91 lines
2.0 KiB
PHP
91 lines
2.0 KiB
PHP
<?php
|
|
namespace App\Policies;
|
|
|
|
use App\Models\Artwork;
|
|
use App\Models\User;
|
|
|
|
class ArtworkPolicy
|
|
{
|
|
/**
|
|
* Global before hook: admins can do everything.
|
|
* Accepts null $user to allow public checks to continue.
|
|
*/
|
|
public function before($user, $ability)
|
|
{
|
|
if (! $user) {
|
|
return null;
|
|
}
|
|
|
|
if ($this->isAdmin($user)) {
|
|
return true;
|
|
}
|
|
|
|
return null;
|
|
}
|
|
|
|
protected function isAdmin(User $user): bool
|
|
{
|
|
if (isset($user->is_admin)) {
|
|
return (bool) $user->is_admin;
|
|
}
|
|
|
|
if (method_exists($user, 'isAdmin')) {
|
|
return (bool) $user->isAdmin();
|
|
}
|
|
|
|
if (method_exists($user, 'hasRole')) {
|
|
return (bool) $user->hasRole('admin');
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Public view: only approved + public + not-deleted artworks.
|
|
*/
|
|
public function view(?User $user, Artwork $artwork): bool
|
|
{
|
|
return $artwork->is_public && $artwork->is_approved && ! $artwork->trashed();
|
|
}
|
|
|
|
/**
|
|
* Any authenticated user can create artworks.
|
|
*/
|
|
public function create(?User $user): bool
|
|
{
|
|
return (bool) $user;
|
|
}
|
|
|
|
/**
|
|
* Owner can update their own artwork.
|
|
*/
|
|
public function update(User $user, Artwork $artwork): bool
|
|
{
|
|
return $user->id === $artwork->user_id;
|
|
}
|
|
|
|
/**
|
|
* Owner can delete their own artwork (soft delete).
|
|
*/
|
|
public function delete(User $user, Artwork $artwork): bool
|
|
{
|
|
return $user->id === $artwork->user_id;
|
|
}
|
|
|
|
/**
|
|
* Restore: owner or admin can restore soft-deleted artwork.
|
|
*/
|
|
public function restore(User $user, Artwork $artwork): bool
|
|
{
|
|
return $user->id === $artwork->user_id || $this->isAdmin($user);
|
|
}
|
|
|
|
/**
|
|
* Force delete reserved for admins only.
|
|
*/
|
|
public function forceDelete(User $user, Artwork $artwork): bool
|
|
{
|
|
return $this->isAdmin($user);
|
|
}
|
|
}
|