fluent-booking / app / Http / Policies / MeetingPolicy.php

MeetingPolicy.php in Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution 2.5.0, at app/Http/Policies/MeetingPolicy.php

165 lines 4.4 KB

Raw Download Zip

1	<?php
2
3	namespace FluentBooking\App\Http\Policies;
4
5	use FluentBooking\App\Models\Booking;
6	use FluentBooking\App\Models\CalendarSlot;
7	use FluentBooking\App\Services\PermissionManager;
8	use FluentBooking\Framework\Http\Request\Request;
9	use FluentBooking\Framework\Foundation\Policy;
10
11	class MeetingPolicy extends Policy
12	{
13	/**
14	* Check user permission for any method
15	* @param \FluentBooking\Framework\Http\Request\Request $request
16	* @return Boolean
17	*/
18	public function verifyRequest(Request $request)
19	{
20	if (PermissionManager::userCan(['manage_all_bookings', 'manage_all_data'])) {
21	return true;
22	}
23
24	// Authorize only against the URL route parameter so request-body
25	// values cannot override the resource being acted on.
26	$bookingId = $this->getRouteBookingId($request);
27
28	if ($request->getMethod() == 'GET') {
29	if (PermissionManager::userCan(['manage_own_calendar','read_all_bookings'])) {
30	return true;
31	}
32
33	if ($bookingId) {
34	$booking = Booking::find($bookingId);
35	return $this->hasBookingAccess($booking);
36	}
37	}
38
39	if ($bookingId) {
40	$booking = Booking::find($bookingId);
41	return $this->hasBookingAccess($booking);
42	}
43
44	return false;
45	}
46
47	public function getGroupAttendees(Request $request)
48	{
49	if (current_user_can('manage_options')) {
50	return true;
51	}
52
53	if (PermissionManager::userCanSeeAllBookings()) {
54	return true;
55	}
56
57	$groupId = $this->getRouteParam($request, 'group_id');
58
59	if (!$groupId) {
60	return false;
61	}
62
63	$booking = Booking::where('group_id', $groupId)->first();
64
65	return $this->hasBookingAccess($booking);
66	}
67
68	public function getBookingActivities(Request $request)
69	{
70	return $this->authorizeBookingAccess($request);
71	}
72
73	public function getNotes(Request $request)
74	{
75	return $this->authorizeBookingAccess($request);
76	}
77
78	public function getBookingMetaInfo(Request $request)
79	{
80	return $this->authorizeBookingAccess($request);
81	}
82
83	public function getCrmContact(Request $request)
84	{
85	return $this->authorizeBookingAccess($request);
86	}
87
88	public function getCrmOptions(Request $request)
89	{
90	return $this->authorizeBookingAccess($request);
91	}
92
93	// State-changing: use verifyRequest so read-only roles (read_all_bookings)
94	// cannot mutate CRM data; only host access or manage_all_* passes for POST.
95	public function updateCrmTags(Request $request)
96	{
97	return $this->verifyRequest($request);
98	}
99
100	public function updateCrmLists(Request $request)
101	{
102	return $this->verifyRequest($request);
103	}
104
105	private function authorizeBookingAccess(Request $request)
106	{
107	if (PermissionManager::userCan(['manage_all_bookings', 'manage_all_data', 'read_all_bookings'])) {
108	return true;
109	}
110
111	$bookingId = $this->getRouteBookingId($request);
112
113	if (!$bookingId) {
114	return false;
115	}
116
117	$booking = Booking::find($bookingId);
118
119	return $this->hasBookingAccess($booking);
120	}
121
122	/**
123	* Resolve the booking ID from the URL route parameter only. Merged inputs
124	* let a body value shadow the URL, so a check could pass on one ID while
125	* the controller acts on another.
126	*/
127	private function getRouteBookingId(Request $request)
128	{
129	return $this->getRouteParam($request, 'id');
130	}
131
132	/**
133	* Read a URL route parameter. Some routes (/schedules/, /schedules/export)
134	* have no placeholder, so direct access would warn under PHP 8.
135	*/
136	private function getRouteParam(Request $request, $key)
137	{
138	$params = (array) $request->get_url_params();
139	return isset($params[$key]) ? $params[$key] : null;
140	}
141
142	private function hasBookingAccess($booking)
143	{
144	if (!$booking) {
145	return false;
146	}
147
148	$userId = get_current_user_id();
149	if (in_array($userId, $booking->getHostIds())) {
150	return true;
151	}
152
153	if (!PermissionManager::userCan('manage_own_calendar')) {
154	return false;
155	}
156
157	$calendarEvent = CalendarSlot::find($booking->event_id);
158	if (!$calendarEvent) {
159	return false;
160	}
161
162	return in_array($userId, $calendarEvent->getHostIds());
163	}
164	}
165