Files
construprogress/app/Models/Project.php
T
javier 8025fa6d05 refactor(authz): Phase 2 — replace hasRole('Admin') with permission checks
Permissions now actually govern access instead of the hard-coded Admin role:
- Super-admin bypass (see all projects / full access) -> can('manage all')
  in Project::scopeAccessibleBy, ProjectMap, ProjectDashboard, PhaseGantt,
  LayerManager, ProjectReportController.
- Redundant '|| hasRole(Admin)' fallbacks dropped (Gate::before already lets
  manage-all through can()): LayerManager (upload/delete layers), MediaManager
  (upload), ProjectMap (update progress), ProjectUsers/ProjectCompanies
  (assign users).
- Admin-only screens now gated by the matching permission: AdminUsers/UserView
  -> can('view users'), UserForm -> can('create users')|can('edit users'),
  CompanyView -> can('view companies').
- MediaManager delete: can('delete media') OR owner.
- Kept UserForm's domain guard (can't remove your own Admin role).

Note: the /admin route group still has middleware can:manage all, so admin
screens stay super-admin-only until that group is relaxed per-route.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-17 19:10:23 +02:00

76 lines
1.8 KiB
PHP

<?php
namespace App\Models;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Model;
use Illuminate\Database\Eloquent\SoftDeletes;
class Project extends Model
{
use HasFactory, SoftDeletes;
protected $fillable = [
'name', 'reference', 'address', 'country', 'lat', 'lng',
'start_date', 'end_date_estimated', 'status', 'created_by',
];
protected $casts = [
"start_date" => "date",
"end_date_estimated" => "date",
];
public function changeOrders()
{
return $this->hasMany(ChangeOrder::class);
}
// Relationships
public function phases()
{
return $this->hasMany(Phase::class)->orderBy('order');
}
public function layers()
{
return $this->hasMany(Layer::class);
}
public function users()
{
return $this->belongsToMany(User::class)->withPivot('role_in_project');
}
public function companies()
{
return $this->belongsToMany(Company::class, 'company_project')
->withPivot('role_in_project')
->withTimestamps();
}
public function creator()
{
return $this->belongsTo(User::class, 'created_by');
}
public function media()
{
return $this->morphMany(Media::class, 'mediable');
}
public function images()
{
return $this->morphMany(Media::class, 'mediable')->where('category', 'image');
}
// Scope to filter accessible projects for non-admin users
public function scopeAccessibleBy($query, User $user)
{
if ($user->can('manage all')) {
return $query;
}
return $query->whereHas('users', function ($q) use ($user) {
$q->where('user_id', $user->id);
});
}
}