From aa50487bfcbdcbe5061f5b9c3a36119c0a120026 Mon Sep 17 00:00:00 2001
From: Yoga Pangestu <ypangestu976@gmail.com>
Date: Thu, 3 Sep 2026 13:58:04 +0700
Subject: [PATCH] feat: update LetterRequestController and LetterRequestService
 to accept User parameter for improved access control; add letter request
 permissions in RolePermissionSeeder

---
 .../Services/LetterRequestController.php      |  1 +
 .../Admin/Services/LetterRequestService.php   | 31 ++++++++++---------
 database/seeders/RolePermissionSeeder.php     |  4 +++
 3 files changed, 21 insertions(+), 15 deletions(-)

diff --git a/app/Http/Controllers/Admin/Services/LetterRequestController.php b/app/Http/Controllers/Admin/Services/LetterRequestController.php
index d405fe2..ef06550 100644
--- a/app/Http/Controllers/Admin/Services/LetterRequestController.php
+++ b/app/Http/Controllers/Admin/Services/LetterRequestController.php
@@ -23,6 +23,7 @@ public function index(PaginatedRequest $request): Response
     {
         return Inertia::render('admin/services/letter-requests/index', [
             'letterRequests' => $this->service->paginated(
+                $request->user(),
                 ...$request->validatedWithDefaults(),
                 status: $request->validated('status'),
             ),
diff --git a/app/Services/Admin/Services/LetterRequestService.php b/app/Services/Admin/Services/LetterRequestService.php
index 0d1f4e0..4c64d65 100644
--- a/app/Services/Admin/Services/LetterRequestService.php
+++ b/app/Services/Admin/Services/LetterRequestService.php
@@ -3,26 +3,25 @@
 namespace App\Services\Admin\Services;
 
 use App\Enums\LetterStatus;
+use App\Enums\UserRole;
 use App\Models\LetterRequest;
+use App\Models\User;
 use Illuminate\Contracts\Pagination\LengthAwarePaginator;
 use Illuminate\Http\UploadedFile;
 
 class LetterRequestService
 {
-    public function paginated(int $perPage = 25, string $search = '', ?string $status = null): LengthAwarePaginator
+    public function paginated(User $user, int $perPage = 25, string $search = '', ?string $status = null): LengthAwarePaginator
     {
-        $user = auth()->user();
-
         return LetterRequest::query()
-            ->select(['id', 'user_id', 'letter_type', 'purpose', 'status', 'processed_by', 'submitted_at', 'completed_at'])
             ->with(['user.profile', 'user.student.department', 'processor.profile'])
             ->when($search, fn ($q) => $q->where('letter_type', 'like', "%{$search}%")
                 ->orWhereHas('user', fn ($q) => $q->whereHas('profile', fn ($q) => $q->where('full_name', 'like', "%{$search}%"))
                     ->orWhereHas('student', fn ($q) => $q->where('student_number', 'like', "%{$search}%"))))
             ->when($status, fn ($q) => $q->where('status', $status))
-            ->when($user->hasRole('mahasiswa'), fn ($q) => $q->where('user_id', $user->id))
+            ->when($user->hasRole(UserRole::Mahasiswa->value) || $user->hasRole(UserRole::Dosen->value), fn ($q) => $q->where('user_id', $user->id))
             ->latest()
-            ->paginate($perPage);
+            ->paginate($perPage, ['id', 'user_id', 'letter_type', 'purpose', 'status', 'processed_by', 'submitted_at', 'completed_at']);
     }
 
     public function create(array $data): LetterRequest
@@ -38,9 +37,10 @@ public function create(array $data): LetterRequest
 
     public function update(LetterRequest $letterRequest, array $data): LetterRequest
     {
-        $letterRequest->letter_type = $data['letter_type'];
-        $letterRequest->purpose = $data['purpose'] ?? null;
-        $letterRequest->update();
+        $letterRequest->update([
+            'letter_type' => $data['letter_type'],
+            'purpose' => $data['purpose'] ?? null,
+        ]);
 
         return $letterRequest;
     }
@@ -54,12 +54,13 @@ public function updateStatus(LetterRequest $letterRequest, ?string $status, ?Upl
     {
         $status = $result ? LetterStatus::Completed->value : $status;
 
-        $letterRequest->status = $status;
-        $letterRequest->processed_by = $status !== LetterStatus::Submitted->value ? auth()->id() : null;
-        $letterRequest->completed_at = $status === LetterStatus::Completed->value
-            ? ($letterRequest->completed_at ?? now())
-            : null;
-        $letterRequest->update();
+        $letterRequest->update([
+            'status' => $status,
+            'processed_by' => $status !== LetterStatus::Submitted->value ? auth()->id() : null,
+            'completed_at' => $status === LetterStatus::Completed->value
+                ? ($letterRequest->completed_at ?? now())
+                : null,
+        ]);
 
         if ($result) {
             $letterRequest->addMedia($result)->toMediaCollection('letter_result');
diff --git a/database/seeders/RolePermissionSeeder.php b/database/seeders/RolePermissionSeeder.php
index d562c75..1aed7cd 100644
--- a/database/seeders/RolePermissionSeeder.php
+++ b/database/seeders/RolePermissionSeeder.php
@@ -75,6 +75,10 @@ public function run(): void
                 'view-attendances',
                 'create-attendances',
                 'delete-attendances',
+                'view-letter-requests',
+                'create-letter-requests',
+                'update-letter-requests',
+                'delete-letter-requests',
                 ...$feedbackSelfService,
             ],
             'staff-admin' => [