User can upload a message draft only to the tenant's boxes

app/models/box.rb

@@ -27,6 +27,8 @@ class Box < ApplicationRecord
   has_many :message_drafts_imports, dependent: :destroy
   has_many :automation_conditions, as: :condition_object
 
+  scope :with_enabled_message_drafts_import, -> { where("(settings ->> 'message_drafts_import_enabled')::boolean = ?", true) }
+
   after_destroy do |box|
     api_connection.destroy if api_connection.destroy_with_box?
     EventBus.publish(:box_destroyed, box.id)

app/models/fs/box.rb

@@ -18,8 +18,6 @@
 class Fs::Box < Box
   DISABLED_MESSAGE_DRAFTS_IMPORT_KEYWORDS = ['(oblasť SPD)']
 
-  scope :with_enabled_message_drafts_import, -> { where("(settings ->> 'message_drafts_import_enabled')::boolean = ?", true) }
-
   validates_uniqueness_of :name, :short_name, scope: :tenant_id
 
   def self.policy_class

app/models/fs/message_draft.rb

@@ -35,7 +35,7 @@ def self.create_and_validate_with_fs_form(form_files: [], author:, fs_client: Fs
       dic = form_information['subject']&.strip
       fs_form_identifier = form_information['form_identifier']
 
-      box = Fs::Box.with_enabled_message_drafts_import.find_by("settings ->> 'dic' = ?", dic)
+      box = author.tenant.boxes.with_enabled_message_drafts_import.find_by("settings ->> 'dic' = ?", dic)
       fs_form = Fs::Form.find_by(identifier: fs_form_identifier)
 
       unless box && fs_form

test/fixtures/api_connections.yml

@@ -63,3 +63,11 @@ sk_api_api_connection_with_obo_support:
   sub: sub4
   api_token_private_key: private_key
   type: 'SkApi::ApiConnectionWithOboSupport'
+
+fs_api_connection2:
+  sub: fs_sub2
+  api_token_private_key: private_key
+  type: 'Fs::ApiConnection'
+  tenant: solver
+  settings: {"username": "7654321", "password": "fs_password"}
+

test/fixtures/boxes.yml

@@ -87,3 +87,12 @@ fs_accountants2:
   api_connection: fs_api_connection1
   settings: {"dic": "1122334456", "subject_id": "387cf7da-2cff-40e0-8ad2-650030429994", "message_drafts_import_enabled": true}
   type: 'Fs::Box'
+
+fs_solver:
+  name: Solver main FS
+  uri: dic://sk/9988776655
+  tenant: solver
+  short_name: SFS
+  api_connection: fs_api_connection2
+  settings: {"dic": "1122334456", "subject_id": SecureRandom.uuid, "message_drafts_import_enabled": true}
+  type: 'Fs::Box'

test/fixtures/tenants.yml

@@ -12,6 +12,7 @@ solver:
   name: Solver
   feature_flags:
     - api
+    - fs_api
   api_token_public_key: "-----BEGIN PUBLIC KEY-----\nMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMIpyOBmP6R5hkFzBlNIbhX4t2CpAaoE\nyDDRzog4rvycPQNXnvZXuIm1shVq0XCrx+2nMWNHFrKqH3QViQR0QGMCAwEAAQ==\n-----END PUBLIC KEY-----"
 
 google:

test/system/fs/message_drafts_test.rb

@@ -96,4 +96,27 @@ class Fs::MessageDraftsTest < ApplicationSystemTestCase
     click_button "Vytvoriť novú správu"
     assert_not has_link? "Vytvoriť novú správu na finančnú správu"
   end
+
+  test "user can upload a message draft only to the tenant's boxes" do
+    sign_in_as(:solver_other)
+
+    visit message_threads_path
+
+    click_button "Vytvoriť novú správu"
+    click_link "Vytvoriť novú správu na finančnú správu"
+
+    fs_api = Minitest::Mock.new
+    fs_api.expect :parse_form, {
+      "subject" => "1122334455",
+      "form_identifier" => "3055_781"
+    },
+    [file_fixture("fs/dic1122334455_fs3055_781__sprava_dani_2023.xml").read]
+
+    FsEnvironment.fs_client.stub :api, fs_api do
+      attach_file "content[]", file_fixture("fs/dic1122334455_fs3055_781__sprava_dani_2023.xml")
+      click_button "Nahrať správy"
+
+      assert_text "Nahratie správ nebolo úspešné"
+    end
+  end
 end