8025fa6d05
Permissions now actually govern access instead of the hard-coded Admin role:
- Super-admin bypass (see all projects / full access) -> can('manage all')
in Project::scopeAccessibleBy, ProjectMap, ProjectDashboard, PhaseGantt,
LayerManager, ProjectReportController.
- Redundant '|| hasRole(Admin)' fallbacks dropped (Gate::before already lets
manage-all through can()): LayerManager (upload/delete layers), MediaManager
(upload), ProjectMap (update progress), ProjectUsers/ProjectCompanies
(assign users).
- Admin-only screens now gated by the matching permission: AdminUsers/UserView
-> can('view users'), UserForm -> can('create users')|can('edit users'),
CompanyView -> can('view companies').
- MediaManager delete: can('delete media') OR owner.
- Kept UserForm's domain guard (can't remove your own Admin role).
Note: the /admin route group still has middleware can:manage all, so admin
screens stay super-admin-only until that group is relaxed per-route.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
76 lines
1.8 KiB
PHP
76 lines
1.8 KiB
PHP
<?php
|
|
|
|
namespace App\Models;
|
|
|
|
use Illuminate\Database\Eloquent\Factories\HasFactory;
|
|
use Illuminate\Database\Eloquent\Model;
|
|
use Illuminate\Database\Eloquent\SoftDeletes;
|
|
|
|
class Project extends Model
|
|
{
|
|
use HasFactory, SoftDeletes;
|
|
|
|
protected $fillable = [
|
|
'name', 'reference', 'address', 'country', 'lat', 'lng',
|
|
'start_date', 'end_date_estimated', 'status', 'created_by',
|
|
];
|
|
|
|
protected $casts = [
|
|
"start_date" => "date",
|
|
"end_date_estimated" => "date",
|
|
];
|
|
|
|
public function changeOrders()
|
|
{
|
|
return $this->hasMany(ChangeOrder::class);
|
|
}
|
|
|
|
// Relationships
|
|
public function phases()
|
|
{
|
|
return $this->hasMany(Phase::class)->orderBy('order');
|
|
}
|
|
|
|
public function layers()
|
|
{
|
|
return $this->hasMany(Layer::class);
|
|
}
|
|
|
|
public function users()
|
|
{
|
|
return $this->belongsToMany(User::class)->withPivot('role_in_project');
|
|
}
|
|
|
|
public function companies()
|
|
{
|
|
return $this->belongsToMany(Company::class, 'company_project')
|
|
->withPivot('role_in_project')
|
|
->withTimestamps();
|
|
}
|
|
|
|
public function creator()
|
|
{
|
|
return $this->belongsTo(User::class, 'created_by');
|
|
}
|
|
|
|
public function media()
|
|
{
|
|
return $this->morphMany(Media::class, 'mediable');
|
|
}
|
|
|
|
public function images()
|
|
{
|
|
return $this->morphMany(Media::class, 'mediable')->where('category', 'image');
|
|
}
|
|
|
|
// Scope to filter accessible projects for non-admin users
|
|
public function scopeAccessibleBy($query, User $user)
|
|
{
|
|
if ($user->can('manage all')) {
|
|
return $query;
|
|
}
|
|
return $query->whereHas('users', function ($q) use ($user) {
|
|
$q->where('user_id', $user->id);
|
|
});
|
|
}
|
|
} |