An Asset assigned to you belongs to a different company

[sahps]

Debug mode

• I have enabled debug mode
• I have read checked the Common Issues page

Describe the bug

We have one user, where if they visit /account/accept they are told there is another hidden asset that can't be accepted.

Reproduction steps

1. User visits /account/accept

Expected behavior

No warning shown, or list all assets

Screenshots

No response

Snipe-IT Version

v6.3.4 build 13139 (g6f9ba6ede)

Operating System

Debian

Web Server

Nginx

PHP Version

8.1.22

Operating System

Windows

Browser

Edge

Version

124.0.2478.51

Device

iPhone 14

Operating System

iOS 17

Browser

Safari

Version

No response

Error messages

No error messages

Additional context

Checking the database, we see the same listed assets as the user sees at /account/view-assets
So I don't understand where this extra device may be.

We run "SELECT * FROM assets WHERE assigned_to = 21;" and see the two entries we are expecting.
When the user visits /account/view-assets they see the same two assets.
When the user visits /account/accept they are told there is another hidden asset from a different company.

We do not have multiple company setting enabled

[welcome]

👋 Thanks for opening your first issue here! If you're reporting a 🐞 bug, please make sure you include steps to reproduce it. We get a lot of issues on this repo, so please be patient and we will get back to you as soon as we can.

[sahps]

[snipe]

Do you have full multiple company support enabled? If so, that's probably why.

[sahps]

Multiple company support is disabled.

[sahps]

I've had some more reports from users having this issue this week. And done a little investigation, but not able to fix yet.

I added an additional line to the output of the accept page at /app/www/resources/views/account/accept

--- index.blade.php.orig
+++ index.blade.php
@@ -46,7 +46,7 @@
                 <td><a href="{{ route('account.accept.item', $acceptance) }}" class="btn btn-default btn-sm">{{ trans('general.accept_decline') }}</a></td>
                 @else
                 <td> ----- </td>
-                <td> {{ trans('general.error_user_company_accept_view') }} </td>
+                <td> {{ trans('general.error_user_company_accept_view') }}<br />DEBUG: <pre>{{ route('account.accept.item', $acceptance) }}</pre></td>
                 @endif
               </tr>
               @endforeach

This then allowed me to identify the item that is supposedly with another company

So I go and check item 38 by visiting /hardware/38. This item is a legitimate item checked out to a different user entirely. So USERA is receiving a "wrong company" message for an item checked out by "USERB"

Checking the database for table assets with id 38. I can see the "assigned_to" field is correctly referencing USERB's id.

Full Multiple Companies Support is disabled

There is a single company configured under Settings > Companies.

In addition, table checkout_acceptances has a field assigned_to_id. Checking for 38 under checkoutable_id I see it is correctly referencing USERB