ok

Production/SNIPE-IT/app/Policies/AccessoryPolicy.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Policies;
+
+class AccessoryPolicy extends CheckoutablePermissionsPolicy
+{
+    protected function columnName()
+    {
+        return 'accessories';
+    }
+}

Production/SNIPE-IT/app/Policies/AssetModelPolicy.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Policies;
+
+class AssetModelPolicy extends SnipePermissionsPolicy
+{
+    protected function columnName()
+    {
+        return 'models';
+    }
+}

Production/SNIPE-IT/app/Policies/AssetPolicy.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\User;
+
+class AssetPolicy extends CheckoutablePermissionsPolicy
+{
+    protected function columnName()
+    {
+        return 'assets';
+    }
+
+    public function viewRequestable(User $user, Asset $asset = null)
+    {
+        return $user->hasAccess('assets.view.requestable');
+    }
+
+    public function audit(User $user, Asset $asset = null)
+    {
+        return $user->hasAccess('assets.audit');
+    }
+}

Production/SNIPE-IT/app/Policies/CategoryPolicy.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Policies;
+
+class CategoryPolicy extends SnipePermissionsPolicy
+{
+    protected function columnName()
+    {
+        return 'categories';
+    }
+}

Production/SNIPE-IT/app/Policies/CheckoutablePermissionsPolicy.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\User;
+
+abstract class CheckoutablePermissionsPolicy extends SnipePermissionsPolicy
+{
+    /**
+     * Determine whether the user can checkout the accessory.
+     *
+     * @param  \App\User  $user
+     * @return mixed
+     */
+    public function checkout(User $user, $item = null)
+    {
+        return $user->hasAccess($this->columnName().'.checkout');
+    }
+
+    /**
+     * Determine whether the user can checkin the accessory.
+     *
+     * @param  \App\User  $user
+     * @return mixed
+     */
+    public function checkin(User $user, $item = null)
+    {
+        return $user->hasAccess($this->columnName().'.checkin');
+    }
+
+    /**
+     * Determine whether the user can manage the accessory.
+     *
+     * @param  \App\User  $user
+     * @return mixed
+     */
+    public function manage(User $user, $item = null)
+    {
+        return $user->hasAccess($this->columnName().'.checkin')
+             || $user->hasAccess($this->columnName().'.edit')
+             || $user->hasAccess($this->columnName().'.checkout');
+    }
+}

Production/SNIPE-IT/app/Policies/CompanyPolicy.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Policies;
+
+class CompanyPolicy extends SnipePermissionsPolicy
+{
+    protected function columnName()
+    {
+        return 'companies';
+    }
+}

Production/SNIPE-IT/app/Policies/ComponentPolicy.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Policies;
+
+class ComponentPolicy extends CheckoutablePermissionsPolicy
+{
+    protected function columnName()
+    {
+        return 'components';
+    }
+}

Production/SNIPE-IT/app/Policies/ConsumablePolicy.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Policies;
+
+class ConsumablePolicy extends CheckoutablePermissionsPolicy
+{
+    protected function columnName()
+    {
+        return 'consumables';
+    }
+}

Production/SNIPE-IT/app/Policies/CustomFieldPolicy.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Policies;
+
+class CustomFieldPolicy extends SnipePermissionsPolicy
+{
+    protected function columnName()
+    {
+        return 'customfields';
+    }
+}

Production/SNIPE-IT/app/Policies/CustomFieldsetPolicy.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Policies;
+
+class CustomFieldsetPolicy extends SnipePermissionsPolicy
+{
+    protected function columnName()
+    {
+        /**
+         * Proxy the authorization for custom fieldsets down to custom fields.
+         * This allows us to use the existing permissions in use and have more
+         * semantically correct authorization checks for custom fieldsets.
+         *
+         * See: https://github.com/snipe/snipe-it/pull/5795
+         */
+        return 'customfields';
+    }
+}

Production/SNIPE-IT/app/Policies/DepartmentPolicy.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Policies;
+
+class DepartmentPolicy extends SnipePermissionsPolicy
+{
+    protected function columnName()
+    {
+        return 'departments';
+    }
+}

Production/SNIPE-IT/app/Policies/DepreciationPolicy.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Policies;
+
+class DepreciationPolicy extends SnipePermissionsPolicy
+{
+    protected function columnName()
+    {
+        return 'depreciations';
+    }
+}

Production/SNIPE-IT/app/Policies/LicensePolicy.php

@@ -0,0 +1,53 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\License;
+use App\Models\User;
+
+class LicensePolicy extends CheckoutablePermissionsPolicy
+{
+    protected function columnName()
+    {
+        return 'licenses';
+    }
+
+    /**
+     * Determine whether the user can view license keys.
+     * This gets a little tricky, UX/logic-wise. If a user has the ability
+     * to create a license (which requires a product key), shouldn't they
+     * have the ability to see the product key as well?
+     *
+     * Example: I create the license, realize I need to change
+     * something (maybe I got the product key wrong), and now I can never
+     * see/edit that product key.
+     *
+     * @see https://github.com/snipe/snipe-it/issues/6956
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\License  $license
+     * @return mixed
+     */
+    public function viewKeys(User $user, License $license = null)
+    {
+        if ($user->hasAccess('licenses.keys') || $user->hasAccess('licenses.create') || $user->hasAccess('licenses.edit')) {
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * Determine whether the user can access files associated with licenses.
+     *
+     * @param  \App\Models\User  $user
+     * @return mixed
+     */
+    public function files(User $user, $license = null)
+    {
+        if ($user->hasAccess('licenses.files'))  {
+            return true;
+        }
+        return false;
+
+    }
+}

Production/SNIPE-IT/app/Policies/LocationPolicy.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Policies;
+
+class LocationPolicy extends SnipePermissionsPolicy
+{
+    protected function columnName()
+    {
+        return 'locations';
+    }
+}

Production/SNIPE-IT/app/Policies/ManufacturerPolicy.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Policies;
+
+class ManufacturerPolicy extends SnipePermissionsPolicy
+{
+    protected function columnName()
+    {
+        return 'manufacturers';
+    }
+}

Production/SNIPE-IT/app/Policies/PredefinedKitPolicy.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Policies;
+
+class PredefinedKitPolicy extends SnipePermissionsPolicy
+{
+    protected function columnName()
+    {
+        return 'kits';
+    }
+}

Production/SNIPE-IT/app/Policies/SnipePermissionsPolicy.php

@@ -0,0 +1,129 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\Company;
+use App\Models\User;
+use Illuminate\Auth\Access\HandlesAuthorization;
+
+/**
+ * SnipePermissionsPolicy provides methods for handling the granular permissions used throughout Snipe-IT.
+ * Each "area" of a permission (which is usually a model, like Assets, Departments, etc), has a setting
+ * in config/permissions.php like view/create/edit/delete (and sometimes some extra stuff like
+ * checkout/checkin, etc.)
+ *
+ * A Policy should exist for each of these models, however if they only use the standard view/create/edit/delete,
+ * the policy can be pretty simple, for example with just one method setting the column name:
+ *
+ * protected function columnName()
+ * {
+ *    return 'manufacturers';
+ * }
+ */
+abstract class SnipePermissionsPolicy
+{
+    /**
+     * This should return the key of the model in the users json permission string.
+     *
+     * @return bool
+     */
+
+    //
+    abstract protected function columnName();
+
+    use HandlesAuthorization;
+
+    public function before(User $user, $ability, $item)
+    {
+        // Lets move all company related checks here.
+        if ($item instanceof \App\Models\SnipeModel && ! Company::isCurrentUserHasAccess($item)) {
+            return false;
+        }
+        // If an admin, they can do all asset related tasks.
+        if ($user->hasAccess('admin')) {
+            return true;
+        }
+    }
+
+    public function index(User $user)
+    {
+        return $user->hasAccess($this->columnName().'.view');
+    }
+
+    /**
+     * Determine whether the user can view the accessory.
+     *
+     * @param  \App\Models\User  $user
+     * @return mixed
+     */
+    public function view(User $user, $item = null)
+    {
+        return $user->hasAccess($this->columnName().'.view');
+    }
+
+    public function files(User $user, $item = null)
+    {
+        return $user->hasAccess($this->columnName().'.files');
+    }
+
+    /**
+     * Determine whether the user can create accessories.
+     *
+     * @param  \App\Models\User  $user
+     * @return mixed
+     */
+    public function create(User $user)
+    {
+        return $user->hasAccess($this->columnName().'.create');
+    }
+
+    /**
+     * Determine whether the user can update the accessory.
+     *
+     * @param  \App\Models\User  $user
+     * @return mixed
+     */
+    public function update(User $user, $item = null)
+    {
+        return $user->hasAccess($this->columnName().'.edit');
+    }
+
+
+    /**
+     * Determine whether the user can update the accessory.
+     *
+     * @param  \App\Models\User  $user
+     * @return mixed
+     */
+    public function checkout(User $user, $item = null)
+    {
+        return $user->hasAccess($this->columnName().'.checkout');
+    }
+
+    /**
+     * Determine whether the user can delete the accessory.
+     *
+     * @param  \App\Models\User  $user
+     * @return mixed
+     */
+    public function delete(User $user, $item = null)
+    {
+        $itemConditional = true;
+        if ($item) {
+            $itemConditional = empty($item->deleted_at);
+        }
+
+        return $itemConditional && $user->hasAccess($this->columnName().'.delete');
+    }
+
+    /**
+     * Determine whether the user can manage the accessory.
+     *
+     * @param  \App\Models\User  $user
+     * @return mixed
+     */
+    public function manage(User $user, $item = null)
+    {
+        return $user->hasAccess($this->columnName().'.edit');
+    }
+}

Production/SNIPE-IT/app/Policies/StatuslabelPolicy.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Policies;
+
+class StatuslabelPolicy extends SnipePermissionsPolicy
+{
+    protected function columnName()
+    {
+        return 'statuslabels';
+    }
+}

Production/SNIPE-IT/app/Policies/SupplierPolicy.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Policies;
+
+class SupplierPolicy extends SnipePermissionsPolicy
+{
+    protected function columnName()
+    {
+        return 'suppliers';
+    }
+}

Production/SNIPE-IT/app/Policies/UserPolicy.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Policies;
+
+class UserPolicy extends SnipePermissionsPolicy
+{
+    protected function columnName()
+    {
+        return 'users';
+    }
+}