67 lines
1.9 KiB
PHP
67 lines
1.9 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Policies;
|
|
|
|
use App\Models\Post;
|
|
use App\Models\User;
|
|
use Illuminate\Auth\Access\Response;
|
|
|
|
class PostPolicy
|
|
{
|
|
/**
|
|
* Authorize viewing a post. The post must live in the user's current
|
|
* workspace; cross-workspace lookups deny as 404 so we don't leak
|
|
* existence across tenants.
|
|
*/
|
|
public function view(User $user, Post $post): bool|Response
|
|
{
|
|
if ($post->workspace_id !== $user->current_workspace_id) {
|
|
return Response::denyAsNotFound();
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* Authorize updating a post: tenancy guard (404 across tenants) then the
|
|
* role gate — viewers are read-only (403).
|
|
*/
|
|
public function update(User $user, Post $post): bool|Response
|
|
{
|
|
if ($post->workspace_id !== $user->current_workspace_id) {
|
|
return Response::denyAsNotFound();
|
|
}
|
|
|
|
return $user->can('createPost', $user->currentWorkspace);
|
|
}
|
|
|
|
/**
|
|
* Authorize deleting a post: tenancy guard (404 across tenants) then the
|
|
* same role gate as `update` — viewers are read-only (403).
|
|
*/
|
|
public function delete(User $user, Post $post): bool|Response
|
|
{
|
|
if ($post->workspace_id !== $user->current_workspace_id) {
|
|
return Response::denyAsNotFound();
|
|
}
|
|
|
|
return $user->can('createPost', $user->currentWorkspace);
|
|
}
|
|
|
|
/**
|
|
* Authorize duplicating a post into the user's current workspace as a
|
|
* fresh draft. The post must live in the user's current workspace
|
|
* (404 otherwise — tenancy guard, see `view()`) AND the user must
|
|
* have permission to create posts there (403 otherwise).
|
|
*/
|
|
public function duplicate(User $user, Post $post): bool|Response
|
|
{
|
|
if ($post->workspace_id !== $user->current_workspace_id) {
|
|
return Response::denyAsNotFound();
|
|
}
|
|
|
|
return $user->can('createPost', $user->currentWorkspace);
|
|
}
|
|
}
|