hermes
d4928789c4
Deploy HickLab3D Dashboard / Deploy to production (push) Failing after 23s
Replace the old touchmark/PNG identity with the supplied lockup and monogram, segmented role-aware navigation, Live/Draft listing filters with generation-based cache invalidation, and admin Projects covering immutable file revisions, listing live pointers, and exact-decimal filament/packaging/shipping costing. Additive schema only; no Etsy publication. Isolated clone tests: 301 tests, 1162 assertions.
19 lines
428 B
PHP
19 lines
428 B
PHP
<?php
|
|
|
|
namespace App\Policies;
|
|
|
|
use App\Models\Project;
|
|
use App\Models\ProjectFile;
|
|
use App\Models\User;
|
|
|
|
class ProjectFilePolicy
|
|
{
|
|
/**
|
|
* Guards against IDOR: a file only downloads through the project it actually belongs to.
|
|
*/
|
|
public function download(User $user, ProjectFile $file, Project $project): bool
|
|
{
|
|
return $user->role === 'admin' && $file->revision->project_id === $project->id;
|
|
}
|
|
}
|