6ae45684f9
Split V5 dashboard behavior into domain controllers and policies, add agent token rotation/revocation, status reconciliation jobs, ingress firewall syncing, and canvas connection APIs. Add migrations for V5 status tracking, server capabilities, resource connection aliases, and revoked agent tokens.
64 lines
1.8 KiB
PHP
64 lines
1.8 KiB
PHP
<?php
|
|
|
|
namespace App\Policies\V5;
|
|
|
|
use App\Models\Team;
|
|
use App\Models\User;
|
|
use App\Models\V5\Cluster;
|
|
use Illuminate\Auth\Access\Response;
|
|
|
|
class ClusterPolicy
|
|
{
|
|
/**
|
|
* Determine whether the user can view the cluster within the current team.
|
|
* Read-only, so gated on team membership alone.
|
|
*/
|
|
public function view(User $user, Cluster $cluster, Team $team): Response
|
|
{
|
|
return $this->belongsToTeam($cluster, $team);
|
|
}
|
|
|
|
/**
|
|
* Determine whether the user can create a cluster in the current team.
|
|
* There is no model to scope yet, so this is a pure role gate.
|
|
*/
|
|
public function create(User $user, Team $team): Response
|
|
{
|
|
return $this->allowIfAdmin($user, $team);
|
|
}
|
|
|
|
/**
|
|
* Determine whether the user can delete the cluster within the current team.
|
|
*/
|
|
public function delete(User $user, Cluster $cluster, Team $team): Response
|
|
{
|
|
$scope = $this->belongsToTeam($cluster, $team);
|
|
|
|
if ($scope->denied()) {
|
|
return $scope;
|
|
}
|
|
|
|
return $this->allowIfAdmin($user, $team);
|
|
}
|
|
|
|
/**
|
|
* Members may read but not mutate; only admins/owners of the team pass.
|
|
*/
|
|
private function allowIfAdmin(User $user, Team $team): Response
|
|
{
|
|
return $user->isAdminOfTeam($team->id)
|
|
? Response::allow()
|
|
: Response::deny('You do not have permission to manage clusters in this team.');
|
|
}
|
|
|
|
/**
|
|
* Clusters outside the current team must stay invisible, so mismatches
|
|
* deny as not found instead of forbidden.
|
|
*/
|
|
private function belongsToTeam(Cluster $cluster, Team $team): Response
|
|
{
|
|
return $cluster->team_id === $team->id
|
|
? Response::allow()
|
|
: Response::denyAsNotFound();
|
|
}
|
|
}
|