fluent-boards / app / Http / Policies / SingleBoardPolicy.php

SingleBoardPolicy.php in FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration 2.1.0, at app/Http/Policies/SingleBoardPolicy.php

216 lines 5.5 KB

Raw Download Zip

1	<?php
2
3	namespace FluentBoards\App\Http\Policies;
4
5	use FluentBoards\Framework\Http\Request\Request;
6	use FluentBoards\App\Services\PermissionManager;
7
8	class SingleBoardPolicy extends BasePolicy
9	{
10	/**
11	* Check user permission for any method
12	* @param \FluentBoards\Framework\Http\Request\Request $request
13	* @param int $board_id
14	* @return bool
15	*/
16	public function verifyRequest(Request $request)
17	{
18
19	return PermissionManager::userHasBoardPermission($request->board_id, $request->getMethod());
20	}
21
22	public function delete(Request $request)
23	{
24	return PermissionManager::isAdmin();
25	}
26
27	/**
28	* Task AI actions. `summarize` only reads content the member can already see,
29	* so it is treated as a read for permission purposes — otherwise viewer-only
30	* members would be denied an action the UI intentionally offers them. Every
31	* other action writes to the task and keeps the normal write restrictions.
32	*/
33	public function taskAssist(Request $request)
34	{
35	$method = $request->get('action') === 'summarize' ? 'GET' : $request->getMethod();
36
37	return PermissionManager::userHasBoardPermission($request->board_id, $method);
38	}
39
40	public function makeManager(Request $request)
41	{
42	return $this->userIsBoardManager($request);
43	}
44
45	public function removeManager(Request $request)
46	{
47	return $this->userIsBoardManager($request);
48	}
49
50	public function makeViewer(Request $request)
51	{
52	return $this->userIsBoardManager($request);
53	}
54
55	public function makeMember(Request $request)
56	{
57	return $this->userIsBoardManager($request);
58	}
59
60	public function getInvitations(Request $request)
61	{
62	return $this->userIsBoardManager($request);
63	}
64
65	public function deleteInvitation(Request $request)
66	{
67	return $this->userIsBoardManager($request);
68	}
69
70	/**
71	* Restrict board membership changes to board managers.
72	*/
73	public function addMembersInBoard(Request $request)
74	{
75	return $this->userIsBoardManager($request);
76	}
77
78	/**
79	* Allow members to leave a board while restricting removal of others.
80	*/
81	public function removeUserFromBoard(Request $request)
82	{
83	$boardId = absint($request->board_id);
84	$targetUserId = absint($request->user_id);
85	$currentUserId = get_current_user_id();
86
87	if ($currentUserId && $targetUserId === $currentUserId) {
88	return PermissionManager::userHasPermission($boardId, $currentUserId);
89	}
90
91	return PermissionManager::isBoardManager($boardId);
92	}
93
94	/**
95	* Restrict permanent task deletion to board managers.
96	*/
97	public function deleteTask(Request $request)
98	{
99	return $this->userIsBoardManager($request);
100	}
101
102	/**
103	* Restrict permanent bulk task deletion to board managers.
104	*/
105	public function bulkDeleteTasks(Request $request)
106	{
107	return $this->userIsBoardManager($request);
108	}
109
110	/**
111	* Restrict board background changes to board managers.
112	*/
113	public function setBoardBackground(Request $request)
114	{
115	return $this->userIsBoardManager($request);
116	}
117
118	/**
119	* Restrict board background uploads to board managers.
120	*/
121	public function uploadBoardBackground(Request $request)
122	{
123	return $this->userIsBoardManager($request);
124	}
125
126	/**
127	* Restrict public board exposure to board managers.
128	*/
129	public function togglePublicAccess(Request $request)
130	{
131	return $this->userIsBoardManager($request);
132	}
133
134	/**
135	* Restrict custom-field creation to board managers (Pro).
136	*/
137	public function createCustomField(Request $request)
138	{
139	return $this->userIsBoardManager($request);
140	}
141
142	/**
143	* Restrict custom-field edits to board managers (Pro).
144	*/
145	public function updateCustomField(Request $request)
146	{
147	return $this->userIsBoardManager($request);
148	}
149
150	/**
151	* Restrict custom-field deletion to board managers (Pro).
152	*/
153	public function deleteCustomField(Request $request)
154	{
155	return $this->userIsBoardManager($request);
156	}
157
158	/**
159	* Restrict custom-field reordering to board managers (Pro).
160	*/
161	public function updateCustomFieldPosition(Request $request)
162	{
163	return $this->userIsBoardManager($request);
164	}
165
166	/**
167	* Restrict stage default-assignee configuration to board managers (Pro).
168	*/
169	public function setDefaultAssignees(Request $request)
170	{
171	return $this->userIsBoardManager($request);
172	}
173
174	/**
175	* Restrict stage default-watcher configuration to board managers (Pro).
176	*/
177	public function setDefaultWatchers(Request $request)
178	{
179	return $this->userIsBoardManager($request);
180	}
181
182	/**
183	* Keep roadmap and board-level properties global-admin-only.
184	*/
185	public function updateBoardProperties(Request $request)
186	{
187	return PermissionManager::isAdmin();
188	}
189
190	/**
191	* Keep whole-board archival global-admin-only.
192	*/
193	public function archiveBoard(Request $request)
194	{
195	return PermissionManager::isAdmin();
196	}
197
198	/**
199	* Keep whole-board restoration global-admin-only.
200	*/
201	public function restoreBoard(Request $request)
202	{
203	return PermissionManager::isAdmin();
204	}
205
206	/**
207	* Resolve board-manager access from the sanitized route board id.
208	*/
209	private function userIsBoardManager(Request $request)
210	{
211	return PermissionManager::isBoardManager(absint($request->board_id));
212	}
213
214
215	}
216