RomanNum3ral
/
kcal
mirror of https://github.com/kcal-app/kcal.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add a policy to restrict goal management to owner

This commit is contained in:
Christopher C. Wells 2021-11-09 17:00:30 -08:00
parent 3f04f14a2d
commit f17fb757ef
3 changed files with 28 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
app/Policies/GoalPolicy.php Normal file
View File

@ -0,0 +1,20 @@
<?php
namespace App\Policies;
use App\Models\Goal;
use App\Models\User;
use Illuminate\Auth\Access\HandlesAuthorization;
class GoalPolicy
{
use HandlesAuthorization;
/**
* Determine whether the user can access (show, edit, delete) the goal.
*/
public function access(User $user, Goal $goal): bool {
return $user->id === $goal->user_id;
}
}

3
app/Providers/AuthServiceProvider.php
View File

@ -2,7 +2,9 @@
namespace App\Providers;
use App\Models\Goal;
use App\Models\User;
use App\Policies\GoalPolicy;
use App\Policies\UserPolicy;
use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;
@ -13,6 +15,7 @@ class AuthServiceProvider extends ServiceProvider
* @inheritdoc
*/
protected $policies = [
Goal::class => GoalPolicy::class,
User::class => UserPolicy::class,
];

11
routes/auth.php
View File

@ -26,8 +26,9 @@ Route::middleware(['auth'])->group(function () {
Route::get('/foods/{food}/delete', [FoodController::class, 'delete'])->name('foods.delete');
// Goals.
Route::resource('goals', GoalController::class);
Route::get('/goals/{goal}/delete', [GoalController::class, 'delete'])->name('goals.delete');
Route::resource('goals', GoalController::class)->only(['index', 'create', 'store']);
Route::resource('goals', GoalController::class)->except(['index', 'create', 'store'])->middleware(['can:access,goal']);
Route::get('/goals/{goal}/delete', [GoalController::class, 'delete'])->middleware(['can:access,goal'])->name('goals.delete');
// Ingredient picker.
Route::get('/ingredient-picker/search', [IngredientPickerController::class, 'search'])->name('ingredient-picker.search');
@ -51,10 +52,8 @@ Route::middleware(['auth'])->group(function () {
// Users.
Route::get('/profile/{user}', [ProfileController::class, 'show'])->name('profiles.show');
});
Route::middleware(['auth', 'can:editProfile,user'])->group(function () {
// Profiles (non-admin Users variant).
Route::get('/profile/{user}/edit', [ProfileController::class, 'edit'])->name('profiles.edit');
Route::put('/profile/{user}', [ProfileController::class, 'update'])->name('profiles.update');
Route::get('/profile/{user}/edit', [ProfileController::class, 'edit'])->middleware(['can:editProfile,user'])->name('profiles.edit');
Route::put('/profile/{user}', [ProfileController::class, 'update'])->middleware(['can:editProfile,user'])->name('profiles.update');
});