← All changes | app/Services/Tickets/AgentTicketAccess.php +58 -5 2.2.1 → 2.4.5 View file →

		@@ -6,8 +6,11 @@
6	6	use FluentSupport\App\Services\Helper;
7	7
8	8	class AgentTicketAccess
9	9	{
	10	+ // Keyed by user id so wp_set_current_user() switches land on their own entry.
	11	+ private static $restrictedByUser = [];
	12	+
10	13	public function currentAgentCanAccess($ticket)
11	14	{
12	15	return $this->canAccess(Helper::getAgentByUserId(), $ticket);
13	16	}
		@@ -79,23 +82,51 @@
79	82	}
80	83
81	84	public function applyMailboxRestrictionScope($query, $agent = null, $restrictions = null)
82	85	{
83		- $agent = $agent ?: Helper::getAgentByUserId();
84	86	$restrictedBoxes = $this->getRestrictedMailboxIds($agent, $restrictions);
85	87
86	88	if ($restrictedBoxes) {
87		- $query->where(function ($q) use ($restrictedBoxes) {
88		- $q->whereNotIn('mailbox_id', $restrictedBoxes);
89		- $q->orWhereNull('mailbox_id');
90		- });
	89	+ $this->applyRestrictedMailboxFilter($query, $restrictedBoxes);
91	90	}
92	91
93	92	return $query;
94	93	}
95	94
	95	+ // NOT IN is NULL, not TRUE, for a NULL mailbox — hence the explicit OR.
	96	+ protected function applyRestrictedMailboxFilter($query, $restrictedBoxes)
	97	+ {
	98	+ return $query->where(function ($q) use ($restrictedBoxes) {
	99	+ $q->whereNotIn('mailbox_id', $restrictedBoxes);
	100	+ $q->orWhereNull('mailbox_id');
	101	+ });
	102	+ }
	103	+
	104	+ // Costs an agent + meta read, so the current-user answer is memoised for the
	105	+ // request; a request constructs many instances and they all share it.
96	106	public function getRestrictedMailboxIds($agent = null, $restrictions = null)
97	107	{
	108	+ if ($agent !== null || $restrictions !== null) {
	109	+ return $this->resolveRestrictedMailboxIds($agent, $restrictions);
	110	+ }
	111	+
	112	+ $userId = (int) get_current_user_id();
	113	+
	114	+ if (!array_key_exists($userId, self::$restrictedByUser)) {
	115	+ self::$restrictedByUser[$userId] = $this->resolveRestrictedMailboxIds(null, null);
	116	+ }
	117	+
	118	+ return self::$restrictedByUser[$userId];
	119	+ }
	120	+
	121	+ // Call after writing agent_restrictions so the same request sees the new value.
	122	+ public static function resetCache()
	123	+ {
	124	+ self::$restrictedByUser = [];
	125	+ }
	126	+
	127	+ private function resolveRestrictedMailboxIds($agent, $restrictions)
	128	+ {
98	129	$agent = $agent ?: Helper::getAgentByUserId();
99	130
100	131	if (!$agent) {
101	132	return [];
		@@ -109,8 +140,30 @@
109	140	return array_values(array_unique(array_map('intval', $restrictions['restrictedBusinessBoxes'])));
110	141	}
111	142
112	143	return [];
	144	+ }
	145	+
	146	+ // Same boundary, for rows that reach their mailbox through a `ticket` relation.
	147	+ public function applyMailboxRestrictionScopeViaTicket($query)
	148	+ {
	149	+ $restrictedBoxes = $this->getRestrictedMailboxIds();
	150	+
	151	+ if (!$restrictedBoxes) {
	152	+ return $query;
	153	+ }
	154	+
	155	+ return $query->whereHas('ticket', function ($q) use ($restrictedBoxes) {
	156	+ $this->applyRestrictedMailboxFilter($q, $restrictedBoxes);
	157	+ });
	158	+ }
	159	+
	160	+ // Full access scope, for rows that reach their ticket through a `ticket` relation.
	161	+ public function applyAccessScopeViaTicket($query, $agent = null, $restrictions = null)
	162	+ {
	163	+ return $query->whereHas('ticket', function ($q) use ($agent, $restrictions) {
	164	+ $this->applyAccessScope($q, $agent, $restrictions);
	165	+ });
113	166	}
114	167
115	168	protected function isMailboxRestricted($agent, $ticket, $restrictions = null)
116	169	{