commit5

app/Http/Controllers/RequisitionController.php

@@ -14,6 +14,7 @@ use App\Models\TechnicalReview;
 use App\Models\Tenant;
 use App\Services\ConflictGuard;
 use App\Services\EquipmentWorkflow;
+use App\Services\OrganizationAccess;
 use App\Services\RequisitionWorkflow;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
@@ -51,6 +52,8 @@ class RequisitionController extends Controller
 
     public function create(Request $request): Response
     {
+        abort_unless(app(OrganizationAccess::class)->canRequest($request->user()), 403);
+
         return Inertia::render('requisitions/form', [
             'costCenters' => CostCenter::query()->where('department_id', $request->user()->department_id)->orderBy('code')->get(),
             'requisition' => null,
@@ -72,7 +75,7 @@ class RequisitionController extends Controller
 
         return Inertia::render('requisitions/show', [
             'requisition' => $requisition,
-            'canEdit' => $requisition->requester_id === $request->user()->id && $requisition->status === 'draft',
+            'canEdit' => app(OrganizationAccess::class)->canRequest($request->user()) && $requisition->requester_id === $request->user()->id && $requisition->status === 'draft',
             'canDecide' => $requisition->canDecide($request->user()),
             'conflictBlocked' => app(ConflictGuard::class)->participationBlocked($request->user(), $requisition),
             'audit' => AuditLog::query()->where('requisition_id', $requisition->id)->orderBy('id')->get(['id', 'action', 'user_id', 'created_at']),
@@ -86,6 +89,7 @@ class RequisitionController extends Controller
 
     public function edit(Request $request, Requisition $requisition): Response
     {
+        abort_unless(app(OrganizationAccess::class)->canRequest($request->user()), 403);
         abort_unless($requisition->requester_id === $request->user()->id && $requisition->status === 'draft', 403);
 
         return Inertia::render('requisitions/form', [