59 lines
1.7 KiB
PHP
59 lines
1.7 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
use Illuminate\Support\Facades\Auth;
|
|
use Modules\ContractorManagement\Models\Contractor;
|
|
|
|
class CheckContractorHierarchy
|
|
{
|
|
/**
|
|
* Handle an incoming request.
|
|
*
|
|
* @param \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response) $next
|
|
*/
|
|
public function handle(Request $request, Closure $next): Response
|
|
{
|
|
if (!Auth::check()) {
|
|
return redirect()->route('login');
|
|
}
|
|
|
|
$user = Auth::user();
|
|
|
|
// admin bypasses hierarchy checks
|
|
if ($user->hasRole('admin')) {
|
|
return $next($request);
|
|
}
|
|
|
|
// For routes that specify a contractor, ensure the user has access
|
|
$targetContractorId = $request->route('contractor') ?? $request->input('contractor_id');
|
|
|
|
if ($targetContractorId) {
|
|
$targetContractorId = (int) $targetContractorId;
|
|
|
|
if ($user->contractor_id === $targetContractorId) {
|
|
return $next($request);
|
|
}
|
|
|
|
// Check if user is Main Contractor trying to access their Sub Contractor
|
|
$contractor = $user->contractor;
|
|
if ($contractor && $contractor->type === 'main') {
|
|
$isSub = Contractor::where('id', $targetContractorId)
|
|
->where('parent_id', $user->contractor_id)
|
|
->exists();
|
|
|
|
if ($isSub) {
|
|
return $next($request);
|
|
}
|
|
}
|
|
|
|
abort(403, 'Unauthorized access to contractor data.');
|
|
}
|
|
|
|
return $next($request);
|
|
}
|
|
}
|