fluent-booking / app / Http / Policies / CalendarPolicy.php

CalendarPolicy.php in Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution 2.5.0, at app/Http/Policies/CalendarPolicy.php

131 lines 3.8 KB

Raw Download Zip

1	<?php
2
3	namespace FluentBooking\App\Http\Policies;
4
5	use FluentBooking\App\Models\Calendar;
6	use FluentBooking\App\Models\CalendarSlot;
7	use FluentBooking\App\Services\PermissionManager;
8	use FluentBooking\Framework\Http\Request\Request;
9	use FluentBooking\Framework\Foundation\Policy;
10
11	class CalendarPolicy extends Policy
12	{
13	/**
14	* Check user permission for any method
15	* @param \FluentBooking\Framework\Http\Request\Request $request
16	* @return bool
17	*/
18	public function verifyRequest(Request $request)
19	{
20	if (PermissionManager::userCan('manage_all_data')) {
21	return true;
22	}
23
24	// Resolve IDs strictly from URL route params; request-body values
25	// must never be allowed to redirect the authorization target.
26	$calendarId = (int) $this->getRouteParam($request, 'id');
27	$eventId = (int) $this->getRouteParam($request, 'event_id');
28
29	if (!$calendarId) {
30	return apply_filters('fluent_booking/verify_calendar_api', current_user_can('manage_options'), $request);
31	}
32
33	if ($eventId && !CalendarSlot::where('calendar_id', $calendarId)->where('id', $eventId)->exists()) {
34	return false;
35	}
36
37	$method = $request->getMethod();
38
39	// Event-scoped for reads too: hosting one event must not expose its sibling events' settings.
40	if ($eventId) {
41	return PermissionManager::canUpdateCalendarEvent($eventId);
42	}
43
44	if ($method == 'GET') {
45	return PermissionManager::canReadCalendar($calendarId);
46	}
47
48	return PermissionManager::canWriteCalendar($calendarId);
49	}
50
51	public function getAllCalendars(Request $request)
52	{
53	return !!PermissionManager::currentUserHasAnyPermission();
54	}
55
56	public function createCalendar(Request $request)
57	{
58	return $this->canCreateCalendar();
59	}
60
61	public function checkSlug(Request $request)
62	{
63	return $this->canCreateCalendar();
64	}
65
66	public function getNewEventLocationFields(Request $request)
67	{
68	return $this->canCreateCalendar();
69	}
70
71	public function getEvent(Request $request, $calendarId, $eventId)
72	{
73	return PermissionManager::canUpdateCalendarEvent($eventId);
74	}
75
76	public function deleteCalendar(Request $request)
77	{
78	if (PermissionManager::userCan('manage_all_data')) {
79	return true;
80	}
81
82	$calendarId = (int) $this->getRouteParam($request, 'id');
83
84	$calendar = Calendar::find($calendarId);
85
86	if (!$calendar) {
87	return false;
88	}
89
90	return $calendar->user_id == get_current_user_id();
91	}
92
93	public function deleteCalendarEvent(Request $request)
94	{
95	return $this->deleteCalendar($request);
96	}
97
98	public function cloneCalendarEvent(Request $request)
99	{
100	if (PermissionManager::userCan('manage_all_data')) {
101	return true;
102	}
103
104	$eventId = (int) $this->getRouteParam($request, 'event_id');
105
106	if (!$eventId \|\| !PermissionManager::canUpdateCalendarEvent($eventId)) {
107	return false;
108	}
109
110	$sourceCalendarId = (int) $this->getRouteParam($request, 'id');
111	$destinationCalendarId = intval($request->get('new_calendar_id')) ?: $sourceCalendarId;
112
113	return PermissionManager::canWriteCalendar($destinationCalendarId);
114	}
115
116	private function canCreateCalendar()
117	{
118	return PermissionManager::userCan(['manage_all_data', 'invite_team_members', 'manage_own_calendar']);
119	}
120
121	/**
122	* Read a URL route parameter. Some routes here (event-lists, root listing,
123	* create) have no placeholder, so direct access would warn.
124	*/
125	private function getRouteParam(Request $request, $key)
126	{
127	$params = (array) $request->get_url_params();
128	return isset($params[$key]) ? $params[$key] : null;
129	}
130	}
131