admin/HRM-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(payroll,leaves): enforce branch scoping for payroll/payslips/salaries, restrict employee role to own leaves, and set payslip header to SCX Software

Browse Source
This commit is contained in:
admin
2026-09-10 15:15:57 +08:00
parent ef1aa7cf24
commit 20f14c3719
427 changed files with 15410 additions and 14946 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
app/Http/Controllers/LeaveApplicationController.php
View File

@@ -17,11 +17,12 @@ class LeaveApplicationController extends Controller
public function index(Request $request)
{
$user = Auth::user();
$isEmployee = ($user->type === 'employee' || $user->hasRole('employee'));
$canManageAny = $user->can('manage-any-leave-applications');
$canManageBranch = $user->can('manage-leave-applications');
$isSelfServiceOnly = !$canManageAny && !$canManageBranch;
$isMyLeavesView = $request->boolean('my_leaves') || $isSelfServiceOnly;
$canManageAny = !$isEmployee && $user->can('manage-any-leave-applications');
$canManageBranch = !$isEmployee && $user->can('manage-leave-applications');
$isSelfServiceOnly = $isEmployee || (!$canManageAny && !$canManageBranch);
$isMyLeavesView = $isEmployee || $request->boolean('my_leaves') || $isSelfServiceOnly;
$scopedBranchId = authBranchId();
$query = LeaveApplication::with(['employee.employee', 'leaveType', 'leavePolicy', 'approver', 'creator']);
@@ -164,7 +165,9 @@ class LeaveApplicationController extends Controller
public function store(Request $request)
{
$user = Auth::user();
if ($user->type === 'employee') {
$isEmployee = ($user->type === 'employee' || $user->hasRole('employee'));
if ($isEmployee) {
$request->merge(['employee_id' => $user->id]);
} else {
if (!$user->can('create-leave-applications')) {
@@ -268,7 +271,8 @@ class LeaveApplicationController extends Controller
if ($leaveApplication) {
$user = Auth::user();
if ($user->type === 'employee') {
$isEmployee = ($user->type === 'employee' || $user->hasRole('employee'));
if ($isEmployee) {
if ($leaveApplication->employee_id !== $user->id) {
return redirect()->back()->with('error', __('Permission Denied.'));
}
@@ -330,7 +334,8 @@ class LeaveApplicationController extends Controller
if ($leaveApplication) {
$user = Auth::user();
if ($user->type === 'employee') {
$isEmployee = ($user->type === 'employee' || $user->hasRole('employee'));
if ($isEmployee) {
if ($leaveApplication->employee_id !== $user->id) {
return redirect()->back()->with('error', __('Permission Denied.'));
}
@@ -359,6 +364,12 @@ class LeaveApplicationController extends Controller
'manager_comments' => 'nullable|string',
]);
$user = Auth::user();
$isEmployee = ($user->type === 'employee' || $user->hasRole('employee'));
if ($isEmployee) {
return redirect()->back()->with('error', __('Permission Denied. Employees cannot approve or reject leave applications.'));
}
$leaveApplication = LeaveApplication::with('employee.employee')->where('id', $leaveApplicationId)
->whereIn('created_by', getCompanyAndUsersId())
->first();
@@ -431,31 +442,34 @@ class LeaveApplicationController extends Controller
public function export()
{
if (Auth::user()->can('export-leave-applications')) {
$user = Auth::user();
$isEmployee = ($user->type === 'employee' || $user->hasRole('employee'));
if ($user->can('export-leave-applications') || $isEmployee) {
$scopedBranchId = authBranchId();
try {
$leaveApplications = LeaveApplication::with(['employee.employee', 'leaveType', 'approver'])
->where(function ($q) use ($scopedBranchId) {
if ($scopedBranchId) {
->where(function ($q) use ($scopedBranchId, $isEmployee, $user) {
if ($isEmployee) {
$q->where('employee_id', $user->id)->orWhere('created_by', $user->id);
} elseif ($scopedBranchId) {
$q->whereIn('created_by', getCompanyAndUsersId())
->whereHas('employee.employee', function ($eq) use ($scopedBranchId) {
$eq->where('branch_id', $scopedBranchId);
});
} elseif (Auth::user()->can('manage-any-leave-applications')) {
} elseif ($user->can('manage-any-leave-applications')) {
$q->whereIn('created_by', getCompanyAndUsersId());
} elseif (Auth::user()->can('manage-leave-applications')) {
$branchId = Auth::user()->branch_id ?? Auth::user()->employee?->branch_id ?? null;
} elseif ($user->can('manage-leave-applications')) {
$branchId = $user->branch_id ?? $user->employee?->branch_id ?? null;
if ($branchId) {
$q->whereHas('employee.employee', function ($eq) use ($branchId) {
$eq->where('branch_id', $branchId);
});
} else {
$q->where('created_by', Auth::id())->orWhere('employee_id', Auth::id())->orWhere('approved_by', Auth::id());
$q->where('created_by', $user->id)->orWhere('employee_id', $user->id)->orWhere('approved_by', $user->id);
}
} elseif (Auth::user()->can('manage-own-leave-applications')) {
$q->where('created_by', Auth::id())->orWhere('employee_id', Auth::id())->orWhere('approved_by', Auth::id());
} else {
$q->whereRaw('1 = 0');
$q->where('employee_id', $user->id)->orWhere('created_by', $user->id);
}
})->get();