12-05-2026 Frontend dev

app/Policies/PressReleasePolicy.php

@@ -0,0 +1,83 @@
+<?php
+
+namespace App\Policies;
+
+use App\Enums\PressReleaseStatus;
+use App\Models\PressRelease;
+use App\Models\User;
+
+class PressReleasePolicy
+{
+    public function before(User $user): ?bool
+    {
+        return $user->is_super_admin ? true : null;
+    }
+
+    public function viewAny(User $user): bool
+    {
+        return $user->canAccessCustomer();
+    }
+
+    public function view(User $user, PressRelease $pressRelease): bool
+    {
+        if ($user->canAccessAdmin()) {
+            return true;
+        }
+
+        return $this->isAuthor($user, $pressRelease);
+    }
+
+    public function create(User $user): bool
+    {
+        return $user->canAccessCustomer();
+    }
+
+    public function update(User $user, PressRelease $pressRelease): bool
+    {
+        if (! $this->isAuthor($user, $pressRelease) && ! $user->canAccessAdmin()) {
+            return false;
+        }
+
+        return in_array(
+            $pressRelease->status,
+            [PressReleaseStatus::Draft, PressReleaseStatus::Rejected, PressReleaseStatus::Review],
+            true,
+        ) || $user->canAccessAdmin();
+    }
+
+    public function submitForReview(User $user, PressRelease $pressRelease): bool
+    {
+        return $this->isAuthor($user, $pressRelease)
+            && in_array($pressRelease->status, [PressReleaseStatus::Draft, PressReleaseStatus::Rejected], true);
+    }
+
+    public function delete(User $user, PressRelease $pressRelease): bool
+    {
+        if ($user->canAccessAdmin()) {
+            return true;
+        }
+
+        return $this->isAuthor($user, $pressRelease)
+            && $pressRelease->status !== PressReleaseStatus::Published;
+    }
+
+    public function restore(User $user, PressRelease $pressRelease): bool
+    {
+        return $user->canAccessAdmin();
+    }
+
+    public function forceDelete(User $user, PressRelease $pressRelease): bool
+    {
+        return $user->is_super_admin === true;
+    }
+
+    public function publish(User $user, PressRelease $pressRelease): bool
+    {
+        return $user->canAccessAdmin() && $user->can('press-releases:publish');
+    }
+
+    private function isAuthor(User $user, PressRelease $pressRelease): bool
+    {
+        return $pressRelease->user_id === $user->id;
+    }
+}