FEATURE #2048: prepare routes for ACL, add some more permissions

app/Policies/BasicPolicy.php

@@ -4,17 +4,43 @@ namespace App\Policies;
 
 use App\Models\User;
 use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Database\Eloquent\Model;
 
 abstract class BasicPolicy
 {
     use HandlesAuthorization;
 
+    protected $entity;
+
     public function before(User $user, $ability)
     {
-        if ($user->role == User::ROLE_ADMIN) {
-            return true;
+        // check if user can operate on given entity
+        if (!$this->manage($user)) {
+            return false;
         }
+    }
 
-        return null;
+    /**
+     * Can user manage given entity?
+     *
+     * @param User $user
+     *
+     * @return bool
+     */
+    public function manage(User $user) {
+        return $user->hasAbility($this->entity.'-management');
+    }
+
+    /**
+     * Determine whether the user can delete the content.
+     *
+     * @param  \App\Models\User $user
+     * @param Model             $model
+     *
+     * @return mixed
+     */
+    public function delete(User $user, Model $model)
+    {
+        return $user->hasAbility('delete-'.$this->entity);
     }
 }

app/Policies/ContentPolicy.php

@@ -2,48 +2,28 @@
 
 namespace App\Policies;
 
-use App\Models\User;
 use App\Models\Content\Content;
+use App\Models\User;
 use Illuminate\Auth\Access\HandlesAuthorization;
 
 class ContentPolicy extends BasicPolicy
 {
     use HandlesAuthorization;
-
-    /**
-     * Determine whether the user can view the content.
-     *
-     * @param  \App\Models\User  $user
-     * @param  \App\Models\Content\Content  $content
-     * @return mixed
-     */
-    public function view(User $user, Content $content)
-    {
-        //
-    }
-
-    /**
-     * Determine whether the user can create contents.
-     *
-     * @param  \App\Models\User  $user
-     * @return mixed
-     */
-    public function create(User $user)
-    {
-        return true;
-    }
+    protected $entity = 'contents';
 
     /**
      * Determine whether the user can update the content.
      *
-     * @param  \App\Models\User  $user
-     * @param  \App\Models\Content\Content  $content
+     * @param  \App\Models\User            $user
+     * @param  \App\Models\Content\Content $content
+     *
      * @return mixed
      */
     public function update(User $user, Content $content)
     {
-        if (!$user->hasAbility('update-contents-'.$content->module->alias))
+        if (!$user->hasAbility('update-contents-' . $content->module->alias)) {
             return false;
+        }
 
         if ($user->id != $content->user_id) {
             return $user->hasAbility('update-contents') && $user->hasAbility('update-all-contents');
@@ -52,15 +32,21 @@ class ContentPolicy extends BasicPolicy
         return $user->hasAbility('update-contents');
     }
 
-    /**
-     * Determine whether the user can delete the content.
-     *
-     * @param  \App\Models\User  $user
-     * @param  \App\Models\Content\Content  $content
-     * @return mixed
-     */
-    public function delete(User $user, Content $content)
+    public function create(User $user, Content $content) {
+        return $user->hasAbility('create-contents');
+    }
+
+    public function publish(User $user, Content $content)
     {
-        return $user->hasAbility('delete-contents');
+        return $user->hasAbility('publish-contents');
+    }
+
+    public function setHomepage(User $user, Content $content)
+    {
+        return $user->hasAbility('set-homepage-contents');
+    }
+
+    public function viewHistory(User $user, Content $content) {
+        return $user->hasAbility('view-history-contents');
     }
 }

app/Policies/FilesPolicy.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\FileManager\File;
+use App\Models\User;
+use Illuminate\Auth\Access\HandlesAuthorization;
+
+class FilesPolicy extends BasicPolicy
+{
+    use HandlesAuthorization;
+    protected $entity = 'files';
+
+    /**
+     * Determine whether the user can create appModelsFileManagerFiles.
+     *
+     * @param  User $user
+     * @param File  $file
+     *
+     * @return mixed
+     */
+    public function create(User $user, File $file)
+    {
+        return $user->hasAbility('upload-files');
+    }
+
+    /**
+     * Determine whether the user can update the appModelsFileManagerFile.
+     *
+     * @param  User  $user
+     * @param  File $file
+     *
+     * @return mixed
+     */
+    public function update(User $user, File $file)
+    {
+        return $user->hasAbility('update-files');
+    }
+}

app/Policies/ModulePolicy.php

@@ -2,25 +2,15 @@
 
 namespace App\Policies;
 
-use App\Models\User;
 use App\Models\Module;
+use App\Models\User;
 use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Database\Eloquent\Model;
 
 class ModulePolicy extends BasicPolicy
 {
     use HandlesAuthorization;
-
-    /**
-     * Determine whether the user can view the module.
-     *
-     * @param  \App\Models\User  $user
-     * @param  \App\Module  $module
-     * @return mixed
-     */
-    public function view(User $user, Module $module)
-    {
-        //
-    }
+    protected $entity = 'modules';
 
     /**
      * Determine whether the user can create modules.
@@ -30,32 +20,8 @@ class ModulePolicy extends BasicPolicy
      *
      * @return mixed
      */
-    public function create(User $user, Module $module)
+    public function create(User $user, Model $module)
     {
-        return $user->hasAbility('create-contents-'.$module->alias);
-    }
-
-    /**
-     * Determine whether the user can update the module.
-     *
-     * @param  \App\Models\User  $user
-     * @param  \App\Module  $module
-     * @return mixed
-     */
-    public function update(User $user, Module $module)
-    {
-        //
-    }
-
-    /**
-     * Determine whether the user can delete the module.
-     *
-     * @param  \App\Models\User  $user
-     * @param  \App\Module  $module
-     * @return mixed
-     */
-    public function delete(User $user, Module $module)
-    {
-        //
+        return $user->hasAbility('create-contents-' . $module->alias);
     }
 }

app/Policies/UserPolicy.php

@@ -8,51 +8,80 @@ use Illuminate\Auth\Access\HandlesAuthorization;
 class UserPolicy extends BasicPolicy
 {
     use HandlesAuthorization;
+    protected $entity = 'users';
 
     /**
-     * Determine whether the user can view the user.
+     * Can current user updates other users (or himself?)
      *
-     * @param  \App\Models\User  $user
-     * @param  \App\Models\User  $user
-     * @return mixed
+     * @param User $currentUser
+     * @param User $user
+     *
+     * @return bool
      */
-    public function view(User $user, User $user)
+    public function update(User $currentUser, User $user)
     {
-
+        return $currentUser->id == $user->id || $currentUser->hasAbility('update-users');
     }
 
     /**
-     * Determine whether the user can create users.
+     * Can user create other users?
      *
-     * @param  \App\Models\User  $user
-     * @return mixed
+     * @param User $user
+     *
+     * @return bool
      */
-    public function create(User $user)
-    {
-        //
+    public function create(User $user) {
+        return $user->hasAbility('create-users');
     }
 
     /**
-     * Determine whether the user can update the user.
+     * Does current user has permissions for setting permissions to other users?
      *
-     * @param  \App\Models\User  $user
-     * @param  \App\Models\User  $user
-     * @return mixed
+     * @param User $currentUser
+     * @param User $user
+     *
+     * @return bool
      */
-    public function update(User $user, User $user)
+    public function setPermissions(User $currentUser, User $user)
     {
-        //
+        if ($currentUser->id == $user->id || $user->role == User::ROLE_VISITOR) {
+            return false;
+        }
+
+        return $currentUser->hasAbility('set-permissions-users');
     }
 
     /**
-     * Determine whether the user can delete the user.
+     * Can logged user change status of other users?
      *
-     * @param  \App\Models\User  $user
-     * @param  \App\Models\User  $user
-     * @return mixed
+     * @param User $currentUser
+     * @param User $user
+     *
+     * @return bool
      */
-    public function delete(User $user, User $user)
+    public function changeStatus(User $currentUser, User $user)
     {
-        //
+        if ($currentUser->id == $user->id) {
+            return false;
+        }
+
+        return $currentUser->hasAbility('change-status-users');
+    }
+
+    /**
+     * Can current user change role of other users?
+     *
+     * @param User $currentUser
+     * @param User $user
+     *
+     * @return bool
+     */
+    public function changeRole(User $currentUser, User $user)
+    {
+        if ($currentUser->id == $user->id) {
+            return false;
+        }
+
+        return $currentUser->hasAbility('change-role-users');
     }
 }