permissions refactoring

app/Http/Controllers/TeamController.php

@@ -2,12 +2,15 @@
 
 namespace App\Http\Controllers;
 
-use App\Actions\ProjectPermissions\ProjectPermissionService;
+use App\Actions\Permissions\PermissionService;
+use App\Enums\Permission;
 use App\Http\Requests\StoreTeamRequest;
+use App\Http\Requests\SyncTeamUserPermissionsRequest;
 use App\Http\Requests\UpdateTeamMembersRequest;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
 use Illuminate\Support\Arr;
 use Inertia\Inertia;
 use Inertia\Response;
@@ -15,17 +18,36 @@ use Inertia\Response;
 class TeamController extends Controller
 {
     public function __construct(
-        private readonly ProjectPermissionService $projectPermissionService,
+        private readonly PermissionService $permissionService,
     ) {}
 
-    public function index(): Response
+    public function index(Request $request): Response
     {
+        $user = $request->user();
+        $canCreateTeams = $this->permissionService->allows($user, Permission::GlobalAdmin);
+        $manageableTeamIds = $this->permissionService->manageableTeamIds($user);
+
+        abort_unless($canCreateTeams || $manageableTeamIds !== [], 403);
+
+        $teams = Team::query()
+            ->with('users')
+            ->when(
+                ! $canCreateTeams,
+                fn ($query) => $query->whereIn('id', $manageableTeamIds),
+            )
+            ->orderBy('name')
+            ->get();
+
         return Inertia::render('teams/Index', [
+            'canCreateTeams' => $canCreateTeams,
+            'permissionOptions' => $this->permissionService->permissionOptions(User::class, Team::class),
             'status' => session('status'),
-            'teams' => Team::query()
-                ->with('users')
-                ->orderBy('name')
-                ->get()
+            'teamPermissions' => $teams
+                ->mapWithKeys(fn (Team $team): array => [
+                    $team->id => $this->permissionService->assignmentMap(User::class, $team),
+                ])
+                ->all(),
+            'teams' => $teams
                 ->map(fn (Team $team): array => [
                     'id' => $team->id,
                     'name' => $team->name,
@@ -44,19 +66,42 @@ class TeamController extends Controller
     {
         $team = Team::query()->create($request->validated());
 
-        return to_route('admin.teams.index')
+        return to_route('teams.index')
             ->with('status', "{$team->name} was created.");
     }
 
     public function updateMembers(UpdateTeamMembersRequest $request, Team $team): RedirectResponse
     {
-        $validated = $request->validated();
+        abort_unless(
+            $this->permissionService->allows($request->user(), Permission::TeamManage, $team),
+            403,
+        );
 
+        $validated = $request->validated();
         $userIds = Arr::get($validated, 'user_ids', []);
 
-        $this->projectPermissionService->syncTeamMembers($team, $userIds);
+        $team->users()->sync($userIds);
 
-        return to_route('admin.teams.index')
+        return to_route('teams.index')
             ->with('status', "{$team->name} members were updated.");
     }
+
+    public function updateUserPermissions(
+        SyncTeamUserPermissionsRequest $request,
+        Team $team,
+        User $user,
+    ): RedirectResponse {
+        abort_unless(
+            $this->permissionService->allows($request->user(), Permission::TeamManage, $team),
+            403,
+        );
+
+        $validated = $request->validated();
+        $permissions = Arr::get($validated, 'permissions', []);
+
+        $this->permissionService->sync($user, $team, $permissions);
+
+        return to_route('teams.index')
+            ->with('status', "{$user->name} permissions on {$team->name} were updated.");
+    }
 }