← All changes | app/Http/Policies/UserPolicy.php +35 -0 2.1.0 → 2.2.0 View file →

		@@ -30,8 +30,43 @@
30	30
31	31	return $targetUserId > 0 && PermissionManager::userCanAccessMemberProfile($targetUserId);
32	32	}
33	33
	34	+ /** Only an authenticated Fluent Boards user may change their own name. */
	35	+ public function updateDisplayName(Request $request)
	36	+ {
	37	+ $routeParams = $request->get_url_params();
	38	+ $currentUserId = get_current_user_id();
	39	+ return $currentUserId > 0
	40	+ && (int) ($routeParams['id'] ?? 0) === $currentUserId
	41	+ && PermissionManager::isFluentBoardsUser($currentUserId);
	42	+ }
	43	+
	44	+ /** Apply the same ownership check to profile photo uploads. */
	45	+ public function updateProfilePhoto(Request $request)
	46	+ {
	47	+ return $this->updateDisplayName($request);
	48	+ }
	49	+
	50	+ /** MCP connections are managed only by their owner. */
	51	+ public function getMcpConnections(Request $request)
	52	+ {
	53	+ $routeParams = $request->get_url_params();
	54	+ $currentUserId = get_current_user_id();
	55	+
	56	+ return $currentUserId > 0 && (int) ($routeParams['id'] ?? 0) === $currentUserId;
	57	+ }
	58	+
	59	+ public function createMcpConnection(Request $request)
	60	+ {
	61	+ return $this->getMcpConnections($request);
	62	+ }
	63	+
	64	+ public function revokeMcpConnection(Request $request)
	65	+ {
	66	+ return $this->getMcpConnections($request);
	67	+ }
	68	+
34	69	public function globalSearch(Request $request)
35	70	{
36	71	return true;
37	72	}