bert.hausmans
d0e17f2824
Two route groups: /api/v1/admin/form-failures (super_admin platform) and
/api/v1/organisations/{organisation}/form-failures (org_admin scoped).
Same controller, policy authorises via FK chain (RFC V3). Cross-tenant
access returns 404 not 403 to prevent enumeration.
Resolve takes optional note; Dismiss requires DismissalReasonType
enum with conditional note (mandatory for 'other'). Both via
FormRequest validation with explicit i18n message keys.
Implementation note: Laravel implicit model binding for nested-namespace
ULID models doesn't pick up reliably across nested route groups. Using
manual resolveFailure() helper that loads withoutGlobalScopes() (so
cross-tenant access still reaches the policy, which translates denied →
404 per V3). Policy explicitly checks soft-delete via deleted_at since
withoutGlobalScopes bypasses SoftDeletes too. Policy registered
explicitly in AppServiceProvider — auto-discovery doesn't reliably
resolve App\Models\FormBuilder\* → App\Policies\FormBuilder\*.
NOT: admin UI (session 3). Not: public form routes (no API contract
notification needed).
Refs: RFC-WS-6.md §3 (Q5), §4 (V2, V3)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
95 lines
2.9 KiB
PHP
95 lines
2.9 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Policies\FormBuilder;
|
|
|
|
use App\Models\FormBuilder\FormSubmissionActionFailure;
|
|
use App\Models\Organisation;
|
|
use App\Models\User;
|
|
|
|
/**
|
|
* RFC-WS-6 §4 (V3) — IDOR-class FK-chain enforcement.
|
|
*
|
|
* The `form_submission_action_failures` table has no `organisation_id`
|
|
* column by design. Tenant scope flows via
|
|
* failure.submission.organisation_id. Cross-tenant access returns
|
|
* `false` here; controllers (sessions 2/3) translate to 404 to prevent
|
|
* resource-existence enumeration.
|
|
*/
|
|
final class FormSubmissionActionFailurePolicy
|
|
{
|
|
public function viewAny(User $user): bool
|
|
{
|
|
if ($user->hasRole('super_admin')) {
|
|
return true;
|
|
}
|
|
|
|
// Org admin in any organisation. Controllers in sessions 2/3
|
|
// restrict the result set per role.
|
|
return $user->organisations()
|
|
->wherePivot('role', 'org_admin')
|
|
->exists();
|
|
}
|
|
|
|
public function view(User $user, FormSubmissionActionFailure $failure): bool
|
|
{
|
|
return $this->canAccess($user, $failure);
|
|
}
|
|
|
|
public function retry(User $user, FormSubmissionActionFailure $failure): bool
|
|
{
|
|
return $this->canAccess($user, $failure);
|
|
}
|
|
|
|
public function resolve(User $user, FormSubmissionActionFailure $failure): bool
|
|
{
|
|
return $this->canAccess($user, $failure);
|
|
}
|
|
|
|
public function dismiss(User $user, FormSubmissionActionFailure $failure): bool
|
|
{
|
|
return $this->canAccess($user, $failure);
|
|
}
|
|
|
|
private function canAccess(User $user, FormSubmissionActionFailure $failure): bool
|
|
{
|
|
// Load the submission without global scopes so cross-tenant
|
|
// resolution works for super_admin and so the policy itself
|
|
// does the tenant gating (RFC V3 — single source of truth for
|
|
// tenant resolution, not OrganisationScope).
|
|
$submission = \App\Models\FormBuilder\FormSubmission::query()
|
|
->withoutGlobalScopes()
|
|
->find($failure->form_submission_id);
|
|
if ($submission === null) {
|
|
return false; // parent submission deleted
|
|
}
|
|
if ($submission->deleted_at !== null) {
|
|
return false; // soft-deleted parent — treat as gone
|
|
}
|
|
|
|
$orgId = (string) $submission->organisation_id;
|
|
if ($orgId === '') {
|
|
return false;
|
|
}
|
|
|
|
if ($user->hasRole('super_admin')) {
|
|
return true;
|
|
}
|
|
|
|
// Tenant scope: user must be an org_admin in the failure's
|
|
// organisation. RFC V3 — IDOR-class FK-chain enforcement.
|
|
$organisation = \App\Models\Organisation::query()
|
|
->withoutGlobalScopes()
|
|
->find($orgId);
|
|
if (! $organisation instanceof Organisation) {
|
|
return false;
|
|
}
|
|
|
|
return $organisation->users()
|
|
->where('user_id', $user->id)
|
|
->wherePivot('role', 'org_admin')
|
|
->exists();
|
|
}
|
|
}
|