feat(auth): implement authorization for PrivateKey management

- Added authorization checks in the Create and Show Livewire components to ensure only authorized users can create, update, and delete PrivateKey instances.
- Introduced a new PrivateKeyPolicy to define access control rules for viewing, creating, updating, and deleting PrivateKey models based on user roles and team associations.
- Updated AuthServiceProvider to register the new PrivateKeyPolicy, enhancing security and access control for PrivateKey functionalities.
This commit is contained in:
Andras Bacsai committed 2025-08-22 13:02:20 +02:00
1 parent 3ffc751f1a
commit d8d01e6886
4 files changed
+76 -1

No files matched your search

+65
View File
@@ -0,0 +1,65 @@
<?php
namespace App\Policies;
use App\Models\PrivateKey;
use App\Models\User;
class PrivateKeyPolicy
{
/**
* Determine whether the user can view any models.
*/
public function viewAny(User $user): bool
{
return true;
}
/**
* Determine whether the user can view the model.
*/
public function view(User $user, PrivateKey $privateKey): bool
{
return $user->teams()->get()->firstWhere('id', $privateKey->team_id) !== null;
}
/**
* Determine whether the user can create models.
*/
public function create(User $user): bool
{
return $user->isAdmin();
}
/**
* Determine whether the user can update the model.
*/
public function update(User $user, PrivateKey $privateKey): bool
{
return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $privateKey->team_id) !== null;
}
/**
* Determine whether the user can delete the model.
*/
public function delete(User $user, PrivateKey $privateKey): bool
{
return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $privateKey->team_id) !== null;
}
/**
* Determine whether the user can restore the model.
*/
public function restore(User $user, PrivateKey $privateKey): bool
{
return false;
}
/**
* Determine whether the user can permanently delete the model.
*/
public function forceDelete(User $user, PrivateKey $privateKey): bool
{
return false;
}
}