From 5fbd2f8ea851c7ac54f8dd94689a1cef7d766533 Mon Sep 17 00:00:00 2001
From: Olivier Legat <olivier.legat@ldc.fr>
Date: Mon, 7 Jun 2021 12:37:52 +0200
Subject: [PATCH] =?UTF-8?q?ticket=20215=20:=20possibilit=C3=A9=20de=20r?=
 =?UTF-8?q?=C3=A9pondre=20quand=20on=20est=20dans=20le=20projet?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitignore                            |  2 ++
 app/Policies/TicketPolicy.php         | 12 +++++++++++-
 resources/views/ticket/show.blade.php |  4 ++--
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index 16d7679..3d663a0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,6 +6,8 @@
 /vendor
 .env
 .env.backup
+.env.dev
+.env.prod
 .phpunit.result.cache
 Homestead.json
 Homestead.yaml
diff --git a/app/Policies/TicketPolicy.php b/app/Policies/TicketPolicy.php
index de00932..1f023b7 100644
--- a/app/Policies/TicketPolicy.php
+++ b/app/Policies/TicketPolicy.php
@@ -114,7 +114,17 @@ class TicketPolicy
     // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.FoundBeforeLastUsed
     public function createMessage(User $user, Ticket $ticket)
     {
-        if ($user->role !== 1 and $ticket->created_by !== $user->id) {
+        //can create if
+        //role == 1
+        // OR created_by == user->id
+        // OR project_id == user->projetct_id
+
+        if (
+            !($user->role === 1
+                or $ticket->created_by === $user->id
+                or $ticket->project_id === $user->project_id)
+            )
+        {
             return Response::deny(trans('Vous ne pouvez modifier un ticket qui ne vous appartient pas.'));
         }
         return $ticket->status->equals(TicketStatus::archived()) ?
diff --git a/resources/views/ticket/show.blade.php b/resources/views/ticket/show.blade.php
index a54a661..aa1a679 100644
--- a/resources/views/ticket/show.blade.php
+++ b/resources/views/ticket/show.blade.php
@@ -6,9 +6,9 @@
         <h2 class="@can('suscribeToTicket', $ticket)col-md-8 @else col-md-10 @endcan">
             <a href="{{ route('home') }}" class="text-decoration-none">←</a>
             Ticket n°{{ $ticket->id }} : {{ $ticket->project->name }} - {{ $ticket->type->label }}
-            @cannot('createMessage', $ticket)
+            {{--@cannot('createMessage', $ticket)--}}
             <span class="badge badge-secondary">{{ $ticket->status->label }}</span>
-            @endcan
+            {{--@endcan--}}
         </h2>
         @can('suscribeToTicket', $ticket)
         <form action="{{ route('ticket.subscribe', $ticket->id) }}" method="POST" id="form_abonnement" class="col">