actingAsForApi($actor)
->patchJson(route('api.assets.update', $asset->id), [
$field->db_column_name() => $value,
])
->assertOk();
}
private function getUpdateRows(Asset $asset, User $viewer): array
{
return $this->actingAsForApi($viewer)
->getJson(route('api.assets.history', ['asset' => $asset->id, 'action_type' => 'update']))
->assertOk()
->json('rows');
}
public function test_encrypted_custom_field_values_are_visible_to_users_with_encrypted_field_permission()
{
$this->markIncompleteIfMySQL('Custom Fields tests do not work on MySQL');
$field = CustomField::factory()->testEncrypted()->create();
$asset = Asset::factory()->hasEncryptedCustomField($field)->create([
$field->db_column => Crypt::encrypt('safe initial value'),
]);
$superuser = User::factory()->superuser()->create();
$this->updateAssetEncryptedField($asset, $field, '
', $superuser);
$viewer = User::factory()->viewAssets()->viewAssetHistory()->viewEncryptedCustomFields()->create();
$fieldEntry = $this->findFieldEntry($this->getUpdateRows($asset, $viewer), $field->db_column);
$this->assertNotNull($fieldEntry, 'Encrypted field change should be visible to users with the encrypted fields permission');
$newValue = $fieldEntry['new'];
$this->assertStringNotContainsString('assertStringContainsString('<', $newValue, 'Value should be HTML-encoded in history log_meta');
}
public function test_encrypted_custom_field_values_are_masked_for_users_without_encrypted_field_permission()
{
$this->markIncompleteIfMySQL('Custom Fields tests do not work on MySQL');
$field = CustomField::factory()->testEncrypted()->create();
$asset = Asset::factory()->hasEncryptedCustomField($field)->create([
$field->db_column => Crypt::encrypt('safe initial value'),
]);
$superuser = User::factory()->superuser()->create();
$this->updateAssetEncryptedField($asset, $field, '', $superuser);
$viewer = User::factory()->viewAssets()->viewAssetHistory()->create();
$fieldEntry = $this->findFieldEntry($this->getUpdateRows($asset, $viewer), $field->db_column);
if ($fieldEntry !== null) {
$this->assertEquals('************', $fieldEntry['new'], 'Users without encrypted field permission should see masked value');
$this->assertStringNotContainsString('