Add HL3D branding, Etsy Live/Draft paging and Projects lifecycle
Deploy HickLab3D Dashboard / Deploy to production (push) Failing after 23s
Deploy HickLab3D Dashboard / Deploy to production (push) Failing after 23s
Replace the old touchmark/PNG identity with the supplied lockup and monogram, segmented role-aware navigation, Live/Draft listing filters with generation-based cache invalidation, and admin Projects covering immutable file revisions, listing live pointers, and exact-decimal filament/packaging/shipping costing. Additive schema only; no Etsy publication. Isolated clone tests: 301 tests, 1162 assertions.
This commit is contained in:
@@ -0,0 +1,18 @@
|
||||
<?php
|
||||
|
||||
namespace App\Policies;
|
||||
|
||||
use App\Models\Project;
|
||||
use App\Models\ProjectFile;
|
||||
use App\Models\User;
|
||||
|
||||
class ProjectFilePolicy
|
||||
{
|
||||
/**
|
||||
* Guards against IDOR: a file only downloads through the project it actually belongs to.
|
||||
*/
|
||||
public function download(User $user, ProjectFile $file, Project $project): bool
|
||||
{
|
||||
return $user->role === 'admin' && $file->revision->project_id === $project->id;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user