diff --git a/app/Models/MovieList.php b/app/Models/MovieList.php index 20e640c..8967081 100644 --- a/app/Models/MovieList.php +++ b/app/Models/MovieList.php @@ -24,4 +24,9 @@ class MovieList extends Model { return $this->belongsTo(User::class, 'user_id'); } + + public function sharedUsers(): BelongsToMany + { + return $this->belongsToMany(User::class)->withPivot('permission')->withTimestamps(); + } } diff --git a/app/Models/Permission.php b/app/Models/Permission.php deleted file mode 100644 index 3767c7e..0000000 --- a/app/Models/Permission.php +++ /dev/null @@ -1,10 +0,0 @@ -roles->contains('name', strtolower($role)); } + + public function sharedLists(): BelongsToMany + { + return $this->belongsToMany(MovieList::class)->withPivot("permission")->withTimestamps(); + } + /** * Get the user's initials */ diff --git a/app/Policies/MovieListPolicy.php b/app/Policies/MovieListPolicy.php index ea25bb5..ebca9d3 100644 --- a/app/Policies/MovieListPolicy.php +++ b/app/Policies/MovieListPolicy.php @@ -15,11 +15,54 @@ class MovieListPolicy // } - public function update(User $user, MovieList $movieList) + /** + * Determine if the user can view the movie list. + * + * Grants access to the list owner and any user who has been + * granted view, edit, or admin permission. + */ + public function view(User $user, MovieList $movieList): bool { - // If the user is the owner of the movie list or has been added as an editor for - // the movie list, allow them to update it. + if ($movieList->user_id === $user->id || $movieList->is_public === true) { + return true; + } - return $movieList->owner()->id = $user->id; //|| $movieList->editors->contains($user->id); + return $movieList->sharedUsers()->where("user_id", $user->id)->exists(); + } + + /** + * Determine if the user can update the movie list. + * + * Grants access to the list owner and any user who has been + * granted edit or admin permission. + */ + public function update(User $user, MovieList $movieList): bool + { + if ($movieList->user_id === $user->id) { + return true; + } + + return $movieList->sharedUsers() + ->where("user_id", $user->id) + ->whereIn("permission", ["edit", "admin"]) + ->exists(); + } + + /** + * Determine if the user can delete the movie list. + * + * Grants access to the list owner and any user who has been + * granted admin permission. + */ + public function delete(User $user, MovieList $movieList): bool + { + if ($movieList->user_id === $user->id) { + return true; + } + + return $movieList->sharedUsers() + ->where("user_id", $user->id) + ->where("permission", "admin") + ->exists(); } } diff --git a/database/migrations/2025_12_27_193705_create_roles_table.php b/database/migrations/2025_12_27_193705_create_roles_table.php deleted file mode 100644 index 4773fc2..0000000 --- a/database/migrations/2025_12_27_193705_create_roles_table.php +++ /dev/null @@ -1,36 +0,0 @@ -id(); - $table->string('name'); - $table->string('display_name'); - $table->timestamps(); - }); - - Schema::create('role_user', function (Blueprint $table) { - $table->id(); - $table->foreignId('user_id')->constrained()->cascadeOnDelete(); - $table->foreignId('role_id')->constrained()->cascadeOnDelete(); - $table->timestamps(); - }); - } - - /** - * Reverse the migrations. - */ - public function down(): void - { - Schema::dropIfExists('roles_user'); - Schema::dropIfExists('roles'); - } -}; diff --git a/database/migrations/2025_12_27_193719_create_permissions_table.php b/database/migrations/2025_12_27_193719_create_permissions_table.php deleted file mode 100644 index 88fa2f3..0000000 --- a/database/migrations/2025_12_27_193719_create_permissions_table.php +++ /dev/null @@ -1,24 +0,0 @@ -id(); + $table->foreignId("movie_list_id")->constrained()->cascadeOnDelete(); + $table->foreignId("user_id")->constrained()->cascadeOnDelete(); + $table->enum("permission", ["view", "edit", "admin"]); + $table->unique(["movie_list_id", "user_id"]); + $table->timestamps(); + }); + } + + /** + * Reverse the migrations. + */ + public function down(): void + { + Schema::dropIfExists('movie_list_user'); + } +}; diff --git a/resources/views/livewire/movie-list.blade.php b/resources/views/livewire/movie-list.blade.php index 60eb12a..d125baa 100644 --- a/resources/views/livewire/movie-list.blade.php +++ b/resources/views/livewire/movie-list.blade.php @@ -2,7 +2,7 @@

{{$list->name}}

- @can('update', $list) + @can('delete', $list)
+ @can("update", $list)
+ @endcan @if(!$filteredMovies->isEmpty())