From 37b7ed8dab789e6dbd72d5de82f9e0acd5e26238 Mon Sep 17 00:00:00 2001
From: Vincent BRIDIER <vincent.bridier@ldc.fr>
Date: Wed, 23 Jun 2021 19:48:22 +0200
Subject: [PATCH] - Fix policies and UI for client

---
 app/Http/Controllers/TicketController.php    | 12 +++++++++++-
 app/Http/Requests/CreateMessage.php          |  2 +-
 app/Http/Requests/StoreTicket.php            |  6 ------
 app/Http/Requests/UpdateTicket.php           |  9 +--------
 app/Policies/TicketPolicy.php                | 10 ++++------
 resources/views/ticket/form-inputs.blade.php | 12 ++++--------
 resources/views/ticket/index.blade.php       |  4 ++--
 7 files changed, 23 insertions(+), 32 deletions(-)

diff --git a/app/Http/Controllers/TicketController.php b/app/Http/Controllers/TicketController.php
index 2b0d161..6d5dfb2 100644
--- a/app/Http/Controllers/TicketController.php
+++ b/app/Http/Controllers/TicketController.php
@@ -141,7 +141,13 @@ class TicketController extends Controller
 
     public function create()
     {
-        $projects = Project::orderBy('name')->get();
+        $user = Auth::user();
+        if ($user->role === 1) {
+            $projects = Project::orderBy('name')->get();
+        } else {
+            $projects = $user->projects;
+        }
+
         if (!count($projects)) {
             return redirect()->route('project.create')
             ->with('warning', 'Vous devez tout d\'abord créer un projet pour y ajouter un ticket');
@@ -162,6 +168,10 @@ class TicketController extends Controller
             $ticket->file2 = Ticket::saveFile($project, $ticket, $ticket->type, $request->file_ticket2);
         }
 
+        if ($request->type === TicketType::evolution()) {
+            $ticket->status = TicketStatus::estimateTodo();
+        }
+
         $ticket->user()->associate(auth()->user());
         $ticket->saveOrFail();
         /** @var \App\Models\User */
diff --git a/app/Http/Requests/CreateMessage.php b/app/Http/Requests/CreateMessage.php
index 5377c3a..cd9f9cd 100644
--- a/app/Http/Requests/CreateMessage.php
+++ b/app/Http/Requests/CreateMessage.php
@@ -18,7 +18,7 @@ class CreateMessage extends FormRequest
             'subscribe' => $this->subscribe ? true : false
         ]);
         return auth()->check() and (auth()->user()->role->equals(Role::admin()) or
-            $this->ticket->project->id === auth()->user()->project_id);
+                auth()->user()->projects->contains(request()->route()->ticket->project_id));
     }
 
     /**
diff --git a/app/Http/Requests/StoreTicket.php b/app/Http/Requests/StoreTicket.php
index 78370a9..4f73e40 100644
--- a/app/Http/Requests/StoreTicket.php
+++ b/app/Http/Requests/StoreTicket.php
@@ -15,12 +15,6 @@ class StoreTicket extends FormRequest
      */
     public function authorize()
     {
-        if (auth()->user()->project_id) {
-            $this->merge([
-                'project_id' => auth()->user()->project_id,
-                'status' => TicketStatus::new()->value,
-            ]);
-        }
         return auth()->check();
     }
 
diff --git a/app/Http/Requests/UpdateTicket.php b/app/Http/Requests/UpdateTicket.php
index a24a5fd..203416a 100644
--- a/app/Http/Requests/UpdateTicket.php
+++ b/app/Http/Requests/UpdateTicket.php
@@ -9,13 +9,6 @@ class UpdateTicket extends StoreTicket
 {
     public function authorize()
     {
-        if (auth()->user()->project_id) {
-            $this->merge([
-                'project_id' => auth()->user()->project_id,
-                'status' => $this->project->status->value,
-            ]);
-        }
-        return auth()->check() and (auth()->user()->role->equals(Role::admin()) or
-            request()->route()->ticket->created_by === auth()->user()->id);
+        return auth()->check() and (auth()->user()->role->equals(Role::admin()));
     }
 }
diff --git a/app/Policies/TicketPolicy.php b/app/Policies/TicketPolicy.php
index fc105a5..c6b3e90 100644
--- a/app/Policies/TicketPolicy.php
+++ b/app/Policies/TicketPolicy.php
@@ -60,7 +60,7 @@ class TicketPolicy
      */
     public function update(User $user, Ticket $ticket)
     {
-        return Auth::user()->role->equals(Role::admin()) or $ticket->created_by == $user->id;
+        return Auth::user()->role->equals(Role::admin()) or $user->projects->contains($ticket->project_id);
     }
 
     /**
@@ -85,7 +85,7 @@ class TicketPolicy
      */
     public function restore(User $user, Ticket $ticket)
     {
-        return Auth::user()->role->equals(Role::admin()) or $ticket->created_by == $user->id;
+        return Auth::user()->role->equals(Role::admin()) or $user->projects->contains($ticket->project_id);
     }
 
     /**
@@ -117,14 +117,12 @@ class TicketPolicy
     {
         //can create if
         //role == 1
-        // OR created_by == user->id
-        // OR project_id == user->projetct_id
+        // OR project_id IN user->projects
 
         if (
             !(
                 $user->role->equals(Role::admin())
-                or $ticket->created_by === $user->id
-                or $ticket->project_id === $user->project_id)
+                or $user->projects->contains($ticket->project_id) )
             )
         {
             return Response::deny(trans('Vous ne pouvez modifier un ticket qui ne vous appartient pas.'));
diff --git a/resources/views/ticket/form-inputs.blade.php b/resources/views/ticket/form-inputs.blade.php
index 390a639..5f8c721 100644
--- a/resources/views/ticket/form-inputs.blade.php
+++ b/resources/views/ticket/form-inputs.blade.php
@@ -1,19 +1,13 @@
 @include('modules.error-messages')
 <div class="form-row">
-    @can('changeStatus', App\Model\Ticket::class)
     <div class="form-group col">
         <label for="project" class="col-form-label">{{ __('Projet') }}</label>
-        <select class="form-select" name="project_id" id="project" @if (!Auth::user()->role->equals(Role::admin())) disabled @endif>
+        <select class="form-select" name="project_id" id="project">
             @foreach($projects as $project)
-                @if (Auth::user()->role->equals(Role::admin()))
-                    <option value="{{ $project->id }}" @if ($project->id == old('project_id') or (isset($ticket) and $ticket->project->id == $project->id))selected @endif>{{ $project->name }}</option>
-                @elseif ($project->id === Auth::user()->project_id)
-                    <option value="{{ $project->id }}" selected>{{ $project->name }}</option>
-                @endif
+                <option value="{{ $project->id }}" @if ($project->id == old('project_id') or (isset($ticket) and $ticket->project->id === $project->id))selected @endif>{{ $project->name }}</option>
             @endforeach
         </select>
     </div>
-    @endcan
     <div class="form-group col">
         <label for="type" class="col-form-label">{{  __('Type') }}</label>
         <select class="form-select" name="type" id="type">
@@ -31,6 +25,8 @@
             @endforeach
         </select>
     </div>
+    @else
+        <input type="hidden" name="status" value="{{ \App\Enums\TicketStatus::new() }}" required>
     @endcan
 </div>
 
diff --git a/resources/views/ticket/index.blade.php b/resources/views/ticket/index.blade.php
index ecbe38a..89c7e19 100644
--- a/resources/views/ticket/index.blade.php
+++ b/resources/views/ticket/index.blade.php
@@ -141,9 +141,9 @@
                 </td>
                 <td>
                     <a href="{{ route('ticket.show', $ticket->id) }}" class="btn btn-sm btn-outline-success">{{ __('Messages') }}</a>
-                    @can('update', $ticket)
+                    @if(auth()->user()->role->equals(Role::admin()))
                         <a href="{{ route('ticket.edit', $ticket) }}" class="btn btn-sm btn-outline-primary">{{ __('Modifier') }}</a>
-                    @endcan
+                    @endif
                     @can('delete', $ticket)
                     @if(!$ticket->status->equals(TicketStatus::archived()))
                     <form method="POST" action="{{ route('ticket.archive', $ticket) }}">