feat: access control

Vatsim-Scandinavia · Oct 5, 2023 · e48be89 · e48be89
1 parent 52c81b1
commit e48be89
Show file tree

Hide file tree

Showing 4 changed files with 92 additions and 26 deletions.
diff --git a/app/Http/Controllers/TaskController.php b/app/Http/Controllers/TaskController.php
@@ -4,6 +4,7 @@
 
 use App\Helpers\TaskStatus;
 use App\Models\Task;
+use App\Models\User;
 use App\Rules\ValidTaskType;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\File;
@@ -17,6 +18,9 @@ class TaskController extends Controller
      */
     public function index($activeFilter = null)
     {
+
+        $this->authorize('update', Task::class);
+
         $user = auth()->user();
 
         if ($activeFilter == 'sent') {
@@ -36,6 +40,8 @@ public function index($activeFilter = null)
     public function store(Request $request)
     {
 
+        $this->authorize('create', Task::class);
+
         $data = $request->validate([
             'type' => ['required', new ValidTaskType],
             'message' => 'sometimes|min:3|max:256',
@@ -47,13 +53,22 @@ public function store(Request $request)
         $data['sender_user_id'] = auth()->user()->id;
         $data['created_at'] = now();
 
-        // Create the model
-        $task = Task::create($data);
+        // Check if recipient is mentor or above
+        $recipient = User::findOrFail($data['recipient_user_id']);
 
-        // Run the create method on the task type to trigger type specific actions on creation
-        $task->type()->create($task);
+        // Policy check if recpient can recieve a task
+        if ($recipient->can('receive', Task::class)) {
+            // Create the model
+            $task = Task::create($data);
+
+            // Run the create method on the task type to trigger type specific actions on creation
+            $task->type()->create($task);
+
+            return redirect()->back()->with('success', 'Task created successfully.');
+        }
+
+        return redirect()->back()->withErrors('Recipient is not allowed to receive tasks.');
 
-        return redirect()->back()->with('success', 'Task created successfully.');
     }
 
     /**
@@ -64,6 +79,8 @@ public function store(Request $request)
     public function complete(Request $request, int $task)
     {
 
+        $this->authorize('update', Task::class);
+
         $task = Task::findOrFail($task);
 
         $task->status = TaskStatus::COMPLETED->value;
@@ -84,6 +101,8 @@ public function complete(Request $request, int $task)
     public function decline(Request $request, int $task)
     {
 
+        $this->authorize('update', Task::class);
+
         $task = Task::findOrFail($task);
 
         $task->status = TaskStatus::DECLINED->value;

diff --git a/app/Policies/TaskPolicy.php b/app/Policies/TaskPolicy.php
@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\User;
+use Illuminate\Auth\Access\HandlesAuthorization;
+
+class TaskPolicy
+{
+    use HandlesAuthorization;
+
+    /**
+     * Determine whether the user can create bookings.
+     *
+     * @return bool
+     */
+    public function create(User $user)
+    {
+        return $user->isMentorOrAbove();
+    }
+
+    /**
+     * Determine whether the user can update the task.
+     *
+     * @return bool
+     */
+    public function update(User $user)
+    {
+        return $user->isMentorOrAbove();
+    }
+
+    /**
+     * Determine if user is able to receive a task
+     *
+     * @return bool
+     */
+    public function receive(User $user)
+    {
+        return $user->isMentorOrAbove();
+    }
+}
diff --git a/resources/views/layouts/sidebar.blade.php b/resources/views/layouts/sidebar.blade.php
@@ -24,15 +24,17 @@
             <span>Dashboard</span></a>
         </li>
 
-        <li class="nav-item {{ Route::is('tasks') ? 'active' : '' }}">
-            <a class="nav-link" href="{{ route('tasks') }}">
-                <i class="fas fa-fw fa-list"></i>
-                <span>Tasks</span>
-                @if(\Auth::user()->tasks->count())
-                    <span class="badge text-bg-danger">{{ \Auth::user()->tasks->count() }}</span>
-                @endif
-            </a>
-        </li>
+        @can('update', [\App\Models\Task::class])
+            <li class="nav-item {{ Route::is('tasks') ? 'active' : '' }}">
+                <a class="nav-link" href="{{ route('tasks') }}">
+                    <i class="fas fa-fw fa-list"></i>
+                    <span>Tasks</span>
+                    @if(\Auth::user()->tasks->count())
+                        <span class="badge text-bg-danger">{{ \Auth::user()->tasks->count() }}</span>
+                    @endif
+                </a>
+            </li>
+        @endcan
 
         @can('view', \App\Models\Booking::class)
             <li class="nav-item {{ Route::is('booking*') ? 'active' : '' }}">

diff --git a/resources/views/training/show.blade.php b/resources/views/training/show.blade.php
@@ -47,19 +47,23 @@
                         @endif
                     @endforeach
                 </h6>
-                <button class="btn btn-light btn-icon dropdown-toggle" type="button" id="dropdownMenuButton" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
-                    <i class="fas fa-hand"></i> Request
-                </button>
-                <div class="dropdown">
-                    <div class="dropdown-menu" aria-labelledby="dropdownMenuButton">
-                        @foreach($requestTypes as $requestType)
-                            <button class="dropdown-item" data-bs-toggle="modal" data-bs-target="#{{ Str::camel($requestType->getName()) }}">
-                                <i class="fas {{ $requestType->getIcon() }}"></i>&nbsp;
-                                {{ $requestType->getName() }}
-                            </button>
-                        @endforeach
+
+                @can('create', [\App\Models\Task::class])
+                    <button class="btn btn-light btn-icon dropdown-toggle" type="button" id="dropdownMenuButton" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+                        <i class="fas fa-hand"></i> Request
+                    </button>
+                    <div class="dropdown">
+                        <div class="dropdown-menu" aria-labelledby="dropdownMenuButton">
+                            @foreach($requestTypes as $requestType)
+                                <button class="dropdown-item" data-bs-toggle="modal" data-bs-target="#{{ Str::camel($requestType->getName()) }}">
+                                    <i class="fas {{ $requestType->getIcon() }}"></i>&nbsp;
+                                    {{ $requestType->getName() }}
+                                </button>
+                            @endforeach
+                        </div>
                     </div>
-                </div>
+                @endcan
+
             </div>
             <div class="card-body">
                 <dl class="copyable">