| 1 |
<?php |
| 2 |
|
| 3 |
namespace FluentBoards\App\Http\Policies; |
| 4 |
|
| 5 |
use FluentBoards\Framework\Http\Request\Request; |
| 6 |
use FluentBoards\App\Services\PermissionManager; |
| 7 |
|
| 8 |
class SingleBoardPolicy extends BasePolicy |
| 9 |
{ |
| 10 |
/** |
| 11 |
* Check user permission for any method |
| 12 |
* @param \FluentBoards\Framework\Http\Request\Request $request |
| 13 |
* @param int $board_id |
| 14 |
* @return bool |
| 15 |
*/ |
| 16 |
public function verifyRequest(Request $request) |
| 17 |
{ |
| 18 |
|
| 19 |
return PermissionManager::userHasBoardPermission($request->board_id, $request->getMethod()); |
| 20 |
} |
| 21 |
|
| 22 |
public function delete(Request $request) |
| 23 |
{ |
| 24 |
return PermissionManager::isAdmin(); |
| 25 |
} |
| 26 |
|
| 27 |
/** |
| 28 |
* Task AI actions. `summarize` only reads content the member can already see, |
| 29 |
* so it is treated as a read for permission purposes — otherwise viewer-only |
| 30 |
* members would be denied an action the UI intentionally offers them. Every |
| 31 |
* other action writes to the task and keeps the normal write restrictions. |
| 32 |
*/ |
| 33 |
public function taskAssist(Request $request) |
| 34 |
{ |
| 35 |
$method = $request->get('action') === 'summarize' ? 'GET' : $request->getMethod(); |
| 36 |
|
| 37 |
return PermissionManager::userHasBoardPermission($request->board_id, $method); |
| 38 |
} |
| 39 |
|
| 40 |
public function makeManager(Request $request) |
| 41 |
{ |
| 42 |
return PermissionManager::isBoardManager($request->board_id); |
| 43 |
} |
| 44 |
|
| 45 |
|
| 46 |
} |
| 47 |
|
