $this->actingAsForApi($user)
+            ->postJson(route('api.assets.requests.destroy', $asset))
+            ->assertStatus(404)
+            ->assertStatusMessageIs('error');
+
+        $this->assertEquals(0, $asset->fresh()->requests_counter);
+    }
+
+    public function test_duplicate_active_request_returns_409_and_increments_counter_only_once()
+    {
+        // Reg-test for duplicate-active-request counter drift: a second
+        // POST from the same caller used to add a second CheckoutRequest
+        // row AND bump requests_counter a second time. On cancel only one
+        // decrement fired, so the counter and the pending queue drifted
+        // apart.
+        $asset = Asset::factory()->requestable()->create(['requests_counter' => 0]);
+        $user = User::factory()->create();
+
+        $this->actingAsForApi($user)
+            ->postJson(route('api.assets.requests.store', $asset))
+            ->assertOk()
+            ->assertStatusMessageIs('success');
+
+        $this->actingAsForApi($user)
+            ->postJson(route('api.assets.requests.store', $asset))
+            ->assertStatus(409)
+            ->assertStatusMessageIs('error');
+
+        $this->assertEquals(1, $asset->fresh()->requests_counter);
+        $this->assertEquals(
+            1,
+            $asset->requests()->whereNull('canceled_at')->where('user_id', $user->id)->count(),
+            'Second request should not have created a second active CheckoutRequest row.'
+        );
+    }
+
+    public function test_cancel_after_active_request_decrements_counter_by_exactly_one()
+    {
+        // Companion to the two above: a legitimate request-then-cancel
+        // round trip must leave the counter at 0.
+        $asset = Asset::factory()->requestable()->create(['requests_counter' => 0]);
+        $user = User::factory()->create();
+
+        $this->actingAsForApi($user)
+            ->postJson(route('api.assets.requests.store', $asset))
+            ->assertOk();
+
+        $this->assertEquals(1, $asset->fresh()->requests_counter);
+
+        $this->actingAsForApi($user)
+            ->postJson(route('api.assets.requests.destroy', $asset))
+            ->assertOk()
+            ->assertStatusMessageIs('success');
+
+        $this->assertEquals(0, $asset->fresh()->requests_counter);
+    }
+
+    public function test_double_cancel_only_decrements_counter_once()
+    {
+        // Combined regression: request once, cancel twice. The second
+        // cancel must 404 without dragging the counter below zero.
+        $asset = Asset::factory()->requestable()->create(['requests_counter' => 0]);
+        $user = User::factory()->create();
+
+        $this->actingAsForApi($user)->postJson(route('api.assets.requests.store', $asset))->assertOk();
+        $this->actingAsForApi($user)->postJson(route('api.assets.requests.destroy', $asset))->assertOk();
+        $this->actingAsForApi($user)
+            ->postJson(route('api.assets.requests.destroy', $asset))
+            ->assertStatus(404);
+
+        $this->assertEquals(0, $asset->fresh()->requests_counter);
+    }
+}

tests/Feature/Reporting/ActivityReportTest.php

@@ -189,6 +189,40 @@ class ActivityReportTest extends TestCase
 
     }
 
+    public function test_activity_report_normalizes_lowercase_camelcase_input()
+    {
+        // Reg-test for the pre-existing `licenseseat` Fatal Error:
+        // Helper::normalizeFullModelName uses ucwords(), which only
+        // capitalizes the first letter of each space-delimited word.
+        // A lowercase short name like `licenseseat` (which FilterRequest
+        // accepts) came out as the nonexistent App\Models\Licenseseat
+        // and Fatal'd when withTrashed()->find() called the class. The
+        // resolver's case-insensitive lookup now returns the canonical
+        // App\Models\LicenseSeat, so the request succeeds cleanly.
+        $this->actingAsForApi(User::factory()->superuser()->create())
+            ->getJson(route('api.activity.index', [
+                'item_type' => 'licenseseat',
+                'item_id' => 999999,
+            ]))
+            ->assertOk();
+    }
+
+    public function test_activity_report_rejects_types_not_in_form_request_allowlist()
+    {
+        // FilterRequest already rejects arbitrary class names, but
+        // Snipe-IT returns validation failures as HTTP 200 with body
+        // status=error (project convention). Pinning that shape so a
+        // refactor that changes either FilterRequest or the response
+        // envelope shows up in tests before it ships.
+        $this->actingAsForApi(User::factory()->superuser()->create())
+            ->getJson(route('api.activity.index', [
+                'item_type' => 'NotARealClass',
+                'item_id' => 1,
+            ]))
+            ->assertOk()
+            ->assertStatusMessageIs('error');
+    }
+
     public function test_search_matches_action_log_location_name()
     {
         // Activity Report eager-loads and shows the location on each