ldc-com-app-bo/app/Policies/Rules/UserStaticRules.php

<?php

namespace App\Policies\Rules;

use App\Enums\UserRolesEnum;
use App\Models\User;
use Illuminate\Database\Eloquent\Model;

/**
 * Userlevel Policiy Static Rules
 *
 * @codeCoverageIgnore
 */
abstract class UserStaticRules
{
    /**
     * Allow everyone.
     *
     * @return boolean
     */
    public static function everyOne(): bool
    {
        return true;
    }

    /**
     * Allow no one.
     *
     * @return boolean
     */
    public static function noOne(): bool
    {
        return false;
    }

    /**
     * At least a minimum role
     *
     * @param \Illuminate\Database\Eloquent\Model $authModel
     * @param \App\Enums\UserRolesEnum            $minRole
     * @return boolean
     */
    public static function atLeastRole(Model $authModel, UserRolesEnum $minRole): bool
    {
        return isset($authModel->role) && $authModel->role->value() <= $minRole->value();
    }

    /**
     * Allow client users associated to the tenant OR admin users.
     *
     * @param \App\Models\User $authUser
     * @return boolean
     */
    public static function restrictTenant(User $authUser): bool
    {
        return UserStaticRules::atLeastRole($authUser, UserRolesEnum::client) &&
            \in_array(\tenant()->getKey(), $authUser->tenants->pluck('id')->toArray()) ||
            UserStaticRules::atLeastRole($authUser, UserRolesEnum::admin);
    }
}