Merge pull request #5666 from ProcessMaker/observation/FOUR-12450

FOUR-12450: Filter only the Projects that belong to the User

Author: ryancooley

ProcessMaker/Traits/SearchAutocompleteTrait.php

@@ -190,21 +190,38 @@ private function searchProjects($query)
         $projectModalClass = 'ProcessMaker\Package\Projects\Models\Project';
         $project = new $projectModalClass;
 
-        if (empty($query)) {
-            $results = $project->get();
-        } else {
-            $results = $project->pmql('title = "' . $query . '"', function ($expression) {
-                return function ($query) use ($expression) {
-                    $query->where($expression->field->field(), 'LIKE', '%' . $expression->value->value() . '%');
-                };
-            })->get();
-        }
+        $projectMemberModalClass = 'ProcessMaker\Package\Projects\Models\ProjectMember';
+        $projectMember = new $projectMemberModalClass;
+        $user = Auth::user();
+        $ids = $projectMember->getProjectWhereTheUserIsMember($user);
+
+        $results = empty($query)
+            ? $this->searchProjectsNoQuery($project, $user, $ids)
+            : $this->searchProjectsWithQuery($project, $query, $user, $ids);
 
         return $results->map(function ($request) {
             return $request->only(['id', 'title']);
         });
     }
 
+    private function searchProjectsNoQuery($project, $user, $ids)
+    {
+        return $project->where(function ($query) use ($user, $ids) {
+            $query->owner($user->id)->orWhereIn('id', $ids);
+        })->get();
+    }
+
+    private function searchProjectsWithQuery($project, $query, $user, $ids)
+    {
+        return $project->pmql('title = "' . $query . '"', function ($expression) use ($user, $ids) {
+            return function ($query) use ($expression, $user, $ids) {
+                $query->owner($user->id)
+                    ->orWhereIn('id', $ids)
+                    ->where($expression->field->field(), 'LIKE', '%' . $expression->value->value() . '%');
+            };
+        })->get();
+    }
+
     private function searchProjectMembers($query)
     {
         return (object) [

resources/js/components/shared/PmqlInputFilters.vue

@@ -695,10 +695,9 @@ export default {
         this.allLoading(true);
 
         const { data } = await ProcessMaker.apiClient.get("/projects/search?type=project_all");
-
-        if (data.projects) {
-          this.projectOptions = data.projects;
-        }
+        
+        this.projectOptions = data.projects ? data.projects : [];
+        
         if (data.members?.users) {
           const usersWithMappedNames = data.members.users
             .filter(user => !!user)