From 1397c9ab1c42260ec27ea2fbd180f36dc3f7dad2 Mon Sep 17 00:00:00 2001
From: David Bomba <turbo124@gmail.com>
Date: Mon, 14 Jun 2021 17:04:15 +1000
Subject: [PATCH] Fixes logic for hosted login

---
 app/Http/Controllers/Auth/LoginController.php | 26 +++++++++++++------
 tests/Integration/MultiDBUserTest.php         |  4 ++-
 2 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/app/Http/Controllers/Auth/LoginController.php b/app/Http/Controllers/Auth/LoginController.php
index 293a0eb665..97abc500b8 100644
--- a/app/Http/Controllers/Auth/LoginController.php
+++ b/app/Http/Controllers/Auth/LoginController.php
@@ -222,14 +222,9 @@ class LoginController extends BaseController
 
             });
 
-            // $cu->first()->account->companies->each(function ($company) use($cu, $request){
-
-            //     if($company->tokens()->where('is_system', true)->count() == 0)
-            //     {
-            //         CreateCompanyToken::dispatchNow($company, $cu->first()->user, $request->server('HTTP_USER_AGENT'));
-            //     }
-
-            // });
+            /*On the hosted platform, only owners can login for free/pro accounts*/
+            if(Ninja::isHosted() && !$cu->first()->is_owner && !$user->account->isEnterpriseClient())
+                return response()->json(['message' => 'Pro / Free accounts only the owner can log in. Please upgrade'], 403);
 
             return $this->timeConstrainedResponse($cu);
 
@@ -318,6 +313,9 @@ class LoginController extends BaseController
         if($request->has('current_company') && $request->input('current_company') == 'true')
           $cu->where("company_id", $company_token->company_id);
 
+        if(Ninja::isHosted() && !$cu->first()->is_owner && !$cu->first()->user->account->isEnterpriseClient())
+            return response()->json(['message' => 'Pro / Free accounts only the owner can log in. Please upgrade'], 403);
+
         return $this->refreshResponse($cu);
     }
 
@@ -379,6 +377,9 @@ class LoginController extends BaseController
                     }
                 });
 
+                if(Ninja::isHosted() && !$cu->first()->is_owner && !$existing_user->account->isEnterpriseClient())
+                    return response()->json(['message' => 'Pro / Free accounts only the owner can log in. Please upgrade'], 403);
+
                 return $this->timeConstrainedResponse($cu);
                 
             }
@@ -407,6 +408,9 @@ class LoginController extends BaseController
                     }
                 });
 
+                if(Ninja::isHosted() && !$cu->first()->is_owner && !$existing_login_user->account->isEnterpriseClient())
+                    return response()->json(['message' => 'Pro / Free accounts only the owner can log in. Please upgrade'], 403);
+
                 return $this->timeConstrainedResponse($cu);
             }
 
@@ -439,6 +443,9 @@ class LoginController extends BaseController
                     }
                 });
 
+                if(Ninja::isHosted() && !$cu->first()->is_owner && !$existing_login_user->account->isEnterpriseClient())
+                    return response()->json(['message' => 'Pro / Free accounts only the owner can log in. Please upgrade'], 403);
+
                 return $this->timeConstrainedResponse($cu);
             }
 
@@ -478,6 +485,9 @@ class LoginController extends BaseController
                 }
             });
 
+            if(Ninja::isHosted() && !$cu->first()->is_owner && !auth()->user()->account->isEnterpriseClient())
+                return response()->json(['message' => 'Pro / Free accounts only the owner can log in. Please upgrade'], 403);
+
             return $this->timeConstrainedResponse($cu);
         }
 
diff --git a/tests/Integration/MultiDBUserTest.php b/tests/Integration/MultiDBUserTest.php
index 311493f1e4..8f3abf239a 100644
--- a/tests/Integration/MultiDBUserTest.php
+++ b/tests/Integration/MultiDBUserTest.php
@@ -194,6 +194,8 @@ class MultiDBUserTest extends TestCase
                 ],
         ];
 
+        $response = false;
+
         try {
             $response = $this->withHeaders([
                 'X-API-SECRET' => config('ninja.api_secret'),
@@ -203,7 +205,7 @@ class MultiDBUserTest extends TestCase
         } catch (ValidationException $e) {
             $message = json_decode($e->validator->getMessageBag(), 1);
             $this->assertNotNull($message);
-
+            nlog($message);
         }
 
         if ($response) {