2019-01-16 10:28:06 +01:00
|
|
|
<?php
|
|
|
|
|
|
|
|
namespace App\Policies;
|
|
|
|
|
|
|
|
use App\Models\User;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Class EntityPolicy
|
|
|
|
* @package App\Policies
|
|
|
|
*/
|
|
|
|
class EntityPolicy
|
|
|
|
{
|
|
|
|
/**
|
|
|
|
* Fires before any of the custom policy methods
|
2019-01-19 11:35:21 +01:00
|
|
|
*
|
|
|
|
* Only fires if true, if false we continue.....
|
2019-01-20 06:00:50 +01:00
|
|
|
*
|
|
|
|
* Do not use this function!!!! We MUST also check company_id,
|
2019-01-16 10:28:06 +01:00
|
|
|
*
|
|
|
|
* @param User $user
|
|
|
|
* @param $ability
|
2019-01-19 11:35:21 +01:00
|
|
|
* @return bool/void
|
2019-01-16 10:28:06 +01:00
|
|
|
*/
|
2019-01-19 11:35:21 +01:00
|
|
|
public function before($user, $ability)
|
2019-01-16 10:28:06 +01:00
|
|
|
{
|
2019-01-20 06:00:50 +01:00
|
|
|
//if($user->isAdmin())
|
|
|
|
// return true;
|
2019-01-16 10:28:06 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
2019-01-20 06:00:50 +01:00
|
|
|
* Checks if the user has edit permissions
|
|
|
|
*
|
|
|
|
* We MUST also check that the user can both edit a entity and also check the entity belongs to the users company!!!!!!
|
|
|
|
*
|
2019-01-16 10:28:06 +01:00
|
|
|
* @param User $user
|
|
|
|
* @param $entity
|
|
|
|
* @return bool
|
|
|
|
*/
|
|
|
|
public function edit(User $user, $entity) : bool
|
|
|
|
{
|
|
|
|
$entity = strtolower(class_basename($entity));
|
|
|
|
|
2019-01-20 06:00:50 +01:00
|
|
|
return ($user->isAdmin() && $entity->company_id == $user->company()->pivot->company_id)
|
|
|
|
|| ($user->hasPermission('edit_' . $entity) && $entity->company_id == $user->company()->pivot->company_id)
|
|
|
|
|| $user->owns($entity);
|
2019-01-16 10:28:06 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Checks if the user has view permissions
|
2019-01-20 06:00:50 +01:00
|
|
|
*
|
|
|
|
* We MUST also check that the user can both view a entity and also check the entity belongs to the users company!!!!!!
|
2019-01-16 10:28:06 +01:00
|
|
|
* @param User $user
|
|
|
|
* @param $entity
|
|
|
|
* @return bool
|
|
|
|
*/
|
|
|
|
public function view(User $user, $entity) : bool
|
|
|
|
{
|
|
|
|
$entity = strtolower(class_basename($entity));
|
|
|
|
|
2019-01-20 06:00:50 +01:00
|
|
|
return ($user->isAdmin() && $entity->company_id == $user->company()->pivot->company_id)
|
|
|
|
|| ($user->hasPermission('view_' . $entity) && $entity->company_id == $user->company()->pivot->company_id)
|
|
|
|
|| $user->owns($entity);
|
2019-01-16 10:28:06 +01:00
|
|
|
}
|
2019-01-20 06:00:50 +01:00
|
|
|
|
|
|
|
|
2019-01-16 10:28:06 +01:00
|
|
|
}
|