Josep Piguillem
76d022053b
A reply starts from a template filled in the language the person wrote in, is sent by the application when it has a mailer that delivers or handed to the replier's mail program otherwise, and is recorded on the submission. The same is available through the API. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
105 lines
3.7 KiB
PHP
105 lines
3.7 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Providers;
|
|
|
|
use App\Models\Application;
|
|
use App\Models\Call;
|
|
use App\Models\Category;
|
|
use App\Models\Client;
|
|
use App\Models\Media;
|
|
use App\Models\Member;
|
|
use App\Models\MissingUrl;
|
|
use App\Models\Page;
|
|
use App\Models\Project;
|
|
use App\Models\Redirect;
|
|
use App\Models\ReplyTemplate;
|
|
use App\Models\Repository;
|
|
use App\Models\Service;
|
|
use App\Models\Talk;
|
|
use App\Models\Technology;
|
|
use App\Models\Testimonial;
|
|
use App\Models\User;
|
|
use App\Models\Webhook;
|
|
use App\Policies\ApplicationPolicy;
|
|
use App\Policies\CallPolicy;
|
|
use App\Policies\CategoryPolicy;
|
|
use App\Policies\ClientPolicy;
|
|
use App\Policies\MediaPolicy;
|
|
use App\Policies\MemberPolicy;
|
|
use App\Policies\MissingUrlPolicy;
|
|
use App\Policies\PagePolicy;
|
|
use App\Policies\ProjectPolicy;
|
|
use App\Policies\RedirectPolicy;
|
|
use App\Policies\ReplyTemplatePolicy;
|
|
use App\Policies\RepositoryPolicy;
|
|
use App\Policies\RolePolicy;
|
|
use App\Policies\ServicePolicy;
|
|
use App\Policies\TalkPolicy;
|
|
use App\Policies\TechnologyPolicy;
|
|
use App\Policies\TestimonialPolicy;
|
|
use App\Policies\UserPolicy;
|
|
use App\Policies\WebhookPolicy;
|
|
use App\Support\Permissions;
|
|
use Illuminate\Support\Facades\Gate;
|
|
use Illuminate\Support\ServiceProvider;
|
|
use Spatie\Permission\Models\Role;
|
|
|
|
class AuthServiceProvider extends ServiceProvider
|
|
{
|
|
public function boot(): void
|
|
{
|
|
Gate::policy(Page::class, PagePolicy::class);
|
|
Gate::policy(Category::class, CategoryPolicy::class);
|
|
Gate::policy(Project::class, ProjectPolicy::class);
|
|
Gate::policy(Member::class, MemberPolicy::class);
|
|
Gate::policy(Technology::class, TechnologyPolicy::class);
|
|
Gate::policy(Call::class, CallPolicy::class);
|
|
Gate::policy(Application::class, ApplicationPolicy::class);
|
|
Gate::policy(Service::class, ServicePolicy::class);
|
|
Gate::policy(Client::class, ClientPolicy::class);
|
|
Gate::policy(Testimonial::class, TestimonialPolicy::class);
|
|
Gate::policy(Talk::class, TalkPolicy::class);
|
|
Gate::policy(Media::class, MediaPolicy::class);
|
|
Gate::policy(Redirect::class, RedirectPolicy::class);
|
|
Gate::policy(MissingUrl::class, MissingUrlPolicy::class);
|
|
Gate::policy(Repository::class, RepositoryPolicy::class);
|
|
Gate::policy(User::class, UserPolicy::class);
|
|
Gate::policy(Role::class, RolePolicy::class);
|
|
Gate::policy(Webhook::class, WebhookPolicy::class);
|
|
Gate::policy(ReplyTemplate::class, ReplyTemplatePolicy::class);
|
|
|
|
// The one place a permission is granted — spatie's own gate check is
|
|
// switched off (config/permission.php) so nothing answers before this.
|
|
//
|
|
// Super admins bypass every check. Granting the role this way rather
|
|
// than by attaching every permission means the role can never fall
|
|
// behind as the catalogue grows. Returning null (not false) when
|
|
// nothing applies lets the normal policy chain run.
|
|
//
|
|
// A machine token narrows all of that: a permission must be one the
|
|
// token was given *and* one its owner holds. A policy is not a
|
|
// permission, so it runs as usual and asks for permissions, which come
|
|
// back here.
|
|
Gate::before(function (User $user, string $ability): ?bool {
|
|
$token = $user->currentAccessToken();
|
|
|
|
if ($token !== null) {
|
|
if (! in_array($ability, Permissions::all(), true)) {
|
|
return null;
|
|
}
|
|
|
|
return $token->allows($ability)
|
|
&& ($user->hasRole('super_admin') || $user->checkPermissionTo($ability));
|
|
}
|
|
|
|
if ($user->hasRole('super_admin')) {
|
|
return true;
|
|
}
|
|
|
|
return $user->checkPermissionTo($ability) ?: null;
|
|
});
|
|
}
|
|
}
|