Fixed some permission stuff

app/Http/Controllers/Api/AssetsController.php

@@ -147,6 +147,12 @@ public function index(Request $request, $action = null, $upcoming_status = null)
             $filter = json_decode($request->input('filter'), true);
         }
 
+        if (!isset($filter[0]['field'])){
+            $filter = array_filter($filter, function ($key) use ($allowed_columns){
+                return in_array($key, $allowed_columns);
+            }, ARRAY_FILTER_USE_KEY);
+        }
+
         $all_custom_fields = CustomField::all(); //used as a 'cache' of custom fields throughout this page load
         foreach ($all_custom_fields as $field) {
             $allowed_columns[] = $field->db_column_name();

app/Models/Asset.php

@@ -1908,9 +1908,19 @@ function ($query) use ($search) {
 
     public function scopeByFilter($query, array $filters)
     {
+        // Check if the filters are in Snipe-IT's original format (key => value)
+        if ($this->isLegacyFilterFormat($filters)) {
+            return $this->applyLegacyFilters($query, $filters);
+        }
         return $this->filterService()->searchByFilter($query, $filters);
     }
 
+    private function isLegacyFilterFormat($filters)
+    {
+        // Snipe-IT filters are simple key/value (not arrays with 'field')
+        return !isset($filters[0]['field']);
+    }
+
     /**
      * Query builder scope to order on model
      *
@@ -2159,6 +2169,227 @@ public function scopeByDepreciationId($query, $search)
      * @return \Illuminate\Database\Eloquent\Builder            Modified query builder
      */
 
+    public function applyLegacyFilters($query, $filter)
+    {
+        return $query->where(
+            function ($query) use ($filter) {
+                foreach ($filter as $key => $search_val) {
+
+                    $fieldname = str_replace('custom_fields.', '', $key);
+
+                    if ($fieldname == 'asset_tag') {
+                        $query->where('assets.asset_tag', 'LIKE', '%'.$search_val.'%');
+                    }
+
+                    if ($fieldname == 'name') {
+                        $query->where('assets.name', 'LIKE', '%'.$search_val.'%');
+                    }
+
+
+                    if ($fieldname =='serial') {
+                        $query->where('assets.serial', 'LIKE', '%'.$search_val.'%');
+                    }
+
+                    if ($fieldname == 'purchase_date') {
+                        $query->where('assets.purchase_date', 'LIKE', '%'.$search_val.'%');
+                    }
+
+                    if ($fieldname == 'purchase_cost') {
+                        $query->where('assets.purchase_cost', 'LIKE', '%'.$search_val.'%');
+                    }
+
+                    if ($fieldname == 'notes') {
+                        $query->where('assets.notes', 'LIKE', '%'.$search_val.'%');
+                    }
+
+                    if ($fieldname == 'order_number') {
+                        $query->where('assets.order_number', 'LIKE', '%'.$search_val.'%');
+                    }
+
+                    if ($fieldname == 'status_label') {
+                        $query->whereHas(
+                            'assetstatus', function ($query) use ($search_val) {
+                                $query->where('status_labels.name', 'LIKE', '%'.$search_val.'%');
+                            }
+                        );
+                    }
+
+                    if ($fieldname == 'location') {
+                        $query->whereHas(
+                            'location', function ($query) use ($search_val) {
+                                $query->where('locations.name', 'LIKE', '%'.$search_val.'%');
+                            }
+                        );
+                    }
 
+                    if ($fieldname == 'rtd_location') {
+                        $query->whereHas(
+                            'defaultLoc', function ($query) use ($search_val) {
+                                $query->where('locations.name', 'LIKE', '%'.$search_val.'%');
+                            }
+                        );
+                    }
 
-}
+                    if ($fieldname == 'assigned_to') {
+                        $query->whereHasMorph(
+                            'assignedTo', [User::class], function ($query) use ($search_val) {
+                                $query->where(
+                                    function ($query) use ($search_val) {
+                                        $query->where('users.first_name', 'LIKE', '%'.$search_val.'%')
+                                            ->orWhere('users.last_name', 'LIKE', '%'.$search_val.'%')
+                                            ->orWhere('users.username', 'LIKE', '%'.$search_val.'%');
+                                    }
+                                );
+                            }
+                        )->orWhereHasMorph(
+                            'assignedTo', [Location::class], function ($query) use ($search_val) {
+                                $query->where('locations.name', 'LIKE', '%'.$search_val.'%');
+                            }
+                        )->orWhereHasMorph(
+                            'assignedTo', [Asset::class], function ($query) use ($search_val) {
+                            $query->where(
+                                function ($query) use ($search_val) {
+                                    // Don't use the asset table prefix here because it will pull from the original asset,
+                                    // not the subselect we're doing here to get the assigned asset
+                                    $query->where('name', 'LIKE', '%'.$search_val.'%')
+                                        ->orWhere('asset_tag', 'LIKE', '%'.$search_val.'%');
+                                }
+                            );
+                        }
+                        );
+                    }
+
+
+                    if ($fieldname == 'manufacturer') {
+                        $query->whereHas(
+                            'model', function ($query) use ($search_val) {
+                                $query->whereHas(
+                                    'manufacturer', function ($query) use ($search_val) {
+                                        $query->where(
+                                            function ($query) use ($search_val) {
+                                                $query->where('manufacturers.name', 'LIKE', '%'.$search_val.'%');
+                                            }
+                                        );
+                                    }
+                                );
+                            }
+                        );
+                    }
+
+                    if ($fieldname == 'category') {
+                        $query->whereHas(
+                            'model', function ($query) use ($search_val) {
+                                $query->whereHas(
+                                    'category', function ($query) use ($search_val) {
+                                        $query->where(
+                                            function ($query) use ($search_val) {
+                                                $query->where('categories.name', 'LIKE', '%'.$search_val.'%')
+                                                    ->orWhere('models.name', 'LIKE', '%'.$search_val.'%')
+                                                    ->orWhere('models.model_number', 'LIKE', '%'.$search_val.'%');
+                                            }
+                                        );
+                                    }
+                                );
+                            }
+                        );
+                    }
+
+                    if ($fieldname == 'model') {
+                        $query->whereHas(
+                            'model', function ($query) use ($search_val) {
+                            $query->where('models.name', 'LIKE', '%'.$search_val.'%');
+                        }
+                        );
+                    }
+
+
+                    if ($fieldname == 'model_number') {
+                        $query->whereHas(
+                            'model', function ($query) use ($search_val) {
+                            $query->where('models.model_number', 'LIKE', '%'.$search_val.'%');
+                        }
+                        );
+                    }
+
+
+                    if ($fieldname == 'company') {
+                        $query->whereHas(
+                            'company', function ($query) use ($search_val) {
+                            $query->where('companies.name', 'LIKE', '%'.$search_val.'%');
+                        }
+                        );
+                    }
+
+                    if ($fieldname == 'supplier') {
+                        $query->whereHas(
+                            'supplier', function ($query) use ($search_val) {
+                            $query->where('suppliers.name', 'LIKE', '%'.$search_val.'%');
+                        }
+                        );
+                    }
+
+                    if ($fieldname == 'status_label') {
+                        $query->whereHas(
+                            'assetstatus', function ($query) use ($search_val) {
+                            $query->where('status_labels.name', 'LIKE', '%'.$search_val.'%');
+                        }
+                        );
+                    }
+
+                    if ($fieldname == 'jobtitle') {
+                        $query->where(function ($query) use ($search_val) {
+                            if (is_array($search_val)) {
+                                $query->whereHasMorph(
+                                    'assignedTo',
+                                    [User::class],
+                                    function ($query) use ($search_val) {
+                                        $query->whereIn('users.jobtitle', $search_val);
+                                    }
+                                );
+                            } else {
+                                $query->whereHasMorph(
+                                    'assignedTo',
+                                    [User::class],
+                                    function ($query) use ($search_val) {
+                                        $query->where(function ($query) use ($search_val) {
+                                            $query->where('users.jobtitle', 'LIKE', '%' . $search_val . '%');
+                                        });
+                                    }
+                                );
+                            }
+                        });
+                    }
+
+
+                    /**
+                     * THIS CLUNKY BIT IS VERY IMPORTANT
+                     *
+                     * Although inelegant, this section matters a lot when querying against fields that do not
+                     * exist on the asset table. There's probably a better way to do this moving forward, for
+                     * example using the Schema:: methods to determine whether or not a column actually exists,
+                     * or even just using the $searchableRelations variable earlier in this file.
+                     *
+                     * In short, this set of statements tells the query builder to ONLY query against an
+                     * actual field that's being passed if it doesn't meet known relational fields. This
+                     * allows us to query custom fields directly in the assets table
+                     * (regardless of their name) and *skip* any fields that we already know can only be
+                     * searched through relational searches that we do earlier in this method.
+                     *
+                     * For example, we do not store "location" as a field on the assets table, we store
+                     * that relationship through location_id on the assets table, therefore querying
+                     * assets.location would fail, as that field doesn't exist -- plus we're already searching
+                     * against those relationships earlier in this method.
+                     *
+                     * - snipe
+                     */
+
+                    if (($fieldname!='category') && ($fieldname!='model_number') && ($fieldname!='rtd_location') && ($fieldname!='location') && ($fieldname!='supplier')
+                        && ($fieldname!='status_label') && ($fieldname!='assigned_to') && ($fieldname!='model')  && ($fieldname!='jobtitle') && ($fieldname!='company') && ($fieldname!='manufacturer')
+                    ) {
+                        $query->where('assets.'.$fieldname, 'LIKE', '%' . $search_val . '%');
+                    }
+                }
+            }
+        );
+    }
+}

tests/Feature/AssetQuery/CombinedQueryTest.php

@@ -731,7 +731,7 @@ public function testFilterAssetNoFiltersReturnsAll()
         $assetC = Asset::factory()->create();
 
         // No filters applied
-        $filter = [[]];
+        $filter = [];
         $results = Asset::query()->byFilter($filter)->get();
 
         $this->assertCount(3, $results);

tests/Feature/AssetQuery/CustomFieldQueryTest.php

@@ -118,7 +118,7 @@ public function testFilterWithEmptyArrayLeavesResultsUnchanged()
         $a = Asset::factory()->create(['custom_text' => 'A']);
         $b = Asset::factory()->create(['custom_text' => 'B']);
 
-        $filter = [[]];
+        $filter = [];
 
         $results = Asset::query()->byFilter($filter)->get();
 

tests/Feature/AssetQuery/LegacyFilterTest.php

@@ -0,0 +1,88 @@
+<?php
+namespace Tests\Feature\AssetQuery;
+
+use App\Models\Asset;
+use App\Models\Company;
+use Tests\TestCase;
+
+
+class LegacyFilterTest extends TestCase
+{
+    public function testFilterAssetsByCompanyId()
+    {
+        $companyA = Company::factory()->create();
+        $companyB = Company::factory()->create();
+
+        $assetA = Asset::factory()->create(['company_id' => $companyA->id]);
+        $assetB = Asset::factory()->create(['company_id' => $companyB->id]);
+
+        $filter = [
+            'company_id' => $companyA->id
+        ];
+
+        $results = Asset::query()->byFilter($filter)->get();
+
+        $this->assertCount(1, $results);
+        $this->assertTrue($results->contains($assetA));
+    }
+
+    public function testFilterAssetsByAssetTag()
+    {
+        $assetA = Asset::factory()->create(['asset_tag' => 'A1']);
+        $assetB = Asset::factory()->create(['asset_tag' => 'B1']);
+
+        $filter = [
+            'asset_tag' => 'A1'
+        ];
+
+        $results = Asset::query()->byFilter($filter)->get();
+
+        $this->assertCount(1, $results);
+        $this->assertTrue($results->contains($assetA));
+    }
+
+    public function testFilterAssetsByCompanyAndAssetTag()
+    {
+        $companyA = Company::factory()->create();
+        $companyB = Company::factory()->create();
+
+        $assetA = Asset::factory()->create([
+            'company_id' => $companyA->id,
+            'asset_tag' => 'X1'
+        ]);
+
+        $assetB = Asset::factory()->create([
+            'company_id' => $companyA->id,
+            'asset_tag' => 'Y1'
+        ]);
+
+        $assetC = Asset::factory()->create([
+            'company_id' => $companyB->id,
+            'asset_tag' => 'X1'
+        ]);
+
+        $filter = [
+            'company_id' => $companyA->id,
+            'asset_tag' => 'X1'
+        ];
+
+        $results = Asset::query()->byFilter($filter)->get();
+
+        $this->assertCount(1, $results);
+        $this->assertTrue($results->contains($assetA));
+    }
+
+    public function testReturnsAllAssetsWhenFilterIsEmpty()
+    {
+        $assetA = Asset::factory()->create();
+        $assetB = Asset::factory()->create();
+
+        $filter = [];
+
+        $results = Asset::query()->byFilter($filter)->get();
+
+        $this->assertCount(2, $results);
+        $this->assertTrue($results->contains($assetA));
+        $this->assertTrue($results->contains($assetB));
+    }
+}