35 lines
875 B
PHP
35 lines
875 B
PHP
|
<?php
|
||
|
|
|
||
|
|
namespace App\Concerns;
|
||
|
|
|
||
|
|
use App\Enums\WorkspaceUserRole;
|
||
|
|
|
||
|
|
trait AuthorizesPermissions
|
||
|
|
{
|
||
|
|
/**
|
||
|
|
* Authorize the current user has the given permission.
|
||
|
|
*
|
||
|
|
* Owner: always passes.
|
||
|
|
* Worker: always fails (abort 404).
|
||
|
|
* Manager: checks the permissions JSON column on workspace_user pivot.
|
||
|
|
* Unknown permission keys default to false.
|
||
|
|
*/
|
||
|
|
protected function authorizePermission(string $permission): void
|
||
|
|
{
|
||
|
|
$workspaceUser = auth()->user()->currentWorkspaceUser();
|
||
|
|
|
||
|
|
if ($workspaceUser->role->is(WorkspaceUserRole::Owner)) {
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($workspaceUser->role->is(WorkspaceUserRole::Worker)) {
|
||
|
|
abort(404);
|
||
|
|
}
|
||
|
|
|
||
|
|
// Manager: check JSON permissions column
|
||
|
|
if (! ($workspaceUser->permissions[$permission] ?? false)) {
|
||
|
|
abort(404);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|