feat: enhance Material management; implement authorization checks for material actions and refactor user role handling

app/Http/Controllers/Admin/AcademicClasses/MaterialController.php

@@ -7,7 +7,7 @@
 use App\Http\Requests\PaginatedRequest;
 use App\Models\Material;
 use App\Services\Admin\AcademicClasses\MaterialService;
-use App\Services\Admin\Manage\CourseClassService;
+use App\Services\Admin\Manage\CourseClass\CourseClassService;
 use Illuminate\Http\RedirectResponse;
 use Inertia\Inertia;
 use Inertia\Response;
@@ -52,6 +52,8 @@ public function update(MaterialRequest $request, Material $material): RedirectRe
 
     public function destroy(Material $material): RedirectResponse
     {
+        abort_unless(request()->user()->canManageMaterial($material), 403);
+
         $this->service->delete($material);
 
         return Inertia::flash('toast', ['type' => 'success', 'message' => 'Materi berhasil dihapus.'])->back();

app/Http/Requests/Admin/AcademicClasses/MaterialRequest.php

@@ -2,6 +2,7 @@
 
 namespace App\Http\Requests\Admin\AcademicClasses;
 
+use App\Enums\UserRole;
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Validation\Rule;
 
@@ -9,7 +10,12 @@ class MaterialRequest extends FormRequest
 {
     public function authorize(): bool
     {
-        return $this->user()->can($this->isMethod('post') ? 'create-materials' : 'update-materials');
+        if ($this->isMethod('post')) {
+            return $this->user()->can('create-materials');
+        }
+
+        return $this->user()->can('update-materials')
+            && $this->user()->canManageMaterial($this->route('material'));
     }
 
     public function rules(): array
@@ -18,7 +24,7 @@ public function rules(): array
 
         $courseClassRule = Rule::exists('course_classes', 'id');
 
-        if ($user->hasRole('dosen')) {
+        if ($user->hasRole(UserRole::Dosen->value)) {
             $courseClassRule->where('lecturer_id', $user->lecturer?->id);
         }
 

app/Models/User.php

@@ -109,6 +109,18 @@ public function uploads(): HasMany
         return $this->hasMany(EditorUpload::class, 'uploaded_by');
     }
 
+    /**
+     * A dosen may only manage (update/delete) materials of classes they lecture.
+     */
+    public function canManageMaterial(Material $material): bool
+    {
+        if ($this->hasRole(UserRole::Dosen->value)) {
+            return $material->courseClass->lecturer_id === $this->lecturer?->id;
+        }
+
+        return true;
+    }
+
     public function isAdvisorOf(Student $student): bool
     {
         return $this->hasRole(UserRole::Dosen->value) && $this->lecturer && $student->academic_advisor_id === $this->lecturer->id;

app/Services/Admin/AcademicClasses/MaterialService.php

@@ -3,6 +3,7 @@
 namespace App\Services\Admin\AcademicClasses;
 
 use App\Enums\RegistrationStatus;
+use App\Enums\UserRole;
 use App\Models\Material;
 use App\Models\User;
 use Illuminate\Contracts\Pagination\LengthAwarePaginator;
@@ -17,8 +18,8 @@ public function paginated(User $user, int $perPage = 25, string $search = '', ?i
             ->with('courseClass.course:id,code,name')
             ->when($search, fn ($q) => $q->where('title', 'like', "%{$search}%"))
             ->when($courseClassId, fn ($q) => $q->where('course_class_id', $courseClassId))
-            ->when($user->hasRole('dosen'), fn ($q) => $q->whereHas('courseClass', fn ($q) => $q->where('lecturer_id', $user->lecturer?->id)))
-            ->when($user->hasRole('mahasiswa'), fn ($q) => $q->whereHas('courseClass', function ($q) use ($user) {
+            ->when($user->hasRole(UserRole::Dosen->value), fn ($q) => $q->whereHas('courseClass', fn ($q) => $q->where('lecturer_id', $user->lecturer?->id)))
+            ->when($user->hasRole(UserRole::Mahasiswa->value), fn ($q) => $q->whereHas('courseClass', function ($q) use ($user) {
                 $q->whereHas('registrations', function ($q) use ($user) {
                     $q->where('student_id', $user->student?->id)
                         ->whereHas('submission', fn ($q) => $q->where('status', RegistrationStatus::Approved));
@@ -46,11 +47,12 @@ public function create(array $data, ?UploadedFile $file): Material
 
     public function update(Material $material, array $data, ?UploadedFile $file): Material
     {
-        $material->course_class_id = $data['course_class_id'];
-        $material->title = $data['title'];
-        $material->description = $data['description'] ?? null;
-        $material->meeting_number = $data['meeting_number'] ?? null;
-        $material->update();
+        $material->update([
+            'course_class_id' => $data['course_class_id'],
+            'title' => $data['title'],
+            'description' => $data['description'] ?? null,
+            'meeting_number' => $data['meeting_number'] ?? null,
+        ]);
 
         if ($file) {
             $material->addMedia($file)->toMediaCollection('materials');

resources/js/types/material.ts

@@ -10,6 +10,4 @@ export type Material = {
     meeting_number: number | null;
     file_url: string | null;
     file_name: string | null;
-    created_at: string;
-    updated_at: string;
 };