admin/GSB-Construction
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: enhance module RBAC permissions, financial billing workflows, task evidence uploading, and role analytics
Some checks failed
Tests / PHP 8.3 (push) Has been cancelled
Details
Tests / PHP 8.4 (push) Has been cancelled
Details
Tests / PHP 8.5 (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Ajjj
2026-08-13 18:46:26 +08:00
parent 10eb7be033
commit ccbd23d474
40 changed files with 2324 additions and 353 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
Modules/DocumentManagement/app/Http/Controllers/DocumentController.php
View File

@@ -14,7 +14,7 @@ class DocumentController extends Controller
{
public function index(Request $request)
{
$query = Document::with(['uploader:id,name', 'category', 'project', 'approvals.approver']);
$query = Document::with(['uploader:id,name,contractor_id', 'category', 'project', 'approvals.approver']);
if ($search = $request->search) {
$query->where('title', 'like', "%{$search}%");
@@ -259,6 +259,22 @@ class DocumentController extends Controller
public function destroy(Document $document)
{
$user = auth()->user();
// Platform / Executive roles can delete any document
$isExecutive = is_null($user?->contractor_id)
|| in_array($user?->user_type, ['admin', 'super_admin'])
|| $user?->hasAnyRole(['Super Admin', 'Admin', 'Project Manager', 'Executive']);
if (!$isExecutive) {
// Contractors can delete documents uploaded by anyone in their contractor company
$uploaderContractorId = $document->uploader?->contractor_id;
$isOwnCompany = ((int)$document->uploaded_by === (int)$user->id)
|| ($user->contractor_id && $uploaderContractorId !== null && (int)$uploaderContractorId === (int)$user->contractor_id);
abort_unless($isOwnCompany, 403, 'Contractors can only delete documents uploaded by their company.');
}
// Delete all version files
foreach ($document->versions as $version) {
$disk = $this->resolveDisk($version->file_path);