# fluent-booking/2.1.2/app/Http/Policies/CalendarEventPolicy.php

Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution, version 2.1.2. 44 lines.

- Page: https://pluginprobe.com/plugins/fluent-booking/2.1.2/code/app/Http/Policies/CalendarEventPolicy.php
- Raw: https://pluginprobe.com/plugins/fluent-booking/2.1.2/raw/app/Http/Policies/CalendarEventPolicy.php
- Modified: 2026-05-20T14:08:58+00:00

Line numbers below start at 1. Link to a line or a range by appending a fragment to the
page URL, for example `https://pluginprobe.com/plugins/fluent-booking/2.1.2/code/app/Http/Policies/CalendarEventPolicy.php#L10-L20`.

```php
<?php

namespace FluentBooking\App\Http\Policies;

use FluentBooking\App\Services\PermissionManager;
use FluentBooking\Framework\Http\Request\Request;
use FluentBooking\Framework\Foundation\Policy;
use FluentBooking\App\Models\CalendarSlot;

class CalendarEventPolicy extends Policy
{
    /**
     * Check user permission for any method
     * @param \FluentBooking\Framework\Http\Request\Request $request
     * @return Boolean
     */
    public function verifyRequest(Request $request)
    {
        if (PermissionManager::userCan(['manage_all_data', 'manage_other_calendars'])) {
            return true;
        }

        // Resolve event_id from the URL route only — request-body values
        // must not be permitted to redirect the authorization target.
        // The /bookings/ index route has no placeholder so guard the access.
        $urlParams = (array) $request->get_url_params();
        $eventId = isset($urlParams['event_id']) ? (int) $urlParams['event_id'] : 0;

        if ($eventId) {
            $calendarEvent = CalendarSlot::find($eventId);
            if (!$calendarEvent) {
                return false;
            }
            return in_array(get_current_user_id(), $calendarEvent->getHostIds());
        }

        if ($request->method() == 'GET') {
            return PermissionManager::userCan(['manage_all_data', 'read_other_calendars']);
        }

        return false;
    }
}

```