From 86ea75ec91e16a2353efa66ace6818a257db3428 Mon Sep 17 00:00:00 2001 From: Yoga Pangestu Date: Mon, 31 Aug 2026 14:41:25 +0700 Subject: [PATCH] feat: implement authorization checks for various requests in academic and user management --- .../Admin/AcademicClasses/AssignmentRequest.php | 2 +- .../Admin/AcademicClasses/AttendanceStoreRequest.php | 2 +- .../Requests/Admin/AcademicClasses/MaterialRequest.php | 2 +- .../Requests/Admin/AcademicClasses/ScheduleRequest.php | 2 +- .../Admin/AcademicClasses/SubmissionRequest.php | 2 +- .../Admin/Developer/UpdateRolePermissionsRequest.php | 2 +- .../Requests/Admin/Finances/TuitionInvoiceRequest.php | 2 +- .../Requests/Admin/Finances/TuitionPaymentRequest.php | 2 +- app/Http/Requests/Admin/Manage/AnnouncementRequest.php | 2 +- .../Requests/Admin/Manage/ClassEnrollmentRequest.php | 2 +- app/Http/Requests/Admin/Manage/CourseClassRequest.php | 2 +- .../Admin/Manage/CourseRegistrationRequest.php | 2 +- .../Admin/Manage/RejectCourseRegistrationRequest.php | 2 +- app/Http/Requests/Admin/Master/AcademicTermRequest.php | 2 +- app/Http/Requests/Admin/Master/CourseRequest.php | 2 +- app/Http/Requests/Admin/Master/DepartmentRequest.php | 2 +- .../Admin/Services/AcademicAdvisingLogRequest.php | 2 +- .../Requests/Admin/Services/LetterRequestRequest.php | 2 +- app/Http/Requests/Admin/UpdateStatusRequest.php | 10 +++++++++- app/Http/Requests/Admin/Users/AdministratorRequest.php | 2 +- app/Http/Requests/Admin/Users/LecturerRequest.php | 2 +- .../Requests/Admin/Users/Student/StudentRequest.php | 2 +- .../Admin/Users/Student/StudentStatusRequest.php | 2 +- 23 files changed, 31 insertions(+), 23 deletions(-) diff --git a/app/Http/Requests/Admin/AcademicClasses/AssignmentRequest.php b/app/Http/Requests/Admin/AcademicClasses/AssignmentRequest.php index 10cc89d..1bf1eb1 100644 --- a/app/Http/Requests/Admin/AcademicClasses/AssignmentRequest.php +++ b/app/Http/Requests/Admin/AcademicClasses/AssignmentRequest.php @@ -9,7 +9,7 @@ class AssignmentRequest extends FormRequest { public function authorize(): bool { - return true; + return $this->user()->can($this->isMethod('post') ? 'create-assignments' : 'update-assignments'); } public function rules(): array diff --git a/app/Http/Requests/Admin/AcademicClasses/AttendanceStoreRequest.php b/app/Http/Requests/Admin/AcademicClasses/AttendanceStoreRequest.php index e1ed780..37e6918 100644 --- a/app/Http/Requests/Admin/AcademicClasses/AttendanceStoreRequest.php +++ b/app/Http/Requests/Admin/AcademicClasses/AttendanceStoreRequest.php @@ -10,7 +10,7 @@ class AttendanceStoreRequest extends FormRequest { public function authorize(): bool { - return true; + return $this->user()->can('create-attendances'); } public function rules(): array diff --git a/app/Http/Requests/Admin/AcademicClasses/MaterialRequest.php b/app/Http/Requests/Admin/AcademicClasses/MaterialRequest.php index d19ca3e..e01888d 100644 --- a/app/Http/Requests/Admin/AcademicClasses/MaterialRequest.php +++ b/app/Http/Requests/Admin/AcademicClasses/MaterialRequest.php @@ -9,7 +9,7 @@ class MaterialRequest extends FormRequest { public function authorize(): bool { - return true; + return $this->user()->can($this->isMethod('post') ? 'create-materials' : 'update-materials'); } public function rules(): array diff --git a/app/Http/Requests/Admin/AcademicClasses/ScheduleRequest.php b/app/Http/Requests/Admin/AcademicClasses/ScheduleRequest.php index da0ece8..f6776a7 100644 --- a/app/Http/Requests/Admin/AcademicClasses/ScheduleRequest.php +++ b/app/Http/Requests/Admin/AcademicClasses/ScheduleRequest.php @@ -9,7 +9,7 @@ class ScheduleRequest extends FormRequest { public function authorize(): bool { - return true; + return $this->user()->can($this->isMethod('post') ? 'create-schedules' : 'update-schedules'); } public function rules(): array diff --git a/app/Http/Requests/Admin/AcademicClasses/SubmissionRequest.php b/app/Http/Requests/Admin/AcademicClasses/SubmissionRequest.php index 59cfe4e..b625385 100644 --- a/app/Http/Requests/Admin/AcademicClasses/SubmissionRequest.php +++ b/app/Http/Requests/Admin/AcademicClasses/SubmissionRequest.php @@ -10,7 +10,7 @@ class SubmissionRequest extends FormRequest { public function authorize(): bool { - return true; + return $this->user()->can($this->isMethod('post') ? 'create-assignment-submissions' : 'update-assignment-submissions'); } public function rules(): array diff --git a/app/Http/Requests/Admin/Developer/UpdateRolePermissionsRequest.php b/app/Http/Requests/Admin/Developer/UpdateRolePermissionsRequest.php index 9f374d5..4e84869 100644 --- a/app/Http/Requests/Admin/Developer/UpdateRolePermissionsRequest.php +++ b/app/Http/Requests/Admin/Developer/UpdateRolePermissionsRequest.php @@ -10,7 +10,7 @@ class UpdateRolePermissionsRequest extends FormRequest { public function authorize(): bool { - return true; + return $this->user()->can('update-roles'); } public function rules(): array diff --git a/app/Http/Requests/Admin/Finances/TuitionInvoiceRequest.php b/app/Http/Requests/Admin/Finances/TuitionInvoiceRequest.php index e296039..37fddbd 100644 --- a/app/Http/Requests/Admin/Finances/TuitionInvoiceRequest.php +++ b/app/Http/Requests/Admin/Finances/TuitionInvoiceRequest.php @@ -9,7 +9,7 @@ class TuitionInvoiceRequest extends FormRequest { public function authorize(): bool { - return true; + return $this->user()->can($this->isMethod('post') ? 'create-tuition-invoices' : 'update-tuition-invoices'); } public function rules(): array diff --git a/app/Http/Requests/Admin/Finances/TuitionPaymentRequest.php b/app/Http/Requests/Admin/Finances/TuitionPaymentRequest.php index 265b87d..408ce7a 100644 --- a/app/Http/Requests/Admin/Finances/TuitionPaymentRequest.php +++ b/app/Http/Requests/Admin/Finances/TuitionPaymentRequest.php @@ -10,7 +10,7 @@ class TuitionPaymentRequest extends FormRequest { public function authorize(): bool { - return true; + return $this->user()->can($this->isMethod('post') ? 'create-tuition-payments' : 'update-tuition-payments'); } public function rules(): array diff --git a/app/Http/Requests/Admin/Manage/AnnouncementRequest.php b/app/Http/Requests/Admin/Manage/AnnouncementRequest.php index cc12a46..7e7f89e 100644 --- a/app/Http/Requests/Admin/Manage/AnnouncementRequest.php +++ b/app/Http/Requests/Admin/Manage/AnnouncementRequest.php @@ -9,7 +9,7 @@ class AnnouncementRequest extends FormRequest { public function authorize(): bool { - return true; + return $this->user()->can($this->isMethod('post') ? 'create-announcements' : 'update-announcements'); } public function rules(): array diff --git a/app/Http/Requests/Admin/Manage/ClassEnrollmentRequest.php b/app/Http/Requests/Admin/Manage/ClassEnrollmentRequest.php index a224331..42a7cc7 100644 --- a/app/Http/Requests/Admin/Manage/ClassEnrollmentRequest.php +++ b/app/Http/Requests/Admin/Manage/ClassEnrollmentRequest.php @@ -9,7 +9,7 @@ class ClassEnrollmentRequest extends FormRequest { public function authorize(): bool { - return true; + return $this->user()->can('create-course-class-enrollments'); } public function rules(): array diff --git a/app/Http/Requests/Admin/Manage/CourseClassRequest.php b/app/Http/Requests/Admin/Manage/CourseClassRequest.php index 71000d5..3c1c0e1 100644 --- a/app/Http/Requests/Admin/Manage/CourseClassRequest.php +++ b/app/Http/Requests/Admin/Manage/CourseClassRequest.php @@ -11,7 +11,7 @@ class CourseClassRequest extends FormRequest { public function authorize(): bool { - return true; + return $this->user()->can($this->isMethod('post') ? 'create-course-classes' : 'update-course-classes'); } public function rules(): array diff --git a/app/Http/Requests/Admin/Manage/CourseRegistrationRequest.php b/app/Http/Requests/Admin/Manage/CourseRegistrationRequest.php index 8e17d5f..58cc960 100644 --- a/app/Http/Requests/Admin/Manage/CourseRegistrationRequest.php +++ b/app/Http/Requests/Admin/Manage/CourseRegistrationRequest.php @@ -12,7 +12,7 @@ class CourseRegistrationRequest extends FormRequest public function authorize(): bool { if (! $this->routeIs('student.*')) { - return true; + return $this->user()->can('create-course-registrations'); } $student = $this->user()->student; diff --git a/app/Http/Requests/Admin/Manage/RejectCourseRegistrationRequest.php b/app/Http/Requests/Admin/Manage/RejectCourseRegistrationRequest.php index 846f4a6..03a8ed3 100644 --- a/app/Http/Requests/Admin/Manage/RejectCourseRegistrationRequest.php +++ b/app/Http/Requests/Admin/Manage/RejectCourseRegistrationRequest.php @@ -8,7 +8,7 @@ class RejectCourseRegistrationRequest extends FormRequest { public function authorize(): bool { - return true; + return $this->user()->can('reject-course-registrations'); } public function rules(): array diff --git a/app/Http/Requests/Admin/Master/AcademicTermRequest.php b/app/Http/Requests/Admin/Master/AcademicTermRequest.php index e6899d7..22bebc4 100644 --- a/app/Http/Requests/Admin/Master/AcademicTermRequest.php +++ b/app/Http/Requests/Admin/Master/AcademicTermRequest.php @@ -10,7 +10,7 @@ class AcademicTermRequest extends FormRequest { public function authorize(): bool { - return true; + return $this->user()->can($this->isMethod('post') ? 'create-academic-terms' : 'update-academic-terms'); } public function rules(): array diff --git a/app/Http/Requests/Admin/Master/CourseRequest.php b/app/Http/Requests/Admin/Master/CourseRequest.php index c90c6fa..d5c2f46 100644 --- a/app/Http/Requests/Admin/Master/CourseRequest.php +++ b/app/Http/Requests/Admin/Master/CourseRequest.php @@ -9,7 +9,7 @@ class CourseRequest extends FormRequest { public function authorize(): bool { - return true; + return $this->user()->can($this->isMethod('post') ? 'create-courses' : 'update-courses'); } public function rules(): array diff --git a/app/Http/Requests/Admin/Master/DepartmentRequest.php b/app/Http/Requests/Admin/Master/DepartmentRequest.php index 5df1d55..0f84faf 100644 --- a/app/Http/Requests/Admin/Master/DepartmentRequest.php +++ b/app/Http/Requests/Admin/Master/DepartmentRequest.php @@ -9,7 +9,7 @@ class DepartmentRequest extends FormRequest { public function authorize(): bool { - return true; + return $this->user()->can($this->isMethod('post') ? 'create-departments' : 'update-departments'); } public function rules(): array diff --git a/app/Http/Requests/Admin/Services/AcademicAdvisingLogRequest.php b/app/Http/Requests/Admin/Services/AcademicAdvisingLogRequest.php index 6ba6e7a..88bd081 100644 --- a/app/Http/Requests/Admin/Services/AcademicAdvisingLogRequest.php +++ b/app/Http/Requests/Admin/Services/AcademicAdvisingLogRequest.php @@ -13,7 +13,7 @@ public function authorize(): bool return (bool) $this->user()->lecturer; } - return true; + return $this->user()->can($this->isMethod('post') ? 'create-academic-advising-logs' : 'update-academic-advising-logs'); } public function rules(): array diff --git a/app/Http/Requests/Admin/Services/LetterRequestRequest.php b/app/Http/Requests/Admin/Services/LetterRequestRequest.php index 43bb35d..85c6fc1 100644 --- a/app/Http/Requests/Admin/Services/LetterRequestRequest.php +++ b/app/Http/Requests/Admin/Services/LetterRequestRequest.php @@ -14,7 +14,7 @@ public function authorize(): bool return (bool) $this->user()->student; } - return true; + return $this->user()->can($this->isMethod('post') ? 'create-letter-requests' : 'update-letter-requests'); } public function rules(): array diff --git a/app/Http/Requests/Admin/UpdateStatusRequest.php b/app/Http/Requests/Admin/UpdateStatusRequest.php index ebdb74f..c5ea771 100644 --- a/app/Http/Requests/Admin/UpdateStatusRequest.php +++ b/app/Http/Requests/Admin/UpdateStatusRequest.php @@ -8,7 +8,15 @@ class UpdateStatusRequest extends FormRequest { public function authorize(): bool { - return true; + $permission = match ($this->route()?->getName()) { + 'admin.master.academic-terms.update_status' => 'update-academic-terms-status', + 'admin.users.lecturers.update_user_status' => 'update-lecturers-status', + 'admin.users.students.update_user_status' => 'update-students-account-status', + 'admin.users.administrators.update_user_status' => 'update-administrators-status', + default => null, + }; + + return $permission !== null && $this->user()->can($permission); } public function rules(): array diff --git a/app/Http/Requests/Admin/Users/AdministratorRequest.php b/app/Http/Requests/Admin/Users/AdministratorRequest.php index 335567c..9efbbdb 100644 --- a/app/Http/Requests/Admin/Users/AdministratorRequest.php +++ b/app/Http/Requests/Admin/Users/AdministratorRequest.php @@ -10,7 +10,7 @@ class AdministratorRequest extends FormRequest { public function authorize(): bool { - return true; + return $this->user()->can($this->isMethod('post') ? 'create-administrators' : 'update-administrators'); } public function rules(): array diff --git a/app/Http/Requests/Admin/Users/LecturerRequest.php b/app/Http/Requests/Admin/Users/LecturerRequest.php index b6b40af..44a67cf 100644 --- a/app/Http/Requests/Admin/Users/LecturerRequest.php +++ b/app/Http/Requests/Admin/Users/LecturerRequest.php @@ -10,7 +10,7 @@ class LecturerRequest extends FormRequest { public function authorize(): bool { - return true; + return $this->user()->can($this->isMethod('post') ? 'create-lecturers' : 'update-lecturers'); } public function rules(): array diff --git a/app/Http/Requests/Admin/Users/Student/StudentRequest.php b/app/Http/Requests/Admin/Users/Student/StudentRequest.php index b0603b0..2f645ec 100644 --- a/app/Http/Requests/Admin/Users/Student/StudentRequest.php +++ b/app/Http/Requests/Admin/Users/Student/StudentRequest.php @@ -11,7 +11,7 @@ class StudentRequest extends FormRequest { public function authorize(): bool { - return true; + return $this->user()->can($this->isMethod('post') ? 'create-students' : 'update-students'); } public function rules(): array diff --git a/app/Http/Requests/Admin/Users/Student/StudentStatusRequest.php b/app/Http/Requests/Admin/Users/Student/StudentStatusRequest.php index adee279..c9a2066 100644 --- a/app/Http/Requests/Admin/Users/Student/StudentStatusRequest.php +++ b/app/Http/Requests/Admin/Users/Student/StudentStatusRequest.php @@ -10,7 +10,7 @@ class StudentStatusRequest extends FormRequest { public function authorize(): bool { - return true; + return $this->user()->can('update-students-academic-status'); } public function rules(): array