Fix KdB, SoSi update permissions for non-admins

Signed-off-by: Christoph Wurst <[email protected]>

Author: ChristophWurst

app/Auth/Abilities/WineAbilities.php

@@ -102,7 +102,7 @@ private function updatesExcluded(Wine $wine, array $data) {
 	 * @return boolean
 	 */
 	private function mayUpdateKdb(User $user, Wine $wine) {
-		return $wine->administrates($user);
+		return $wine->competition->administrates($user);
 	}
 
 	/**
@@ -111,7 +111,7 @@ private function mayUpdateKdb(User $user, Wine $wine) {
 	 * @return boolean
 	 */
 	private function mayUpdateSosi(User $user, Wine $wine) {
-		return $wine->administrates($user);
+		return $wine->competition->administrates($user);
 	}
 
 	/**

tests/Unit/Auth/Abilities/WineAbilitiesTest.php

@@ -92,9 +92,10 @@ public function testCreateWithWrongCompetitionState() {
 	/**
 	 * Simulate a user updating the sosi state (kdb remains)
 	 */
-	public function testUpdateAllowedForWineAdministrator() {
+	public function testUpdateNotAllowedForWineAdministrator() {
 		$user = $this->getUserMock();
 		$wine = Mockery::mock(Wine::class);
+		$competition = Mockery::mock(Competition::class);
 		$data = [
 			'id' => 23,
 			'kdb' => true,
@@ -106,7 +107,40 @@ public function testUpdateAllowedForWineAdministrator() {
 		$wine->shouldReceive('getAttribute')
 			->with('sosi')
 			->andReturn(false);
-		$wine->shouldReceive('administrates')
+		$wine->shouldReceive('getAttribute')
+			->with('competition')
+			->andReturn($competition);
+		$competition->shouldReceive('administrates')
+			->with($user)
+			->andReturn(false);
+
+		$allowed = $this->abilities->update($user, $wine, $data);
+
+		$this->assertFalse($allowed);
+	}
+
+	/**
+	 * Simulate a user updating the sosi state (kdb remains)
+	 */
+	public function testUpdateAllowedForCompetitionAdministrator() {
+		$user = $this->getUserMock();
+		$wine = Mockery::mock(Wine::class);
+		$competition = Mockery::mock(Competition::class);
+		$data = [
+			'id' => 23,
+			'kdb' => true,
+			'sosi' => true,
+		];
+		$wine->shouldReceive('getAttribute')
+			->with('kdb')
+			->andReturn(true);
+		$wine->shouldReceive('getAttribute')
+			->with('sosi')
+			->andReturn(false);
+		$wine->shouldReceive('getAttribute')
+			->with('competition')
+			->andReturn($competition);
+		$competition->shouldReceive('administrates')
 			->with($user)
 			->andReturn(true);