From 82d5592aecb55e45de7aaef710ab6601b8ec6d99 Mon Sep 17 00:00:00 2001 From: admin Date: Mon, 6 Jul 2026 13:49:05 +0800 Subject: [PATCH] Fix HR users with employee type bypassing branch view in Attendance Records --- app/Http/Controllers/AttendanceRecordController.php | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/app/Http/Controllers/AttendanceRecordController.php b/app/Http/Controllers/AttendanceRecordController.php index 234fc9b8b..fb697ae95 100644 --- a/app/Http/Controllers/AttendanceRecordController.php +++ b/app/Http/Controllers/AttendanceRecordController.php @@ -25,7 +25,8 @@ class AttendanceRecordController extends Controller $user = Auth::user(); // Employee self-service: redirect to calendar but pass their own records only - if ($user->type === 'employee' || $request->has('my_attendance')) { + $isStrictlyEmployee = $user->type === 'employee' && !$user->can('manage-attendance-records'); + if ($isStrictlyEmployee || $request->has('my_attendance')) { // For employees, show only their own attendance in calendar view if (!$request->routeIs('hr.attendance-records.calendar')) { return redirect()->route('hr.attendance-records.calendar', array_merge($request->all(), ['my_attendance' => 1])); @@ -958,7 +959,8 @@ class AttendanceRecordController extends Controller $user = Auth::user(); // Employee self-service: show only their own calendar - if ($user->type === 'employee' || $request->has('my_attendance')) { + $isStrictlyEmployee = $user->type === 'employee' && !$user->can('manage-attendance-records'); + if ($isStrictlyEmployee || $request->has('my_attendance')) { $month = $request->input('month', date('n')); $year = $request->input('year', date('Y'));