51 lines
1.9 KiB
PHP
51 lines
1.9 KiB
PHP
<?php
|
|
namespace App\Services;
|
|
|
|
use App\Models\User;
|
|
use App\Models\InterestRequest;
|
|
use Illuminate\Support\Facades\DB;
|
|
|
|
/** Reuses approved administration; never changes the global gate or private-record ACL. */
|
|
final class ScopedPortalAdministration
|
|
{
|
|
public function administrative(?User $actor): bool
|
|
{
|
|
if (!$actor || !$actor->hasVerifiedEmail()) return false;
|
|
$access = app(PortalProfileAccess::class);
|
|
if ($access->has($actor, 'auditor')) return false;
|
|
return ($access->superuser($actor) && $access->mfa($actor))
|
|
|| ($access->legacyWriteAllowed($actor) && $access->mfa($actor));
|
|
}
|
|
|
|
public function interestOperator(?User $actor): bool
|
|
{
|
|
if (!$actor || !$actor->hasVerifiedEmail()) return false;
|
|
$access=app(PortalProfileAccess::class);
|
|
return !$access->has($actor,'auditor') && $access->mfa($actor)
|
|
&& ($this->administrative($actor) || DB::table('interest_requests')->where('assigned_to',$actor->id)->whereNull('deleted_at')->exists());
|
|
}
|
|
|
|
public function interest(User $actor, InterestRequest $record): bool
|
|
{
|
|
return $this->interestOperator($actor)
|
|
&& ($actor->can('manage-portal') || (int)$record->assigned_to===$actor->id);
|
|
}
|
|
|
|
public function interestQuery($query, User $actor): void
|
|
{
|
|
if (!$actor->can('manage-portal')) $query->where('assigned_to',$actor->id);
|
|
}
|
|
|
|
public function deskDecision(User $actor, object $request): bool
|
|
{
|
|
return $actor->can('manage-portal')
|
|
|| ($this->administrative($actor) && (int)$request->analyst_id===$actor->id);
|
|
}
|
|
|
|
public function deskCaseDecision(User $actor, string $id): bool
|
|
{
|
|
return $actor->can('manage-portal') || ($this->administrative($actor)
|
|
&& DB::table('desk_requests')->where('case_id',$id)->where('analyst_id',$actor->id)->exists());
|
|
}
|
|
}
|