← All changes | app/Models/User.php +67 -1 1.11 → 2.1.0 View file →

		@@ -11,11 +11,56 @@
11	11	protected $primaryKey = 'ID';
12	12
13	13	protected $hidden = ['user_pass', 'user_activation_key'];
14	14
	15	+ /**
	16	+ * wp_users columns that never belong in an API response. Nothing in the frontend reads them.
	17	+ */
	18	+ const ALWAYS_HIDDEN = [
	19	+ 'user_pass',
	20	+ 'user_activation_key',
	21	+ 'user_nicename',
	22	+ 'user_url',
	23	+ 'user_registered',
	24	+ 'user_status',
	25	+ ];
	26	+
	27	+ /**
	28	+ * Columns only serialized for users holding the `list_users` capability, matching the
	29	+ * policy Helper::sanitizeUserCollections() applies on the board and task routes.
	30	+ */
	31	+ const PRIVILEGED_ONLY = ['user_email'];
	32	+
	33	+ /** @var bool Set by the board export so the importer can match members by email. */
	34	+ protected static $serializePrivileged = false;
	35	+
15	36	protected $appends = ['photo'];
16	37
17	38	/**
	39	+ * Allow (or stop allowing) privileged columns in serialized output for the rest of the
	40	+ * request. Only for trusted, permission-checked flows such as the board JSON export.
	41	+ */
	42	+ public static function serializePrivilegedFields($enabled = true)
	43	+ {
	44	+ static::$serializePrivileged = (bool)$enabled;
	45	+ }
	46	+
	47	+ /**
	48	+ * Hidden attributes are resolved per request so that every response path serializing a
	49	+ * User model (relations, eager loads, toArray) applies the same disclosure policy.
	50	+ */
	51	+ public function getHidden()
	52	+ {
	53	+ $hidden = array_merge(self::ALWAYS_HIDDEN, parent::getHidden());
	54	+
	55	+ if (!static::$serializePrivileged && !current_user_can('list_users')) {
	56	+ $hidden = array_merge($hidden, self::PRIVILEGED_ONLY);
	57	+ }
	58	+
	59	+ return array_values(array_unique($hidden));
	60	+ }
	61	+
	62	+ /**
18	63	* Accessor to get dynamic photo attribute
19	64	* @return string
20	65	*/
21	66	public function getPhotoAttribute()
		@@ -30,9 +75,9 @@
30	75	'fbs_relations',
31	76	'foreign_id',
32	77	'object_id'
33	78	)->withPivot('settings')
34		- ->wherePivot('object_type', Constant::OBJECT_TYPE_TASK_ASSIGNEE)
	79	+ ->wherePivot('object_type', Constant::OBJECT_TYPE_USER_TASK_WATCH)
35	80	->withTimestamps();
36	81	}
37	82
38	83	public function watchingTasks()
		@@ -128,6 +173,27 @@
128	173	'user_id',
129	174	'notification_id'
130	175	)->withTimestamps()
131	176	->withPivot('marked_read_at');
	177	+ }
	178	+ public function assignedTasks()
	179	+ {
	180	+ return $this->belongsToMany(
	181	+ Task::class,
	182	+ 'fbs_relations',
	183	+ 'foreign_id',
	184	+ 'object_id'
	185	+ )->withPivot('settings')
	186	+ ->wherePivot('object_type', Constant::OBJECT_TYPE_TASK_ASSIGNEE)
	187	+ ->withTimestamps();
	188	+ }
	189	+
	190	+ public function mentionedTasks()
	191	+ {
	192	+ return Task::whereHas('notifications', function ($query) {
	193	+ $query->where('action', 'task_comment_mentioned')
	194	+ ->whereHas('users', function ($q) {
	195	+ $q->where('user_id', $this->ID);
	196	+ });
	197	+ });
132	198	}
133	199	}