fluent-booking / app / Http / Policies / CalendarPolicy.php

CalendarPolicy.php in Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution 2.3.0, at app/Http/Policies/CalendarPolicy.php

129 lines 3.8 KB

Raw Download Zip

1	<?php
2
3	namespace FluentBooking\App\Http\Policies;
4
5	use FluentBooking\App\Models\Calendar;
6	use FluentBooking\App\Models\CalendarSlot;
7	use FluentBooking\App\Services\PermissionManager;
8	use FluentBooking\Framework\Http\Request\Request;
9	use FluentBooking\Framework\Foundation\Policy;
10
11	class CalendarPolicy extends Policy
12	{
13	/**
14	* Check user permission for any method
15	* @param \FluentBooking\Framework\Http\Request\Request $request
16	* @return bool
17	*/
18	public function verifyRequest(Request $request)
19	{
20	if (PermissionManager::userCan('manage_all_data')) {
21	return true;
22	}
23
24	// Resolve IDs strictly from URL route params; request-body values
25	// must never be allowed to redirect the authorization target.
26	$calendarId = (int) $this->getRouteParam($request, 'id');
27	$eventId = (int) $this->getRouteParam($request, 'event_id');
28
29	if (!$calendarId) {
30	return apply_filters('fluent_booking/verify_calendar_api', current_user_can('manage_options'), $request);
31	}
32
33	if ($eventId && !CalendarSlot::where('calendar_id', $calendarId)->where('id', $eventId)->exists()) {
34	return false;
35	}
36
37	$method = $request->getMethod();
38
39	if ($method == 'GET') {
40	return PermissionManager::canReadCalendar($calendarId);
41	}
42
43	if ($eventId) {
44	return PermissionManager::canUpdateCalendarEvent($eventId);
45	}
46
47	return PermissionManager::canWriteCalendar($calendarId);
48	}
49
50	public function getAllCalendars(Request $request)
51	{
52	return !!PermissionManager::currentUserHasAnyPermission();
53	}
54
55	public function createCalendar(Request $request)
56	{
57	if (PermissionManager::userCan(['manage_all_data', 'invite_team_members'])) {
58	return true;
59	}
60
61	if (PermissionManager::userCan('manage_own_calendar')) {
62	return true;
63	}
64
65	return false;
66	}
67
68	public function checkSlug(Request $request)
69	{
70	return PermissionManager::userCan(['manage_all_data', 'invite_team_members', 'manage_own_calendar']);
71	}
72
73	public function getEvent(Request $request, $calendarId, $eventId)
74	{
75	return PermissionManager::canUpdateCalendarEvent($eventId);
76	}
77
78	public function deleteCalendar(Request $request)
79	{
80	if (PermissionManager::userCan('manage_all_data')) {
81	return true;
82	}
83
84	$calendarId = (int) $this->getRouteParam($request, 'id');
85
86	$calendar = Calendar::find($calendarId);
87
88	if (!$calendar) {
89	return false;
90	}
91
92	return $calendar->user_id == get_current_user_id();
93	}
94
95	public function deleteCalendarEvent(Request $request)
96	{
97	return $this->deleteCalendar($request);
98	}
99
100	public function cloneCalendarEvent(Request $request)
101	{
102	if (PermissionManager::userCan('manage_all_data')) {
103	return true;
104	}
105
106	$eventId = (int) $this->getRouteParam($request, 'event_id');
107
108	if (!$eventId \|\| !PermissionManager::canUpdateCalendarEvent($eventId)) {
109	return false;
110	}
111
112	$sourceCalendarId = (int) $this->getRouteParam($request, 'id');
113	$destinationCalendarId = intval($request->get('new_calendar_id')) ?: $sourceCalendarId;
114
115	return PermissionManager::canWriteCalendar($destinationCalendarId);
116	}
117
118	/**
119	* Read a URL-only route parameter safely. Some routes under this prefix
120	* (event-lists, root listing, create) have no path placeholder, so a
121	* direct array access would emit an undefined-array-key warning.
122	*/
123	private function getRouteParam(Request $request, $key)
124	{
125	$params = (array) $request->get_url_params();
126	return isset($params[$key]) ? $params[$key] : null;
127	}
128	}
129