5bb39da598
Viewers could mutate posts, automations and trigger AI write endpoints,
and every role saw create/manage affordances that 403'd on click.
Backend (security):
- PostPolicy update/delete now require member+ (was tenancy-only), which
also gates the AI write endpoints that authorize('update')
- AutomationPolicy create/update/delete require member+; activate/pause
delegate to update
- AutomationController authorizes index/store/show; AnalyticsController
authorizes view
- Comments stay open to members incl. viewer (by design)
Frontend (UI gating via new useWorkspaceRole composable):
- Sidebar: create post / create workspace / automations / library nav
- Accounts grid: connect / disconnect / reconnect (admin+)
- Members: invite / change role / remove / cancel invite (admin+)
- Account billing tab (owner); posts index + calendar create affordances
Tests: PostPolicyTest, AutomationPolicyTest (all four roles) and an
end-to-end WorkspaceRolePermissionsTest; aligned the automation test
suites' account/workspace setup with role pivots.
49 lines
1.2 KiB
PHP
49 lines
1.2 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Policies;
|
|
|
|
use App\Models\Automation;
|
|
use App\Models\User;
|
|
|
|
class AutomationPolicy
|
|
{
|
|
public function viewAny(User $user): bool
|
|
{
|
|
return $user->currentWorkspace !== null;
|
|
}
|
|
|
|
public function view(User $user, Automation $automation): bool
|
|
{
|
|
return $automation->workspace_id === $user->current_workspace_id;
|
|
}
|
|
|
|
public function create(User $user): bool
|
|
{
|
|
return $user->currentWorkspace !== null
|
|
&& $user->can('createPost', $user->currentWorkspace);
|
|
}
|
|
|
|
public function update(User $user, Automation $automation): bool
|
|
{
|
|
return $automation->workspace_id === $user->current_workspace_id
|
|
&& $user->can('createPost', $user->currentWorkspace);
|
|
}
|
|
|
|
public function delete(User $user, Automation $automation): bool
|
|
{
|
|
return $automation->workspace_id === $user->current_workspace_id
|
|
&& $user->can('createPost', $user->currentWorkspace);
|
|
}
|
|
|
|
public function activate(User $user, Automation $automation): bool
|
|
{
|
|
return $this->update($user, $automation);
|
|
}
|
|
|
|
public function pause(User $user, Automation $automation): bool
|
|
{
|
|
return $this->update($user, $automation);
|
|
}
|
|
}
|