Add equals team validations for project and folder

app/controllers/api/v1/project_folders_controller.rb

@@ -5,7 +5,6 @@ module Api
     class ProjectFoldersController < BaseController
       before_action :load_team
       before_action :load_project_folder, only: %i(show update)
-      before_action :check_parent_folder, only: %i(create update)
 
       def index
         project_folders = @team.project_folders
@@ -52,10 +51,6 @@ module Api
 
         folder_params
       end
-
-      def check_parent_folder
-        @team.project_folders.find(folder_params[:parent_folder_id]) if folder_params[:parent_folder_id]
-      end
     end
   end
 end

app/controllers/api/v1/projects_controller.rb

@@ -9,7 +9,6 @@ module Api
       end
       before_action :load_project, only: :activities
       before_action :load_project_for_managing, only: %i(update)
-      before_action :check_parent_folder, only: %i(create update)
 
       def index
         projects = @team.projects
@@ -69,10 +68,6 @@ module Api
         @project = @team.projects.find(params.require(:id))
         raise PermissionError.new(Project, :manage) unless can_manage_project?(@project)
       end
-
-      def check_parent_folder
-        @team.project_folders.find(project_params[:project_folder_id]) if project_params[:project_folder_id]
-      end
     end
   end
 end

app/models/project.rb

@@ -12,6 +12,7 @@ class Project < ApplicationRecord
             uniqueness: { scope: :team_id, case_sensitive: false }
   validates :visibility, presence: true
   validates :team, presence: true
+  validate :project_folder_team, if: -> { project_folder.present? }
 
   belongs_to :created_by,
              foreign_key: 'created_by_id',
@@ -321,4 +322,12 @@ class Project < ApplicationRecord
   ensure
     report.destroy if report.present?
   end
+
+  private
+
+  def project_folder_team
+    return if project_folder.team_id == team_id
+
+    errors.add(:project_folder, I18n.t('activerecord.errors.models.project.attributes.project_folder.team'))
+  end
 end

app/models/project_folder.rb

@@ -8,8 +8,9 @@ class ProjectFolder < ApplicationRecord
             length: { minimum: Constants::NAME_MIN_LENGTH,
                       maximum: Constants::NAME_MAX_LENGTH },
             uniqueness: { scope: :team_id, case_sensitive: false }
+  validate :parent_folder_team, if: -> { parent_folder.present? }
 
-  before_validation :inherit_team_from_parent_folder, if: -> { team.blank? && parent_folder.present? }
+  before_validation :inherit_team_from_parent_folder, on: :create, if: -> { parent_folder.present? }
 
   belongs_to :team, inverse_of: :project_folders, touch: true
   belongs_to :parent_folder, class_name: 'ProjectFolder', optional: true
@@ -87,4 +88,10 @@ class ProjectFolder < ApplicationRecord
   def inherit_team_from_parent_folder
     self.team = parent_folder.team
   end
+
+  def parent_folder_team
+    return if parent_folder.team_id == team_id
+
+    errors.add(:parent_folder, I18n.t('activerecord.errors.models.project_folder.attributes.parent_folder'))
+  end
 end

config/locales/en.yml

@@ -96,6 +96,11 @@ en:
           attributes:
             name:
               taken: "This project name has to be unique inside a team (this includes the archive)."
+            project_folder:
+              team: "Project folder and project should belongs to the same team"
+        project_folder:
+          attributes:
+            parent_folder: "Parent folder and folder should belongs to the same team"
         view_state:
           attributes:
             viewable_id:

spec/models/project_folder_spec.rb

@@ -40,5 +40,27 @@ describe ProjectFolder, type: :model do
         expect(project_folder).to validate_uniqueness_of(:name).scoped_to(:team_id).case_insensitive
       end
     end
+
+    describe '#parent_folder_team' do
+      it 'should validate equals of team and parent_folder team' do
+        project_folder.save
+        parent_folder = create(:project_folder, name: 'Parent folder')
+
+        project_folder.update(parent_folder: parent_folder)
+
+        expect(project_folder.errors).to have_key(:parent_folder)
+      end
+    end
+  end
+
+  describe 'Callbacks' do
+    describe 'inherit_team_from_parent_folder' do
+      it do
+        parent_folder = create(:project_folder, name: 'Parent folder')
+        project_folder.parent_folder = parent_folder
+
+        expect { project_folder.save }.to(change { project_folder.team })
+      end
+    end
   end
 end

spec/models/project_spec.rb

@@ -67,5 +67,15 @@ describe Project, type: :model do
         expect(project).to validate_uniqueness_of(:name).scoped_to(:team_id).case_insensitive
       end
     end
+
+    describe '#project_folder_team' do
+      it 'should validate equals of team and project_folder team' do
+        project_folder = create(:project_folder, name: 'Folder from another team')
+        project.project_folder = project_folder
+        project.save
+
+        expect(project.errors).to have_key(:project_folder)
+      end
+    end
   end
 end

spec/requests/api/v1/project_folders_controller_spec.rb

@@ -111,16 +111,6 @@ RSpec.describe 'Api::V1::ProjectFoldersController', type: :request do
           expect(JSON.parse(response.body)['errors'].first['title']).to be_eql 'Validation error'
         end
       end
-
-      context 'when parent_folder not found' do
-        let(:parent_folder_id) { -1 }
-
-        it do
-          action
-
-          expect(response).to have_http_status 404
-        end
-      end
     end
   end
 
@@ -190,13 +180,15 @@ RSpec.describe 'Api::V1::ProjectFoldersController', type: :request do
         end
       end
 
-      context 'when parent_folder not found' do
-        let(:parent_folder_id) { -1 }
+      context 'when parent_folder belongs to another team' do
+        let(:folder_from_another_team) { create(:project_folder) }
+        let(:parent_folder_id) { folder_from_another_team.id }
 
         it do
           action
 
-          expect(response).to have_http_status(404)
+          expect(JSON.parse(response.body)['errors'].first['title']).to be_eql 'Validation error'
+          expect(response).to have_http_status 400
         end
       end
 

spec/requests/api/v1/projects_controller_spec.rb

@@ -169,6 +169,17 @@ RSpec.describe 'Api::V1::ProjectsController', type: :request do
           expect(response).to have_http_status(201)
           expect(JSON.parse(response.body).dig('data', 'relationships', 'project_folder', 'data')).to be_truthy
         end
+
+        context 'when folder from a different team' do
+          let(:project_folder) { create :project_folder, team: @teams.last }
+
+          it do
+            action
+
+            expect(JSON.parse(response.body)['errors'].first['title']).to be_eql 'Validation error'
+            expect(response).to have_http_status 400
+          end
+        end
       end
     end