diff --git a/app/Http/Controllers/AttendanceRecordController.php b/app/Http/Controllers/AttendanceRecordController.php index 234fc9b8b..fb697ae95 100644 --- a/app/Http/Controllers/AttendanceRecordController.php +++ b/app/Http/Controllers/AttendanceRecordController.php @@ -25,7 +25,8 @@ class AttendanceRecordController extends Controller $user = Auth::user(); // Employee self-service: redirect to calendar but pass their own records only - if ($user->type === 'employee' || $request->has('my_attendance')) { + $isStrictlyEmployee = $user->type === 'employee' && !$user->can('manage-attendance-records'); + if ($isStrictlyEmployee || $request->has('my_attendance')) { // For employees, show only their own attendance in calendar view if (!$request->routeIs('hr.attendance-records.calendar')) { return redirect()->route('hr.attendance-records.calendar', array_merge($request->all(), ['my_attendance' => 1])); @@ -958,7 +959,8 @@ class AttendanceRecordController extends Controller $user = Auth::user(); // Employee self-service: show only their own calendar - if ($user->type === 'employee' || $request->has('my_attendance')) { + $isStrictlyEmployee = $user->type === 'employee' && !$user->can('manage-attendance-records'); + if ($isStrictlyEmployee || $request->has('my_attendance')) { $month = $request->input('month', date('n')); $year = $request->input('year', date('Y'));