diff --git a/app/Http/Controllers/V1/SuggestionController.php b/app/Http/Controllers/V1/SuggestionController.php index 4cbbf58..c7e76ec 100644 --- a/app/Http/Controllers/V1/SuggestionController.php +++ b/app/Http/Controllers/V1/SuggestionController.php @@ -8,16 +8,21 @@ use App\Http\Requests\SuggestionRequest; use App\Models\Suggestion; use App\Models\Trip; +use Illuminate\Auth\Access\AuthorizationException; use Illuminate\Http\RedirectResponse; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Gate; class SuggestionController extends Controller { /** * Store a newly created resource in storage. + * + * @throws AuthorizationException */ public function store(Trip $trip, SuggestionRequest $suggestionRequest): RedirectResponse { + Gate::authorize('view', $trip); $suggestion = [ 'description' => $suggestionRequest['description'], 'user_id' => auth()->id(), @@ -28,8 +33,14 @@ public function store(Trip $trip, SuggestionRequest $suggestionRequest): Redirec return redirect()->route('trips.show', ['trip' => $trip]); } + /** + * This can and should be moved to its own controller + * + * @throws AuthorizationException + */ public function vote(Suggestion $suggestion, Request $request): RedirectResponse { + Gate::authorize('view', $suggestion->trip); $validated = $request->validate([ 'type' => 'required|in:up,down', ]); @@ -41,4 +52,19 @@ public function vote(Suggestion $suggestion, Request $request): RedirectResponse return redirect()->back(); } + + /** + * @throws AuthorizationException + */ + public function status(Suggestion $suggestion, Request $request): RedirectResponse + { + Gate::authorize('update', $suggestion->trip); + $validated = $request->validate([ + 'type' => 'required|in:approved,rejected', + ]); + + $suggestion->update(['status' => $validated['type']]); + + return redirect()->back(); + } } diff --git a/app/Http/Controllers/V1/TripController.php b/app/Http/Controllers/V1/TripController.php index e10b3ab..a9e0254 100644 --- a/app/Http/Controllers/V1/TripController.php +++ b/app/Http/Controllers/V1/TripController.php @@ -8,6 +8,7 @@ use App\Http\Requests\TripRequest; use App\Models\Trip; use App\Models\User; +use Illuminate\Auth\Access\AuthorizationException; use Illuminate\Http\RedirectResponse; use Illuminate\Support\Facades\Cache; use Illuminate\Support\Facades\Gate; @@ -58,9 +59,12 @@ public function store(TripRequest $tripRequest): RedirectResponse /** * Display the specified resource. + * + * @throws AuthorizationException */ public function show(Trip $trip): View { + Gate::authorize('view', $trip); $data = $trip->load([ 'suggestions' => function ($query) { $query->withCount([ @@ -72,6 +76,7 @@ public function show(Trip $trip): View }, ]); }, + 'users:name', ]); return view('trips.show', compact('data')); @@ -79,6 +84,8 @@ public function show(Trip $trip): View /** * Show the form for editing the specified resource. + * + * @throws AuthorizationException */ public function edit(Trip $trip): View { @@ -94,6 +101,8 @@ public function edit(Trip $trip): View /** * Update the specified resource in storage. + * + * @throws AuthorizationException */ public function update(TripRequest $tripRequest, Trip $trip): RedirectResponse { diff --git a/app/Policies/TripPolicy.php b/app/Policies/TripPolicy.php index b59a11f..c4e429e 100644 --- a/app/Policies/TripPolicy.php +++ b/app/Policies/TripPolicy.php @@ -22,6 +22,17 @@ public function viewAny(User $user): bool */ public function view(User $user, Trip $trip): bool { + // if i own the trip, im allowed + if ($user->id === $trip->owner_id) { + return true; + } + + // if im part of the trip, i should also be allowed + if ($trip->users->contains(auth()->id())) { + return true; + } + + // else i have no business here return false; } diff --git a/resources/views/trips/show.blade.php b/resources/views/trips/show.blade.php index cbee6da..73e631f 100644 --- a/resources/views/trips/show.blade.php +++ b/resources/views/trips/show.blade.php @@ -72,18 +72,33 @@ class="inline-flex items-center px-4 py-2 bg-gray-800 border border-transparent
@foreach($data->suggestions as $suggestion) -
+
is_null($suggestion->status), + 'p-2 flex gap-2 border-green-500 border rounded bg-green-100 hover:bg-green-300 font-bold shadow-lg shadow-green-500/50 text-green-950' => $suggestion->status == 'approved', + 'p-2 flex gap-2 border-red-500 border rounded bg-red-50 font-italic line-through opacity-50 shadow-lg shadow-red-500/50 text-red-950' => $suggestion->status == 'rejected' + ]) + >
- + status)) + href="{{ route('suggestions.vote', $suggestion) }}?type=up" + @endif + > - - + + - {{ $suggestion->up_votes_count }} - + {{ $suggestion->up_votes_count }} + status)) + href="{{ route('suggestions.vote', $suggestion) }}?type=down" + @endif + > - + {{ $suggestion->down_votes_count }} @@ -92,12 +107,20 @@ class="inline-flex items-center px-4 py-2 bg-gray-800 border border-transparent {{ $suggestion->description }}

@can('update', $data) -
+
- Approve + + + + + - Reject + + + + +
@endcan diff --git a/routes/web.php b/routes/web.php index 40ab428..e977098 100644 --- a/routes/web.php +++ b/routes/web.php @@ -20,6 +20,7 @@ Route::resource('trips', TripController::class)->except(['destroy']); Route::resource('trips.suggestions', SuggestionController::class)->only(['store']); Route::get('/suggestions/{suggestion}/vote', [SuggestionController::class, 'vote'])->name('suggestions.vote'); + Route::get('/suggestions/{suggestion}/status', [SuggestionController::class, 'status'])->name('suggestions.status'); }); require __DIR__.'/auth.php';