presseportale/app/Http/Controllers/Api/V1/CompanyController.php

<?php

namespace App\Http\Controllers\Api\V1;

use App\Http\Controllers\Controller;
use App\Http\Resources\CompanyResource;
use App\Models\Company;
use App\Scopes\PortalScope;
use Illuminate\Http\Request;
use Illuminate\Http\Resources\Json\AnonymousResourceCollection;

class CompanyController extends Controller
{
    public function index(Request $request): AnonymousResourceCollection
    {
        abort_unless($request->user()->tokenCan('companies:read'), 403);

        // Untergrenze wie Obergrenze (Audit F11): ein negatives per_page hob
        // das SQL-Limit auf.
        $filters = $request->validate([
            'per_page' => ['sometimes', 'integer', 'min:1', 'max:100'],
        ]);

        $companies = Company::withoutGlobalScope(PortalScope::class)
            ->accessibleBy($request->user())
            ->orderBy('name')
            ->paginate((int) ($filters['per_page'] ?? 25));

        return CompanyResource::collection($companies);
    }

    public function store(Request $request)
    {
        abort(404);
    }

    public function show(Request $request, int $company): CompanyResource
    {
        abort_unless($request->user()->tokenCan('companies:read'), 403);

        $company = Company::withoutGlobalScope(PortalScope::class)
            ->whereKey($company)
            ->accessibleBy($request->user())
            ->first();

        abort_unless($company !== null, 403);

        return CompanyResource::make($company);
    }

    public function update(Request $request, string $id)
    {
        abort(404);
    }

    public function destroy(string $id)
    {
        abort(404);
    }
}