admin/HRM-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(biometrics): enforce strict branch scoping on biometric attendance and sync

Browse Source 
- Restrict biometric attendances query and grouped records strictly to employees of assigned branch
- Scope bulk sync (syncAll) to only sync biometric records for employees within the user's branch
- Guard individual sync and custom sync against processing employees from foreign branches
- Tighten attendance records query to strictly filter by employee assigned branch
- Add feature test verifying biometric attendance isolation and permission guards
This commit is contained in:
admin
2026-09-10 11:32:48 +08:00
parent 33f776c6b2
commit ef1aa7cf24
3 changed files with 143 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
app/Http/Controllers/AttendanceRecordController.php
View File

@@ -46,11 +46,8 @@ class AttendanceRecordController extends Controller
->where(function ($q) use ($scopedBranchId) {
if ($scopedBranchId) {
$q->whereIn('created_by', getCompanyAndUsersId())
->where(function ($subQ) use ($scopedBranchId) {
$subQ->where('attendance_records.branch_id', $scopedBranchId)
->orWhereHas('employee.employee', function ($eq) use ($scopedBranchId) {
$eq->where('branch_id', $scopedBranchId);
});
->whereHas('employee.employee', function ($eq) use ($scopedBranchId) {
$eq->where('branch_id', $scopedBranchId);
});
} elseif (Auth::user()->can('manage-any-attendance-records')) {
$q->whereIn('created_by', getCompanyAndUsersId());