Optimierung 3.1: Company::scopeAccessibleBy() zentralisiert Firmenzugriff

Die 4x identische Zugriffs-Closure (owner_user_id == me OR whereHas('users',
me)) in CompanyController (index/show), PressReleaseController::
findOwnedCompany und CustomerCompanyContext::accessibleCompanyQuery durch
einen Company::scopeAccessibleBy() ersetzt; das Scope-Verhalten
(withoutGlobalScopes) bleibt beim Aufrufer.

Bewusst unangetastet: User::accessibleCompanyIds() (relationenbasiert MIT
globalen Scopes - anderes Scope-Verhalten) und PressReleaseImageController
(prueft PR-Autorschaft user_id, nicht Firmenzugriff).

Tests: neuer Scope-Test; volle Suite gruen (801 passed, 1 skipped).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/Http/Controllers/Api/V1/CompanyController.php

@@ -15,10 +15,7 @@ class CompanyController extends Controller
         abort_unless($request->user()->tokenCan('companies:read'), 403);
 
         $companies = Company::withoutGlobalScopes()
-            ->where(function ($query) use ($request): void {
-                $query->where('owner_user_id', $request->user()->id)
-                    ->orWhereHas('users', fn ($users) => $users->whereKey($request->user()->id));
-            })
+            ->accessibleBy($request->user())
             ->orderBy('name')
             ->paginate(min((int) $request->query('per_page', 25), 100));
 
@@ -36,10 +33,7 @@ class CompanyController extends Controller
 
         $company = Company::withoutGlobalScopes()
             ->whereKey($company)
-            ->where(function ($query) use ($request): void {
-                $query->where('owner_user_id', $request->user()->id)
-                    ->orWhereHas('users', fn ($users) => $users->whereKey($request->user()->id));
-            })
+            ->accessibleBy($request->user())
             ->first();
 
         abort_unless($company !== null, 403);

app/Http/Controllers/Api/V1/PressReleaseController.php

@@ -183,10 +183,7 @@ class PressReleaseController extends Controller
     {
         return Company::withoutGlobalScopes()
             ->whereKey($companyId)
-            ->where(function ($query) use ($request): void {
-                $query->where('owner_user_id', $request->user()->id)
-                    ->orWhereHas('users', fn ($users) => $users->whereKey($request->user()->id));
-            })
+            ->accessibleBy($request->user())
             ->first();
     }
 

app/Models/Company.php

@@ -103,6 +103,20 @@ class Company extends Model
         });
     }
 
+    /**
+     * Firmen, auf die ein User zugreifen darf: als Owner (owner_user_id) oder
+     * als Mitglied über den company_user-Pivot. Single Source of Truth für die
+     * zuvor in mehreren API-Controllern und Services duplizierte Closure. Das
+     * Scope-Verhalten (mit/ohne globale Scopes) bestimmt der Aufrufer.
+     */
+    public function scopeAccessibleBy(Builder $query, User $user): Builder
+    {
+        return $query->where(function (Builder $query) use ($user): void {
+            $query->where('owner_user_id', $user->id)
+                ->orWhereHas('users', fn (Builder $users) => $users->whereKey($user->id));
+        });
+    }
+
     public function owner(): BelongsTo
     {
         return $this->belongsTo(User::class, 'owner_user_id');

app/Services/Customer/CustomerCompanyContext.php

@@ -144,10 +144,7 @@ class CustomerCompanyContext
     {
         return Company::query()
             ->withoutGlobalScopes()
-            ->where(function ($query) use ($user): void {
-                $query->where('owner_user_id', $user->id)
-                    ->orWhereHas('users', fn ($userQuery) => $userQuery->whereKey($user->id));
-            });
+            ->accessibleBy($user);
     }
 
     public function findFor(User $user, int $companyId): ?Company

tests/Feature/CompanySearchByTermTest.php

@@ -1,6 +1,7 @@
 <?php
 
 use App\Models\Company;
+use App\Models\User;
 
 test('searchByTerm matches name and slug, ignoring non-matches', function () {
     $acme = Company::factory()->create(['name' => 'Acme Industries', 'slug' => 'acme-industries']);
@@ -23,3 +24,18 @@ test('searchByTerm strips a trailing portal abbreviation from the term', functio
 
     expect(Company::query()->searchByTerm('Musterfirma (PE)')->pluck('id'))->toContain($company->id);
 });
+
+test('accessibleBy includes owned and member companies but excludes others', function () {
+    $user = User::factory()->create();
+
+    $owned = Company::factory()->create(['owner_user_id' => $user->id]);
+    $member = Company::factory()->create();
+    $member->users()->attach($user->id, ['role' => 'member']);
+    $foreign = Company::factory()->create();
+
+    $ids = Company::query()->withoutGlobalScopes()->accessibleBy($user)->pluck('id');
+
+    expect($ids)->toContain($owned->id)
+        ->toContain($member->id)
+        ->not->toContain($foreign->id);
+});