NetworkServerTest: [Command] only allowed on owned objects

Assets/Mirror/Tests/Editor/NetworkServerTest.cs

@@ -507,6 +507,57 @@ public void SendCommand_CalledOnCorrectComponent()
             RemoteCallHelper.RemoveDelegate(registeredHash);
         }
 
+        [Test]
+        public void SendCommand_OnlyAllowedOnOwnedObjects()
+        {
+            // listen & connect
+            NetworkServer.Listen(1);
+            ConnectClientBlocking();
+
+            // set authenticated (required for message)
+            NetworkConnectionToClient connectionToClient = NetworkServer.connections.Values.First();
+            connectionToClient.isAuthenticated = true;
+
+            // add an identity with two networkbehaviour components
+            CreateNetworked(out GameObject _, out NetworkIdentity identity, out CommandTestNetworkBehaviour comp);
+            identity.netId = 42;
+            // for authority check
+            identity.connectionToClient = connectionToClient;
+            connectionToClient.identity = identity;
+
+            // identity needs to be in spawned dict, otherwise command handler
+            // won't find it
+            NetworkIdentity.spawned[identity.netId] = identity;
+
+            // register the command delegate, otherwise it's not found
+            int registeredHash = RemoteCallHelper.RegisterDelegate(
+                typeof(CommandTestNetworkBehaviour),
+                nameof(CommandTestNetworkBehaviour.CommandGenerated),
+                MirrorInvokeType.Command,
+                CommandTestNetworkBehaviour.CommandGenerated,
+                true);
+
+            // serialize message into an arraysegment
+            CommandMessage message = new CommandMessage
+            {
+                componentIndex = 0,
+                functionHash = RemoteCallHelper.GetMethodHash(typeof(CommandTestNetworkBehaviour), nameof(CommandTestNetworkBehaviour.CommandGenerated)),
+                netId = identity.netId,
+                payload = new ArraySegment<byte>(new byte[0])
+            };
+
+            // change identity's owner connection so we can't call [Commands] on it
+            identity.connectionToClient = new LocalConnectionToClient();
+
+            // send message to server
+            NetworkClient.Send(message);
+            ProcessMessages();
+            Assert.That(comp.called, Is.EqualTo(0));
+
+            // clean up
+            RemoteCallHelper.RemoveDelegate(registeredHash);
+        }
+
         // this runs a command all the way:
         //   byte[]->transport->server->identity->component
         [Test]