admin/HRM-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow HR to view company shifts but protect from edit/delete

Browse Source
This commit is contained in:
admin
2026-07-14 10:55:18 +08:00
parent 94c1ea050f
commit 778bf0f52b
1 changed files with 15 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
app/Http/Controllers/ShiftController.php
View File

@@ -16,7 +16,7 @@ class ShiftController extends Controller
if (Auth::user()->can('manage-any-shifts')) {
$q->whereIn('created_by', getCompanyAndUsersId());
} else {
$q->where('created_by', Auth::id());
$q->whereIn('created_by', getCompanyAndUsersId()); // Show all company shift templates
}
});
@@ -122,7 +122,13 @@ class ShiftController extends Controller
public function update(Request $request, $shiftId)
{
$shift = Shift::where('id', $shiftId)
->whereIn('created_by', getCompanyAndUsersId())
->where(function($q) {
if (Auth::user()->can('manage-any-shifts')) {
$q->whereIn('created_by', getCompanyAndUsersId());
} else {
$q->where('created_by', Auth::id());
}
})
->first();
if ($shift) {
@@ -164,7 +170,13 @@ class ShiftController extends Controller
public function destroy($shiftId)
{
$shift = Shift::where('id', $shiftId)
->whereIn('created_by', getCompanyAndUsersId())
->where(function($q) {
if (Auth::user()->can('manage-any-shifts')) {
$q->whereIn('created_by', getCompanyAndUsersId());
} else {
$q->where('created_by', Auth::id());
}
})
->first();
if ($shift) {