Fixed permissions for tasks endpoints

app/Http/Controllers/Api/V1/ProjectController.php

@@ -12,7 +12,6 @@ use App\Models\Organization;
 use App\Models\Project;
 use App\Models\User;
 use Illuminate\Auth\Access\AuthorizationException;
-use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Resources\Json\JsonResource;
 use Illuminate\Support\Facades\Auth;
@@ -47,12 +46,7 @@ class ProjectController extends Controller
             ->whereBelongsTo($organization, 'organization');
 
         if (! $canViewAllProjects) {
-            $projectsQuery->where(function (Builder $builder) use ($user): Builder {
-                return $builder->where('is_public', '=', true)
-                    ->orWhereHas('members', function (Builder $builder) use ($user): Builder {
-                        return $builder->whereBelongsTo($user, 'user');
-                    });
-            });
+            $projectsQuery->visibleByUser($user);
         }
 
         $projects = $projectsQuery->paginate();

app/Http/Controllers/Api/V1/TaskController.php

@@ -10,10 +10,14 @@ use App\Http\Requests\V1\Task\TaskUpdateRequest;
 use App\Http\Resources\V1\Task\TaskCollection;
 use App\Http\Resources\V1\Task\TaskResource;
 use App\Models\Organization;
+use App\Models\Project;
 use App\Models\Task;
+use App\Models\User;
 use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Resources\Json\JsonResource;
+use Illuminate\Support\Facades\Auth;
 
 class TaskController extends Controller
 {
@@ -37,6 +41,9 @@ class TaskController extends Controller
     public function index(Organization $organization, TaskIndexRequest $request): TaskCollection
     {
         $this->checkPermission($organization, 'tasks:view');
+        $canViewAllTasks = $this->hasPermission($organization, 'tasks:view:all');
+        /** @var User $user */
+        $user = Auth::user();
 
         $projectId = $request->input('project_id');
 
@@ -47,6 +54,13 @@ class TaskController extends Controller
             $query->where('project_id', '=', $projectId);
         }
 
+        if (! $canViewAllTasks) {
+            $query->whereHas('project', function (Builder $builder) use ($user): void {
+                /** @var Builder<Project> $builder */
+                $builder->visibleByUser($user);
+            });
+        }
+
         $tasks = $query->paginate();
 
         return new TaskCollection($tasks);

app/Http/Requests/V1/Task/TaskIndexRequest.php

@@ -6,9 +6,11 @@ namespace App\Http\Requests\V1\Task;
 
 use App\Models\Organization;
 use App\Models\Project;
+use App\Service\PermissionStore;
 use Illuminate\Contracts\Validation\ValidationRule;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Support\Facades\Auth;
 use Korridor\LaravelModelValidationRules\Rules\ExistsEloquent;
 
 /**
@@ -28,7 +30,13 @@ class TaskIndexRequest extends FormRequest
                 'uuid',
                 new ExistsEloquent(Project::class, null, function (Builder $builder): Builder {
                     /** @var Builder<Project> $builder */
-                    return $builder->whereBelongsTo($this->organization, 'organization');
+                    $builder = $builder->whereBelongsTo($this->organization, 'organization');
+
+                    if (! app(PermissionStore::class)->has($this->organization, 'tasks:view:all')) {
+                        $builder = $builder->visibleByUser(Auth::user());
+                    }
+
+                    return $builder;
                 }),
             ],
         ];

app/Models/Project.php

@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace App\Models;
 
 use Database\Factories\ProjectFactory;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Database\Eloquent\Concerns\HasUuids;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -23,6 +24,7 @@ use Illuminate\Database\Eloquent\Relations\HasMany;
  * @property-read Client|null $client
  * @property-read Collection<Task> $tasks
  *
+ * @method Builder<Project> visibleByUser(User $user)
  * @method static ProjectFactory factory()
  */
 class Project extends Model
@@ -71,4 +73,17 @@ class Project extends Model
     {
         return $this->hasMany(Task::class);
     }
+
+    /**
+     * @param  Builder<Project>  $builder
+     */
+    public function scopeVisibleByUser(Builder $builder, User $user): void
+    {
+        $builder->where(function (Builder $builder) use ($user): Builder {
+            return $builder->where('is_public', '=', true)
+                ->orWhereHas('members', function (Builder $builder) use ($user): Builder {
+                    return $builder->whereBelongsTo($user, 'user');
+                });
+        });
+    }
 }

app/Providers/JetstreamServiceProvider.php

@@ -119,6 +119,10 @@ class JetstreamServiceProvider extends ServiceProvider
             'tags:create',
             'tags:update',
             'tags:delete',
+            'clients:view',
+            'clients:create',
+            'clients:update',
+            'clients:delete',
             'organizations:view',
             'members:view',
         ])->description('Managers have the ability to read, create, and update their own time entries as well as those of their team.');