94 lines
2.7 KiB
PHP
94 lines
2.7 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Requests;
|
|
|
|
use Illuminate\Foundation\Http\FormRequest;
|
|
use App\Models\Permission;
|
|
use Illuminate\Support\Facades\Auth;
|
|
|
|
class RoleRequest extends FormRequest
|
|
{
|
|
public function authorize(): bool
|
|
{
|
|
return true;
|
|
}
|
|
|
|
public function rules(): array
|
|
{
|
|
return [
|
|
'label' => [
|
|
'required',
|
|
'string',
|
|
function ($attribute, $value, $fail) {
|
|
$this->validateSystemRole($value, $fail);
|
|
}
|
|
],
|
|
'description' => 'nullable|string',
|
|
'permissions' => 'required|array'
|
|
];
|
|
}
|
|
|
|
|
|
private function validatePermissionAccess($permissionName, $fail)
|
|
{
|
|
$user = Auth::user();
|
|
$userType = $user->type ?? 'company';
|
|
|
|
// Superadmin can assign any permission
|
|
if ($userType === 'superadmin' || $userType === 'super admin') {
|
|
return;
|
|
}
|
|
|
|
// Get allowed modules for current user role
|
|
$allowedModules = config('role-permissions.' . $userType, config('role-permissions.company'));
|
|
|
|
// Check if permission belongs to allowed module
|
|
$permission = Permission::where('name', $permissionName)->first();
|
|
|
|
if (!$permission) {
|
|
$fail('Permission does not exist.');
|
|
return;
|
|
}
|
|
|
|
// Skip validation if permission module is not in allowed modules (commented out)
|
|
if (!in_array($permission->module, $allowedModules)) {
|
|
return; // Allow but will be filtered out by controller
|
|
}
|
|
|
|
// For company users, validate settings permissions
|
|
if ($userType === 'company' && $permission->module === 'settings') {
|
|
$allowedSettingsPermissions = [
|
|
'manage-email-settings',
|
|
'manage-system-settings',
|
|
'manage-brand-settings'
|
|
];
|
|
|
|
if (!in_array($permissionName, $allowedSettingsPermissions)) {
|
|
$fail('You are not authorized to assign this permission.');
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
private function validateSystemRole($label, $fail)
|
|
{
|
|
$user = Auth::user();
|
|
$userType = $user->type ?? 'company';
|
|
|
|
// Superadmin can create/edit any role
|
|
if ($userType === 'superadmin' || $userType === 'super admin') {
|
|
return;
|
|
}
|
|
|
|
$systemRoles = ['superadmin', 'super admin', 'company'];
|
|
$slug = \Illuminate\Support\Str::slug($label);
|
|
|
|
if (
|
|
in_array(strtolower($label), array_map('strtolower', $systemRoles)) ||
|
|
in_array($slug, $systemRoles)
|
|
) {
|
|
$fail('This role name is reserved for system use. Please choose a different name.');
|
|
}
|
|
}
|
|
}
|