fluentform / app / Http / Policies / ReportPolicy.php

ReportPolicy.php in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 6.2.14, at app/Http/Policies/ReportPolicy.php

181 lines 4.9 KB

Raw Download Zip

1	<?php
2
3	namespace FluentForm\App\Http\Policies;
4
5	use FluentForm\App\Modules\Acl\Acl;
6	use FluentForm\App\Services\Manager\FormManagerService;
7	use FluentForm\Framework\Http\Request\Request;
8	use FluentForm\Framework\Foundation\Policy;
9	use FluentForm\Framework\Support\Arr;
10
11	class ReportPolicy extends Policy
12	{
13	private function canAccessReportData(Request $request)
14	{
15	$formId = $this->resolveFormId($request);
16
17	if ($formId) {
18	return Acl::hasPermission('fluentform_entries_viewer', $formId);
19	}
20
21	return Acl::hasPermission('fluentform_entries_viewer');
22	}
23
24	private function canAccessDashboardReport(Request $request)
25	{
26	if (!Acl::hasPermission('fluentform_dashboard_access')) {
27	return false;
28	}
29
30	return $this->canAccessReportData($request);
31	}
32
33	private function canAccessRequestedForm(Request $request)
34	{
35	return $this->canAccessReportData($request);
36	}
37
38	private function canAccessOptionalFormScopedReport(Request $request)
39	{
40	if (!Acl::hasPermission('fluentform_dashboard_access')) {
41	return false;
42	}
43
44	$formId = $this->resolveFormId($request);
45
46	if ($formId) {
47	return Acl::hasPermission('fluentform_entries_viewer', $formId);
48	}
49
50	if (!Acl::hasPermission('fluentform_entries_viewer')) {
51	return false;
52	}
53
54	$userId = get_current_user_id();
55
56	return !$userId \|\| !FormManagerService::hasSpecificFormsPermission($userId);
57	}
58
59	private function canAccessPaymentReport(Request $request)
60	{
61	// Payment/revenue/subscription data requires the dedicated, form-scoped
62	// payment-view capability — the entry-view capability must not authorize
63	// financial aggregates.
64	$formId = $this->resolveFormId($request);
65
66	if ($formId) {
67	return Acl::hasPermission('fluentform_view_payments', $formId);
68	}
69
70	if (!Acl::hasPermission('fluentform_view_payments')) {
71	return false;
72	}
73
74	// A specific-forms manager must NOT read the all-forms (form_id 0)
75	// payment view — otherwise the per-form scope is bypassed by loading the
76	// aggregate revenue/subscription report. Mirrors canAccessOptionalFormScopedReport.
77	$userId = get_current_user_id();
78
79	return !$userId \|\| !FormManagerService::hasSpecificFormsPermission($userId);
80	}
81
82	/**
83	* Check permission for any method
84	*
85	* @param \FluentForm\Framework\Request\Request $request
86	* @return bool
87	*/
88	public function verifyRequest(Request $request)
89	{
90	return Acl::hasPermission('fluentform_dashboard_access');
91	}
92
93	public function form(Request $request)
94	{
95	return $this->canAccessRequestedForm($request);
96	}
97
98	public function submissions(Request $request)
99	{
100	return $this->canAccessRequestedForm($request);
101	}
102
103	public function getOverviewChart(Request $request)
104	{
105	return $this->canAccessRequestedForm($request);
106	}
107
108	public function getRevenueChart(Request $request)
109	{
110	return $this->canAccessPaymentReport($request);
111	}
112
113	public function getFormStats(Request $request)
114	{
115	return $this->canAccessRequestedForm($request);
116	}
117
118	public function getApiLogs(Request $request)
119	{
120	return $this->canAccessRequestedForm($request);
121	}
122
123	public function getPaymentTypes(Request $request)
124	{
125	return $this->canAccessPaymentReport($request);
126	}
127
128	public function getCompletionRate(Request $request)
129	{
130	return $this->canAccessOptionalFormScopedReport($request);
131	}
132
133	public function getHeatmapData(Request $request)
134	{
135	return $this->canAccessOptionalFormScopedReport($request);
136	}
137
138	public function getCountryHeatmap(Request $request)
139	{
140	return $this->canAccessOptionalFormScopedReport($request);
141	}
142
143	public function getTopPerformingForms(Request $request)
144	{
145	return $this->canAccessDashboardReport($request);
146	}
147
148	public function getSubscriptions(Request $request)
149	{
150	return $this->canAccessPaymentReport($request);
151	}
152
153	public function getFormsDropdown(Request $request)
154	{
155	return $this->canAccessDashboardReport($request);
156	}
157
158	public function netRevenue(Request $request)
159	{
160	return $this->canAccessPaymentReport($request);
161	}
162
163	public function submissionsAnalysis(Request $request)
164	{
165	return $this->canAccessOptionalFormScopedReport($request);
166	}
167
168	private function resolveFormId(Request $request)
169	{
170	$route = $request->route();
171	$routeFormId = $route ? Arr::get($route->getParameter(), 'form_id') : null;
172	$routeFormId = Acl::normalizeFormId($routeFormId);
173
174	if ($routeFormId) {
175	return $routeFormId;
176	}
177
178	return Acl::normalizeFormId($request->get('form_id'));
179	}
180	}
181