← All changes | app/Features/Onboarding/OnboardingService.php +18 -0 2.0.2 → 2.1.1 View file →

		@@ -66,10 +66,28 @@
66	66	}
67	67	throw $e;
68	68	}
69	69
	70	+ if (!$this->brandCanBeConnected($brand)) {
	71	+ throw new BrandAccessDeniedException();
	72	+ }
	73	+
70	74	$this->activateTrackingHash($brand);
71	75	$this->api->storeBlogId($blogId);
	76	+ }
	77	+
	78	+ /**
	79	+ * A brand can only be connected by its owner or by a user whose brand
	80	+ * role includes the editBrand permission. This is the same capability
	81	+ * the Metricool API validates when linking a site to a brand.
	82	+ */
	83	+ private function brandCanBeConnected(array $brand): bool
	84	+ {
	85	+ if (isset($brand['ownerUserId']) && (string) $brand['ownerUserId'] === $this->api->getUserId()) {
	86	+ return true;
	87	+ }
	88	+
	89	+ return isset($brand['brandRole']['actions']['editBrand']) && $brand['brandRole']['actions']['editBrand'] === true;
72	90	}
73	91
74	92	/**
75	93	* Activate the tracking hash for the given brand and store it in the database