Snapshot of main at 9f39a6e1e (2026-11-02)

app/Traits/ProfilePermissionTrait.php

@@ -0,0 +1,166 @@
+<?php
+
+namespace App\Traits;
+
+use Illuminate\Support\Facades\Auth;
+use Spatie\Permission\Models\Role;
+
+trait ProfilePermissionTrait
+{
+    /**
+     * Determines if the currently authenticated user has permission to manage profiles.
+     *
+     * @return bool
+     */
+    protected function getCanManageProfiles()
+    {
+        $user = Auth::guard('web')->user();
+        $activeType = session('activeProfileType');
+        $activeId = session('activeProfileId');
+
+        if (!$user || !$activeType || !$activeId) {
+            return false;
+        }
+
+        // Admin profiles: the same gate as the rest of the app (any of the user's roles under
+        // Admin\{id}\ that has the permission). This used to require the legacy role
+        // Admin\{id}\admin, which refused admins with an admin_roles role such as administrator.
+        if ($activeType === 'App\Models\Admin') {
+            return $user->can('manage profiles');
+        }
+
+        $typeMap = [
+            'App\Models\Bank' => ['prefix' => 'Bank', 'suffix' => 'bank-manager'],
+            'App\Models\Organization' => ['prefix' => 'Organization', 'suffix' => 'organization-manager'],
+        ];
+
+        if (!isset($typeMap[$activeType])) {
+            return false;
+        }
+
+        $roleName = "{$typeMap[$activeType]['prefix']}\\{$activeId}\\{$typeMap[$activeType]['suffix']}";
+
+        if (!$user->hasRole($roleName)) {
+            return false;
+        }
+
+        $role = Role::where('name', $roleName)->first();
+        if (!$role) {
+            return false;
+        }
+
+        return $role->permissions->where('name', 'manage profiles')->count() > 0;
+    }
+
+
+
+    /**
+     * Determines if the active profile can view incomplete profiles.
+     *
+     * Only Admin and Bank profiles can view incomplete profiles.
+     * This is a simple profile type check, independent of permission system.
+     *
+     * @return bool
+     */
+    protected function canViewIncompleteProfiles()
+    {
+        if (!function_exists('getActiveProfile')) {
+            return false;
+        }
+
+        $activeProfile = getActiveProfile();
+
+        if (!$activeProfile) {
+            return false;
+        }
+
+        $activeProfileClass = get_class($activeProfile);
+
+        // Only Admin and Bank profiles can view incomplete profiles
+        return in_array($activeProfileClass, [
+            'App\Models\Admin',
+            'App\Models\Bank',
+        ]);
+    }
+
+
+    /**
+     * Determines if the currently authenticated user can create payments as the active profile.
+     *
+     * Users with the coordinator role (organization-coordinator / bank-coordinator) have
+     * full access to the profile EXCEPT payment execution. Only manager roles can pay.
+     *
+     * @return bool
+     */
+    protected function getCanCreatePayments()
+    {
+        $user = Auth::guard('web')->user();
+        $activeType = session('activeProfileType');
+        $activeId = session('activeProfileId');
+
+        // User profiles can always pay (no elevated profile restriction)
+        if ($activeType === 'App\Models\User') {
+            return true;
+        }
+
+        if (!$user || !$activeType || !$activeId) {
+            return false;
+        }
+
+        $managerRoleMap = [
+            'App\Models\Organization' => "Organization\\{$activeId}\\organization-manager",
+            'App\Models\Bank'         => "Bank\\{$activeId}\\bank-manager",
+        ];
+
+        if (!isset($managerRoleMap[$activeType])) {
+            return false;
+        }
+
+        return $user->hasRole($managerRoleMap[$activeType]);
+    }
+
+    /**
+     * Determines if the currently authenticated user has permission to manage accounts.
+     *
+     * @return bool
+     */
+    protected function getCanManageAccounts()
+    {
+        $user = Auth::guard('web')->user();
+        $activeType = session('activeProfileType');
+        $activeId = session('activeProfileId');
+
+        if (!$user || !$activeType || !$activeId) {
+            return false;
+        }
+
+        // Admin profiles: the same gate as the rest of the app (any of the user's roles under
+        // Admin\{id}\ that has the permission). This used to require the legacy role
+        // Admin\{id}\admin, which refused admins with an admin_roles role such as administrator.
+        if ($activeType === 'App\Models\Admin') {
+            return $user->can('manage accounts');
+        }
+
+        $typeMap = [
+            'App\Models\Bank' => ['prefix' => 'Bank', 'suffix' => 'bank-manager'],
+            'App\Models\Organization' => ['prefix' => 'Organization', 'suffix' => 'organization-manager'],
+        ];
+
+        if (!isset($typeMap[$activeType])) {
+            return false;
+        }
+
+        $roleName = "{$typeMap[$activeType]['prefix']}\\{$activeId}\\{$typeMap[$activeType]['suffix']}";
+
+        if (!$user->hasRole($roleName)) {
+            return false;
+        }
+
+        $role = Role::where('name', $roleName)->first();
+        if (!$role) {
+            return false;
+        }
+
+        return $role->permissions->where('name', 'manage accounts')->count() > 0;
+    }
+}