admin/HRM-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(permissions): resolve manager role permissions for leave applications and biometric attendance

Browse Source
This commit is contained in:
admin
2026-08-28 13:16:25 +08:00
parent d4788e3c9a
commit b992a49fec
439 changed files with 15761 additions and 14621 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
app/Http/Controllers/BiometricAttendanceController.php
View File

@@ -157,11 +157,34 @@ class BiometricAttendanceController extends Controller
return redirect()->back()->with('error', __('Permission Denied.'));
}
$user = Auth::user();
$canManageAny = $user->can('manage-any-biometric-attendance');
$canManageBranch = $user->can('manage-biometric-attendance');
$query = \App\Models\BiometricAttendance::with(['branch']);
// Filter by user type if employee
if (Auth::user()->type === 'employee') {
$biometricEmpId = Auth::user()->employee?->biometric_emp_id;
// Filter by permissions
if ($canManageAny) {
// Full company access
} elseif ($canManageBranch) {
$branchId = $user->branch_id ?? $user->employee?->branch_id;
if ($branchId) {
$branchEmpCodes = \App\Models\Employee::where('branch_id', $branchId)->whereNotNull('biometric_emp_id')->pluck('biometric_emp_id');
$query->where(function($q) use ($branchId, $branchEmpCodes) {
$q->where('branch_id', $branchId)
->orWhereIn('biometric_emp_id', $branchEmpCodes);
});
} else {
$biometricEmpId = $user->employee?->biometric_emp_id;
if (!empty($biometricEmpId)) {
$query->where('biometric_emp_id', $biometricEmpId);
} else {
$query->whereRaw('1 = 0');
}
}
} else {
// Self-service: only own biometric details
$biometricEmpId = $user->employee?->biometric_emp_id;
if (empty($biometricEmpId)) {
$query->whereRaw('1 = 0');
} else {
@@ -290,22 +313,37 @@ class BiometricAttendanceController extends Controller
public function show(Request $request, $employeeCode, $date)
{
try {
if (!Auth::user()->can('view-biometric-attendance')) {
$user = Auth::user();
if (!$user->can('view-biometric-attendance') && !$user->can('manage-biometric-attendance') && !$user->can('manage-any-biometric-attendance')) {
return response()->json([
'success' => false,
'message' => 'Permission denied'
], 403);
}
// If user is an employee, verify they are viewing their own record
if (Auth::user()->type === 'employee') {
$biometricEmpId = Auth::user()->employee?->biometric_emp_id;
$canManageAny = $user->can('manage-any-biometric-attendance');
$canManageBranch = $user->can('manage-biometric-attendance');
// If user is a self-service employee only, verify they are viewing their own record
if (!$canManageAny && !$canManageBranch) {
$biometricEmpId = $user->employee?->biometric_emp_id;
if (empty($biometricEmpId) || $biometricEmpId !== $employeeCode) {
return response()->json([
'success' => false,
'message' => 'Permission denied'
], 403);
}
} elseif (!$canManageAny && $canManageBranch) {
$branchId = $user->branch_id ?? $user->employee?->branch_id;
if ($branchId) {
$targetEmp = Employee::where('biometric_emp_id', $employeeCode)->first();
if ($targetEmp && $targetEmp->branch_id != $branchId) {
return response()->json([
'success' => false,
'message' => 'Permission denied'
], 403);
}
}
}
$employee = Employee::with('shift')->where('biometric_emp_id', $employeeCode)->first();