CLDC-4502: scope non-api user lettings log updates to those they have authorisation to access

app/controllers/lettings_logs_controller.rb

@@ -150,7 +150,7 @@ class LettingsLogsController < LogsController
     end
   end
 
-private
+  private
 
   def session_filters
     filter_manager.session_filters
@@ -183,7 +183,11 @@ private
   end
 
   def find_resource
-    @log = LettingsLog.visible.find_by(id: params[:id])
+    @log = if current_user
+             current_user.lettings_logs.visible.find_by(id: params[:id])
+           else
+             LettingsLog.visible.find_by(id: params[:id])
+           end
   end
 
   def post_create_redirect_url(log)

spec/requests/lettings_logs_controller_spec.rb

@@ -1633,6 +1633,27 @@ RSpec.describe LettingsLogsController, type: :request do
         expect(response).to have_http_status(:unauthorized)
       end
     end
+
+    context "when signed in as a user from a different organisation (not using the API)" do
+      let(:other_user) { create(:user) }
+      let(:headers) { { "Content-Type" => "application/json", "Accept" => "text/html" } }
+      let(:params) { { lettings_log: { tenancycode: "New Value" } } }
+
+      before do
+        allow(other_user).to receive(:need_two_factor_authentication?).and_return(false)
+        sign_in other_user
+        patch "/lettings-logs/#{id}", headers:, params: params.to_json
+      end
+
+      it "does not update the lettings log" do
+        lettings_log.reload
+        expect(lettings_log.tenancycode).to eq("Old Value")
+      end
+
+      it "returns a not found response" do
+        expect(response).to have_http_status(:not_found)
+      end
+    end
   end
 
   # We don't really have any meaningful distinction between PUT and PATCH here since you can update some or all