From 778bf0f52bad9442249a1a800331c7b962b53506 Mon Sep 17 00:00:00 2001 From: admin Date: Tue, 14 Jul 2026 10:55:18 +0800 Subject: [PATCH] Allow HR to view company shifts but protect from edit/delete --- app/Http/Controllers/ShiftController.php | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/app/Http/Controllers/ShiftController.php b/app/Http/Controllers/ShiftController.php index e88ebb3eb..ed11a4968 100644 --- a/app/Http/Controllers/ShiftController.php +++ b/app/Http/Controllers/ShiftController.php @@ -16,7 +16,7 @@ class ShiftController extends Controller if (Auth::user()->can('manage-any-shifts')) { $q->whereIn('created_by', getCompanyAndUsersId()); } else { - $q->where('created_by', Auth::id()); + $q->whereIn('created_by', getCompanyAndUsersId()); // Show all company shift templates } }); @@ -122,7 +122,13 @@ class ShiftController extends Controller public function update(Request $request, $shiftId) { $shift = Shift::where('id', $shiftId) - ->whereIn('created_by', getCompanyAndUsersId()) + ->where(function($q) { + if (Auth::user()->can('manage-any-shifts')) { + $q->whereIn('created_by', getCompanyAndUsersId()); + } else { + $q->where('created_by', Auth::id()); + } + }) ->first(); if ($shift) { @@ -164,7 +170,13 @@ class ShiftController extends Controller public function destroy($shiftId) { $shift = Shift::where('id', $shiftId) - ->whereIn('created_by', getCompanyAndUsersId()) + ->where(function($q) { + if (Auth::user()->can('manage-any-shifts')) { + $q->whereIn('created_by', getCompanyAndUsersId()); + } else { + $q->where('created_by', Auth::id()); + } + }) ->first(); if ($shift) {