← All changes | app/Http/Policies/SingleBoardPolicy.php +186 -3 1.21 → 2.1.0 View file →

		@@ -8,15 +8,16 @@
8	8	class SingleBoardPolicy extends BasePolicy
9	9	{
10	10	/**
11	11	* Check user permission for any method
12		- * @param \FluentBoards\Framework\Request\Request $request
	12	+ * @param \FluentBoards\Framework\Http\Request\Request $request
13	13	* @param int $board_id
14	14	* @return bool
15	15	*/
16	16	public function verifyRequest(Request $request)
17	17	{
18		- return PermissionManager::userHasPermission($request->board_id);
	18	+
	19	+ return PermissionManager::userHasBoardPermission($request->board_id, $request->getMethod());
19	20	}
20	21
21	22	public function delete(Request $request)
22	23	{
		@@ -22,11 +23,193 @@
22	23	{
23	24	return PermissionManager::isAdmin();
24	25	}
25	26
	27	+ /**
	28	+ * Task AI actions. `summarize` only reads content the member can already see,
	29	+ * so it is treated as a read for permission purposes — otherwise viewer-only
	30	+ * members would be denied an action the UI intentionally offers them. Every
	31	+ * other action writes to the task and keeps the normal write restrictions.
	32	+ */
	33	+ public function taskAssist(Request $request)
	34	+ {
	35	+ $method = $request->get('action') === 'summarize' ? 'GET' : $request->getMethod();
	36	+
	37	+ return PermissionManager::userHasBoardPermission($request->board_id, $method);
	38	+ }
	39	+
26	40	public function makeManager(Request $request)
27	41	{
28		- return PermissionManager::isBoardManager($request->board_id);
	42	+ return $this->userIsBoardManager($request);
	43	+ }
	44	+
	45	+ public function removeManager(Request $request)
	46	+ {
	47	+ return $this->userIsBoardManager($request);
	48	+ }
	49	+
	50	+ public function makeViewer(Request $request)
	51	+ {
	52	+ return $this->userIsBoardManager($request);
	53	+ }
	54	+
	55	+ public function makeMember(Request $request)
	56	+ {
	57	+ return $this->userIsBoardManager($request);
	58	+ }
	59	+
	60	+ public function getInvitations(Request $request)
	61	+ {
	62	+ return $this->userIsBoardManager($request);
	63	+ }
	64	+
	65	+ public function deleteInvitation(Request $request)
	66	+ {
	67	+ return $this->userIsBoardManager($request);
	68	+ }
	69	+
	70	+ /**
	71	+ * Restrict board membership changes to board managers.
	72	+ */
	73	+ public function addMembersInBoard(Request $request)
	74	+ {
	75	+ return $this->userIsBoardManager($request);
	76	+ }
	77	+
	78	+ /**
	79	+ * Allow members to leave a board while restricting removal of others.
	80	+ */
	81	+ public function removeUserFromBoard(Request $request)
	82	+ {
	83	+ $boardId = absint($request->board_id);
	84	+ $targetUserId = absint($request->user_id);
	85	+ $currentUserId = get_current_user_id();
	86	+
	87	+ if ($currentUserId && $targetUserId === $currentUserId) {
	88	+ return PermissionManager::userHasPermission($boardId, $currentUserId);
	89	+ }
	90	+
	91	+ return PermissionManager::isBoardManager($boardId);
	92	+ }
	93	+
	94	+ /**
	95	+ * Restrict permanent task deletion to board managers.
	96	+ */
	97	+ public function deleteTask(Request $request)
	98	+ {
	99	+ return $this->userIsBoardManager($request);
	100	+ }
	101	+
	102	+ /**
	103	+ * Restrict permanent bulk task deletion to board managers.
	104	+ */
	105	+ public function bulkDeleteTasks(Request $request)
	106	+ {
	107	+ return $this->userIsBoardManager($request);
	108	+ }
	109	+
	110	+ /**
	111	+ * Restrict board background changes to board managers.
	112	+ */
	113	+ public function setBoardBackground(Request $request)
	114	+ {
	115	+ return $this->userIsBoardManager($request);
	116	+ }
	117	+
	118	+ /**
	119	+ * Restrict board background uploads to board managers.
	120	+ */
	121	+ public function uploadBoardBackground(Request $request)
	122	+ {
	123	+ return $this->userIsBoardManager($request);
	124	+ }
	125	+
	126	+ /**
	127	+ * Restrict public board exposure to board managers.
	128	+ */
	129	+ public function togglePublicAccess(Request $request)
	130	+ {
	131	+ return $this->userIsBoardManager($request);
	132	+ }
	133	+
	134	+ /**
	135	+ * Restrict custom-field creation to board managers (Pro).
	136	+ */
	137	+ public function createCustomField(Request $request)
	138	+ {
	139	+ return $this->userIsBoardManager($request);
	140	+ }
	141	+
	142	+ /**
	143	+ * Restrict custom-field edits to board managers (Pro).
	144	+ */
	145	+ public function updateCustomField(Request $request)
	146	+ {
	147	+ return $this->userIsBoardManager($request);
	148	+ }
	149	+
	150	+ /**
	151	+ * Restrict custom-field deletion to board managers (Pro).
	152	+ */
	153	+ public function deleteCustomField(Request $request)
	154	+ {
	155	+ return $this->userIsBoardManager($request);
	156	+ }
	157	+
	158	+ /**
	159	+ * Restrict custom-field reordering to board managers (Pro).
	160	+ */
	161	+ public function updateCustomFieldPosition(Request $request)
	162	+ {
	163	+ return $this->userIsBoardManager($request);
	164	+ }
	165	+
	166	+ /**
	167	+ * Restrict stage default-assignee configuration to board managers (Pro).
	168	+ */
	169	+ public function setDefaultAssignees(Request $request)
	170	+ {
	171	+ return $this->userIsBoardManager($request);
	172	+ }
	173	+
	174	+ /**
	175	+ * Restrict stage default-watcher configuration to board managers (Pro).
	176	+ */
	177	+ public function setDefaultWatchers(Request $request)
	178	+ {
	179	+ return $this->userIsBoardManager($request);
	180	+ }
	181	+
	182	+ /**
	183	+ * Keep roadmap and board-level properties global-admin-only.
	184	+ */
	185	+ public function updateBoardProperties(Request $request)
	186	+ {
	187	+ return PermissionManager::isAdmin();
	188	+ }
	189	+
	190	+ /**
	191	+ * Keep whole-board archival global-admin-only.
	192	+ */
	193	+ public function archiveBoard(Request $request)
	194	+ {
	195	+ return PermissionManager::isAdmin();
	196	+ }
	197	+
	198	+ /**
	199	+ * Keep whole-board restoration global-admin-only.
	200	+ */
	201	+ public function restoreBoard(Request $request)
	202	+ {
	203	+ return PermissionManager::isAdmin();
	204	+ }
	205	+
	206	+ /**
	207	+ * Resolve board-manager access from the sanitized route board id.
	208	+ */
	209	+ private function userIsBoardManager(Request $request)
	210	+ {
	211	+ return PermissionManager::isBoardManager(absint($request->board_id));
29	212	}
30	213
31	214
32	215	}