diff --git a/app/controllers/admin/enterprise_relationships_controller.rb b/app/controllers/admin/enterprise_relationships_controller.rb index 9bb94b7849..212bf3849d 100644 --- a/app/controllers/admin/enterprise_relationships_controller.rb +++ b/app/controllers/admin/enterprise_relationships_controller.rb @@ -3,7 +3,7 @@ module Admin def index @my_enterprises = Enterprise.managed_by(spree_current_user).by_name @all_enterprises = Enterprise.by_name - @enterprise_relationships = EnterpriseRelationship.by_name + @enterprise_relationships = EnterpriseRelationship.by_name.involving_enterprises @my_enterprises end def create diff --git a/spec/features/admin/enterprise_relationships_spec.rb b/spec/features/admin/enterprise_relationships_spec.rb index 9e17a44979..7e15a243c8 100644 --- a/spec/features/admin/enterprise_relationships_spec.rb +++ b/spec/features/admin/enterprise_relationships_spec.rb @@ -76,17 +76,32 @@ feature %q{ end end + context "as an enterprise user" do let!(:d1) { create(:distributor_enterprise) } let!(:d2) { create(:distributor_enterprise) } + let!(:d3) { create(:distributor_enterprise) } let(:enterprise_user) { create_enterprise_user([d1]) } + let!(:er1) { create(:enterprise_relationship, parent: d1, child: d2) } + let!(:er2) { create(:enterprise_relationship, parent: d2, child: d1) } + let!(:er3) { create(:enterprise_relationship, parent: d2, child: d3) } + before { login_to_admin_as enterprise_user } + scenario "enterprise user can only see relationships involving their enterprises" do + visit admin_enterprise_relationships_path + + page.should have_table_row [d1.name, 'permits', d2.name, ''] + page.should have_table_row [d2.name, 'permits', d1.name, ''] + page.should_not have_table_row [d2.name, 'permits', d3.name, ''] + end + + scenario "enterprise user can only add their own enterprises as parent" do visit admin_enterprise_relationships_path page.should have_select 'enterprise_relationship_parent_id', options: ['', d1.name] - page.should have_select 'enterprise_relationship_child_id', options: ['', d1.name, d2.name] + page.should have_select 'enterprise_relationship_child_id', options: ['', d1.name, d2.name, d3.name] end end end