- Implementasi otorisasi berbasis peran untuk seluruh aksi di BranchController seperti index, create, store, edit, update, delete, dan export. - Tambahan utilitas `getUser` untuk mendapatkan pengguna yang diautentikasi dan mempermudah pengecekan otorisasi. - Semua aksi pada controller sekarang memeriksa izin pengguna sebelum melanjutkan: - `basic-data.read` untuk melihat data. - `basic-data.create` untuk membuat cabang baru. - `basic-data.update` untuk memperbarui data cabang. - `basic-data.delete` untuk menghapus data cabang. - `basic-data.export` untuk mengekspor data cabang. - Penyesuaian pada view: - Tombol aksi seperti `Save`, `Delete Selected`, dan `Export to Excel` hanya tampil jika pengguna memiliki izin terkait. - Tambahan pengujian (unit test) pada `BranchControllerTest` untuk memastikan logika otorisasi: - Pengguna dengan izin dapat melakukan aksi sesuai dengan perannya. - Pengguna tanpa izin mendapatkan respon 403 atau dicegah melakukan aksi tertentu. - Update logika tombol aksi di datatables untuk mendukung pengecekan izin sebelum menampilkan opsi edit/hapus. - Update respons JSON dalam aksi hapus tunggal dan hapus banyak untuk kejelasan struktur pesan. Commit ini mengamankan BranchController dari akses tak sah dan meningkatkan fleksibilitas sistem terkait kendali peran dan izin. Signed-off-by: Daeng Deni Mardaeni <ddeni05@gmail.com>
216 lines
8.1 KiB
PHP
216 lines
8.1 KiB
PHP
<?php
|
|
|
|
namespace Modules\Basicdata\Http\Controllers;
|
|
|
|
use App\Http\Controllers\Controller;
|
|
use Exception;
|
|
use Illuminate\Http\Request;
|
|
use Maatwebsite\Excel\Facades\Excel;
|
|
use Modules\Basicdata\Exports\BranchExport;
|
|
use Modules\Basicdata\Http\Requests\BranchRequest;
|
|
use Modules\Basicdata\Models\Branch;
|
|
|
|
class BranchController extends Controller
|
|
{
|
|
/**
|
|
* Get the authenticated user.
|
|
*
|
|
* @return \Illuminate\Contracts\Auth\Authenticatable|null
|
|
*/
|
|
protected function getUser()
|
|
{
|
|
return \Illuminate\Support\Facades\Auth::guard('web')->user();
|
|
}
|
|
|
|
public function index()
|
|
{
|
|
// Check if the authenticated user has the required permission to view branches
|
|
$user = $this->getUser();
|
|
if (is_null($user) || !$user->can('basic-data.read')) {
|
|
abort(403, 'Sorry! You are not allowed to view branches.');
|
|
}
|
|
|
|
return view('basicdata::branch.index');
|
|
}
|
|
|
|
public function store(BranchRequest $request)
|
|
{
|
|
// Check if the authenticated user has the required permission to create branches
|
|
$user = $this->getUser();
|
|
if (is_null($user) || !$user->can('basic-data.create')) {
|
|
abort(403, 'Sorry! You are not allowed to create branches.');
|
|
}
|
|
|
|
$validate = $request->validated();
|
|
|
|
if ($validate) {
|
|
try {
|
|
// Save to database
|
|
Branch::create($validate);
|
|
return redirect()
|
|
->route('basicdata.branch.index')
|
|
->with('success', 'Branch created successfully');
|
|
} catch (Exception $e) {
|
|
return redirect()
|
|
->route('basicdata.branch.create')
|
|
->with('error', 'Failed to create branch');
|
|
}
|
|
}
|
|
}
|
|
|
|
public function create()
|
|
{
|
|
// Check if the authenticated user has the required permission to create branches
|
|
$user = $this->getUser();
|
|
if (is_null($user) || !$user->can('basic-data.create')) {
|
|
abort(403, 'Sorry! You are not allowed to create branches.');
|
|
}
|
|
|
|
return view('basicdata::branch.create');
|
|
}
|
|
|
|
public function edit($id)
|
|
{
|
|
// Check if the authenticated user has the required permission to update branches
|
|
$user = $this->getUser();
|
|
if (is_null($user) || !$user->can('basic-data.update')) {
|
|
abort(403, 'Sorry! You are not allowed to update branches.');
|
|
}
|
|
|
|
$branch = Branch::find($id);
|
|
return view('basicdata::branch.create', compact('branch'));
|
|
}
|
|
|
|
public function update(BranchRequest $request, $id)
|
|
{
|
|
// Check if the authenticated user has the required permission to update branches
|
|
$user = $this->getUser();
|
|
if (is_null($user) || !$user->can('basic-data.update')) {
|
|
abort(403, 'Sorry! You are not allowed to update branches.');
|
|
}
|
|
|
|
$validate = $request->validated();
|
|
|
|
if ($validate) {
|
|
try {
|
|
// Update in database
|
|
$branch = Branch::find($id);
|
|
$branch->update($validate);
|
|
return redirect()
|
|
->route('basicdata.branch.index')
|
|
->with('success', 'Branch updated successfully');
|
|
} catch (Exception $e) {
|
|
return redirect()
|
|
->route('basicdata.branch.edit', $id)
|
|
->with('error', 'Failed to update branch');
|
|
}
|
|
}
|
|
}
|
|
|
|
public function destroy($id)
|
|
{
|
|
// Check if the authenticated user has the required permission to delete branches
|
|
$user = $this->getUser();
|
|
if (is_null($user) || !$user->can('basic-data.delete')) {
|
|
return response()->json(['success' => false, 'message' => 'Sorry! You are not allowed to delete branches.'], 403);
|
|
}
|
|
|
|
try {
|
|
// Delete from database
|
|
$branch = Branch::find($id);
|
|
$branch->delete();
|
|
|
|
return response()->json(['success' => true, 'message' => 'Branch deleted successfully']);
|
|
} catch (Exception $e) {
|
|
return response()->json(['success' => false, 'message' => 'Failed to delete branch']);
|
|
}
|
|
}
|
|
|
|
public function deleteMultiple(Request $request)
|
|
{
|
|
// Check if the authenticated user has the required permission to delete branches
|
|
$user = $this->getUser();
|
|
if (is_null($user) || !$user->can('basic-data.delete')) {
|
|
return response()->json(['success' => false, 'message' => 'Sorry! You are not allowed to delete branches.'], 403);
|
|
}
|
|
|
|
$ids = $request->input('ids');
|
|
Branch::whereIn('id', $ids)->delete();
|
|
return response()->json(['success' => true, 'message' => 'Branches deleted successfully']);
|
|
}
|
|
|
|
public function dataForDatatables(Request $request)
|
|
{
|
|
// Check if the authenticated user has the required permission to view branches
|
|
$user = $this->getUser();
|
|
if (is_null($user) || !$user->can('basic-data.read')) {
|
|
return response()->json(['success' => false, 'message' => 'Sorry! You are not allowed to view branches.'], 403);
|
|
}
|
|
|
|
// Retrieve data from the database
|
|
$query = Branch::query();
|
|
|
|
// Apply search filter if provided
|
|
if ($request->has('search') && !empty($request->get('search'))) {
|
|
$search = $request->get('search');
|
|
$query->where(function ($q) use ($search) {
|
|
$q->where('code', 'LIKE', "%$search%");
|
|
$q->orWhere('name', 'LIKE', "%$search%");
|
|
});
|
|
}
|
|
|
|
// Apply sorting if provided
|
|
if ($request->has('sortOrder') && !empty($request->get('sortOrder'))) {
|
|
$order = $request->get('sortOrder');
|
|
$column = $request->get('sortField');
|
|
$query->orderBy($column, $order);
|
|
}
|
|
|
|
// Get the total count of records
|
|
$totalRecords = $query->count();
|
|
|
|
// Apply pagination if provided
|
|
if ($request->has('page') && $request->has('size')) {
|
|
$page = $request->get('page');
|
|
$size = $request->get('size');
|
|
$offset = ($page - 1) * $size; // Calculate the offset
|
|
|
|
$query->skip($offset)->take($size);
|
|
}
|
|
|
|
// Get the filtered count of records
|
|
$filteredRecords = $query->count();
|
|
|
|
// Get the data for the current page
|
|
$data = $query->get();
|
|
|
|
// Calculate the page count
|
|
$pageCount = ceil($totalRecords / $request->get('size'));
|
|
|
|
// Calculate the current page number
|
|
$currentPage = 0 + 1;
|
|
|
|
// Return the response data as a JSON object
|
|
return response()->json([
|
|
'draw' => $request->get('draw'),
|
|
'recordsTotal' => $totalRecords,
|
|
'recordsFiltered' => $filteredRecords,
|
|
'pageCount' => $pageCount,
|
|
'page' => $currentPage,
|
|
'totalCount' => $totalRecords,
|
|
'data' => $data,
|
|
]);
|
|
}
|
|
|
|
public function export()
|
|
{
|
|
// Check if the authenticated user has the required permission to export branches
|
|
$user = $this->getUser();
|
|
if (is_null($user) || !$user->can('basic-data.export')) {
|
|
abort(403, 'Sorry! You are not allowed to export branches.');
|
|
}
|
|
|
|
return Excel::download(new BranchExport, 'branch.xlsx');
|
|
}
|
|
}
|