bert.hausmans/crewli
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: round 2 — multi-tenancy isolation (OrganisationScope, scoped validation, boundary checks)

Browse Source 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
bert.hausmans
2026-04-14 06:38:19 +02:00
parent 1028498705
commit 090d2b7d89
40 changed files with 603 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
api/app/Http/Requests/Api/V1/SyncVolunteerAvailabilityRequest.php
View File

@@ -5,6 +5,7 @@ declare(strict_types=1);
namespace App\Http\Requests\Api\V1;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rule;
final class SyncVolunteerAvailabilityRequest extends FormRequest
{
@@ -16,9 +17,20 @@ final class SyncVolunteerAvailabilityRequest extends FormRequest
/** @return array<string, mixed> */
public function rules(): array
{
$event = $this->route('event');
$eventIds = [$event->id];
if ($event->parent_event_id) {
$eventIds[] = $event->parent_event_id;
} elseif ($event->isFestival()) {
$eventIds = array_merge($eventIds, $event->children()->pluck('id')->all());
}
return [
'availabilities' => ['required', 'array'],
'availabilities.*.time_slot_id' => ['required', 'ulid', 'exists:time_slots,id'],
'availabilities.*.time_slot_id' => [
'required', 'ulid',
Rule::exists('time_slots', 'id')->whereIn('event_id', $eventIds),
],
'availabilities.*.preference_level' => ['sometimes', 'integer', 'min:1', 'max:5'],
];
}