mirror of
https://github.com/snipe/snipe-it.git
synced 2026-08-18 19:22:48 +00:00
b18b713919
`test_requires_permission` set `assigned_user => 1` expecting the controller's `$this->authorize('checkout', Asset::class)` to fire a 403, but commit 8acedc241f (Jul 20, FD-56263) added `exists_undeleted:users,id` validation to that field.
Since AssetCheckoutRequest::authorize() just returns true, Laravel runs FormRequest validation *before* the controller method, and the nonexistent user id 1 tripped 422 first.
Instead, now we create a real user in the test and pass their id, so validation passes and the permission check fires the expected 403.
Added a comment referencing the commit so a future refactor understands the ordering constraint.