From 436dd731d48e0078909df42885053aa6b93b3615 Mon Sep 17 00:00:00 2001
From: admin <aysuser00@gmail.com>
Date: Mon, 6 Jul 2026 13:43:11 +0800
Subject: [PATCH] Enforce branch isolation on Shift Calendar and fallback on
 templates

---
 app/Http/Controllers/ShiftController.php | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/app/Http/Controllers/ShiftController.php b/app/Http/Controllers/ShiftController.php
index 7da7758a0..e88ebb3eb 100644
--- a/app/Http/Controllers/ShiftController.php
+++ b/app/Http/Controllers/ShiftController.php
@@ -15,10 +15,8 @@ class ShiftController extends Controller
             $query = Shift::with(['creator'])->where(function ($q) {
                 if (Auth::user()->can('manage-any-shifts')) {
                     $q->whereIn('created_by',  getCompanyAndUsersId());
-                } elseif (Auth::user()->can('manage-own-shifts')) {
-                    $q->where('created_by', Auth::id());
                 } else {
-                    $q->whereRaw('1 = 0');
+                    $q->where('created_by', Auth::id());
                 }
             });
 
@@ -227,6 +225,17 @@ class ShiftController extends Controller
                 $q->where('employee_status', 'active');
             });
 
+            if (!Auth::user()->can('manage-any-shifts')) {
+                $branchId = Auth::user()->employee->branch_id ?? null;
+                if ($branchId) {
+                    $query->whereHas('employee', function($q) use ($branchId) {
+                        $q->where('branch_id', $branchId);
+                    });
+                } else {
+                    $query->where('id', Auth::id());
+                }
+            }
+
             if ($department_id) {
                 $query->whereHas('employee', function($q) use ($department_id) {
                     $q->where('department_id', $department_id);