From 44312e76c96155c7c276b497f6bbfff7fa5c0c86 Mon Sep 17 00:00:00 2001 From: Yoga Pangestu Date: Sat, 20 Jun 2026 18:47:22 +0700 Subject: [PATCH] refactor: update permission middleware for cutting routes to enhance access control and streamline permission checks --- routes/web.php | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/routes/web.php b/routes/web.php index 3a799ff..8303483 100644 --- a/routes/web.php +++ b/routes/web.php @@ -256,31 +256,33 @@ }); Route::prefix('cuttings')->name('cuttings.') - ->middleware('permission:'.Permission::CUTTINGS_VIEW->value) ->group(function () { - Route::get('/', [CuttingController::class, 'index'])->name('index'); + Route::get('/', [CuttingController::class, 'index']) + ->middleware('permission:'.Permission::CUTTINGS_VIEW->value) + ->name('index'); Route::get('create', [CuttingController::class, 'create']) - ->middleware('permission:'.Permission::CUTTINGS_CREATE->value) + ->middleware('permission:'.Permission::CUTTINGS_VIEW->value.'|'.Permission::CUTTINGS_CREATE->value) ->name('create'); Route::post('/', [CuttingController::class, 'store']) - ->middleware('permission:'.Permission::CUTTINGS_CREATE->value) + ->middleware('permission:'.Permission::CUTTINGS_VIEW->value.'|'.Permission::CUTTINGS_CREATE->value) ->name('store'); Route::get('{cutting}/edit', [CuttingController::class, 'edit']) - ->middleware('permission:'.Permission::CUTTINGS_UPDATE->value) + ->middleware('permission:'.Permission::CUTTINGS_VIEW->value.'|'.Permission::CUTTINGS_UPDATE->value) ->name('edit'); Route::put('{cutting}', [CuttingController::class, 'update']) - ->middleware('permission:'.Permission::CUTTINGS_UPDATE->value) + ->middleware('permission:'.Permission::CUTTINGS_VIEW->value.'|'.Permission::CUTTINGS_UPDATE->value) ->name('update'); Route::post('{cutting}/status', [CuttingController::class, 'transitionStatus']) + ->middleware('permission:'.Permission::CUTTINGS_COMPLETE->value.'|'.Permission::CUTTINGS_VERIFY->value.'|'.Permission::CUTTINGS_REJECT->value) ->name('transition-status'); Route::delete('{cutting}', [CuttingController::class, 'destroy']) - ->middleware('permission:'.Permission::CUTTINGS_DELETE->value) + ->middleware('permission:'.Permission::CUTTINGS_VIEW->value.'|'.Permission::CUTTINGS_DELETE->value) ->name('destroy'); }); });