bert.hausmans/crewli
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: round 2 — multi-tenancy isolation (OrganisationScope, scoped validation, boundary checks)

Browse Source 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
bert.hausmans
2026-04-14 06:38:19 +02:00
parent 1028498705
commit 090d2b7d89
40 changed files with 603 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
api/app/Http/Controllers/Api/V1/Portal/PortalShiftController.php
View File

@@ -172,6 +172,12 @@ final class PortalShiftController extends Controller
public function claim(Request $request, Event $event, Shift $shift): JsonResponse
{
// Verify shift belongs to this event context
$eventIds = $this->resolveEventIds($event);
if (! in_array($shift->festivalSection->event_id, $eventIds)) {
return $this->notFound('Shift niet gevonden.');
}
$person = $this->resolvePerson($event);
if ($person->status !== 'approved') {
@@ -203,6 +209,12 @@ final class PortalShiftController extends Controller
public function cancel(Request $request, Event $event, ShiftAssignment $shiftAssignment): JsonResponse
{
// Verify assignment belongs to this event context
$eventIds = $this->resolveEventIds($event);
if (! in_array($shiftAssignment->shift->timeSlot->event_id, $eventIds)) {
return $this->notFound('Dienst niet gevonden.');
}
$person = $this->resolvePerson($event);
// Must be the person's own assignment