admin/HRM-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enforce branch isolation on Shift Calendar and fallback on templates

Browse Source
This commit is contained in:
admin
2026-07-06 13:43:11 +08:00
parent f851f30df5
commit 436dd731d4
1 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
app/Http/Controllers/ShiftController.php
View File

@@ -15,10 +15,8 @@ class ShiftController extends Controller
$query = Shift::with(['creator'])->where(function ($q) {
if (Auth::user()->can('manage-any-shifts')) {
$q->whereIn('created_by', getCompanyAndUsersId());
} elseif (Auth::user()->can('manage-own-shifts')) {
$q->where('created_by', Auth::id());
} else {
$q->whereRaw('1 = 0');
$q->where('created_by', Auth::id());
}
});
@@ -227,6 +225,17 @@ class ShiftController extends Controller
$q->where('employee_status', 'active');
});
if (!Auth::user()->can('manage-any-shifts')) {
$branchId = Auth::user()->employee->branch_id ?? null;
if ($branchId) {
$query->whereHas('employee', function($q) use ($branchId) {
$q->where('branch_id', $branchId);
});
} else {
$query->where('id', Auth::id());
}
}
if ($department_id) {
$query->whereHas('employee', function($q) use ($department_id) {
$q->where('department_id', $department_id);