chore: update document approval workflow and bug fixes

app/Http/Middleware/CheckContractorHierarchy.php

@@ -0,0 +1,58 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Illuminate\Support\Facades\Auth;
+use Modules\ContractorManagement\Models\Contractor;
+
+class CheckContractorHierarchy
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (!Auth::check()) {
+            return redirect()->route('login');
+        }
+
+        $user = Auth::user();
+
+        // admin bypasses hierarchy checks
+        if ($user->hasRole('admin')) {
+            return $next($request);
+        }
+
+        // For routes that specify a contractor, ensure the user has access
+        $targetContractorId = $request->route('contractor') ?? $request->input('contractor_id');
+
+        if ($targetContractorId) {
+            $targetContractorId = (int) $targetContractorId;
+
+            if ($user->contractor_id === $targetContractorId) {
+                return $next($request);
+            }
+
+            // Check if user is Main Contractor trying to access their Sub Contractor
+            $contractor = $user->contractor;
+            if ($contractor && $contractor->type === 'main') {
+                $isSub = Contractor::where('id', $targetContractorId)
+                    ->where('parent_id', $user->contractor_id)
+                    ->exists();
+
+                if ($isSub) {
+                    return $next($request);
+                }
+            }
+
+            abort(403, 'Unauthorized access to contractor data.');
+        }
+
+        return $next($request);
+    }
+}