Josep Piguillem
3897113313
Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer collective, backed by the Pireon OAuth identity server. The public site is a separate, server-rendered application consuming /api/public/v1. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
44 lines
1.0 KiB
PHP
44 lines
1.0 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Policies;
|
|
|
|
use App\Enums\PageStatus;
|
|
use App\Models\Page;
|
|
use App\Models\User;
|
|
use Illuminate\Database\Eloquent\Model;
|
|
|
|
class PagePolicy extends ResourcePolicy
|
|
{
|
|
protected function resource(): string
|
|
{
|
|
return 'pages';
|
|
}
|
|
|
|
/**
|
|
* Authors may always edit their own drafts, even without the general
|
|
* update permission. Once a page is published, changing it takes the
|
|
* `pages.update` permission like anything else.
|
|
*
|
|
* @param Page|Model $model
|
|
*/
|
|
public function update(User $user, Model $model): bool
|
|
{
|
|
if (parent::update($user, $model)) {
|
|
return true;
|
|
}
|
|
|
|
return $model->author_id === $user->id && $model->status !== PageStatus::Published;
|
|
}
|
|
|
|
/**
|
|
* Moving a page into or out of the published state is a separate
|
|
* responsibility from editing its content.
|
|
*/
|
|
public function publish(User $user, ?Page $page = null): bool
|
|
{
|
|
return $user->can('pages.publish');
|
|
}
|
|
}
|