security: round 2 — multi-tenancy isolation (OrganisationScope, scoped validation, boundary checks)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-14 06:38:19 +02:00
parent 1028498705
commit 090d2b7d89
40 changed files with 603 additions and 64 deletions
--- a/api/app/Http/Controllers/Api/V1/ShiftAssignmentController.php
+++ b/api/app/Http/Controllers/Api/V1/ShiftAssignmentController.php
@@ -96,6 +96,7 @@ final class ShiftAssignmentController extends Controller
        Gate::authorize('bulkApprove', [ShiftAssignment::class, $event]);

        $assignments = ShiftAssignment::whereIn('id', $request->validated('assignment_ids'))
+            ->whereHas('shift.festivalSection', fn ($q) => $q->where('event_id', $event->id))
            ->with('shift')
            ->get();