Die 4x identische Zugriffs-Closure (owner_user_id == me OR whereHas('users',
me)) in CompanyController (index/show), PressReleaseController::
findOwnedCompany und CustomerCompanyContext::accessibleCompanyQuery durch
einen Company::scopeAccessibleBy() ersetzt; das Scope-Verhalten
(withoutGlobalScopes) bleibt beim Aufrufer.
Bewusst unangetastet: User::accessibleCompanyIds() (relationenbasiert MIT
globalen Scopes - anderes Scope-Verhalten) und PressReleaseImageController
(prueft PR-Autorschaft user_id, nicht Firmenzugriff).
Tests: neuer Scope-Test; volle Suite gruen (801 passed, 1 skipped).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
53 lines
1.3 KiB
PHP
53 lines
1.3 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers\Api\V1;
|
|
|
|
use App\Http\Controllers\Controller;
|
|
use App\Http\Resources\CompanyResource;
|
|
use App\Models\Company;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
|
|
|
|
class CompanyController extends Controller
|
|
{
|
|
public function index(Request $request): AnonymousResourceCollection
|
|
{
|
|
abort_unless($request->user()->tokenCan('companies:read'), 403);
|
|
|
|
$companies = Company::withoutGlobalScopes()
|
|
->accessibleBy($request->user())
|
|
->orderBy('name')
|
|
->paginate(min((int) $request->query('per_page', 25), 100));
|
|
|
|
return CompanyResource::collection($companies);
|
|
}
|
|
|
|
public function store(Request $request)
|
|
{
|
|
abort(404);
|
|
}
|
|
|
|
public function show(Request $request, int $company): CompanyResource
|
|
{
|
|
abort_unless($request->user()->tokenCan('companies:read'), 403);
|
|
|
|
$company = Company::withoutGlobalScopes()
|
|
->whereKey($company)
|
|
->accessibleBy($request->user())
|
|
->first();
|
|
|
|
abort_unless($company !== null, 403);
|
|
|
|
return CompanyResource::make($company);
|
|
}
|
|
|
|
public function update(Request $request, string $id)
|
|
{
|
|
abort(404);
|
|
}
|
|
|
|
public function destroy(string $id)
|
|
{
|
|
abort(404);
|
|
}
|
|
}
|