diff --git a/app/Http/Controllers/Api/AssetModelsController.php b/app/Http/Controllers/Api/AssetModelsController.php index 95af6fbe5af2..120c4344b0ff 100644 --- a/app/Http/Controllers/Api/AssetModelsController.php +++ b/app/Http/Controllers/Api/AssetModelsController.php @@ -234,6 +234,7 @@ public function destroy($id) public function selectlist(Request $request) { + $this->authorize('view.selectlists'); $assetmodels = AssetModel::select([ 'models.id', 'models.name', diff --git a/app/Http/Controllers/Api/CategoriesController.php b/app/Http/Controllers/Api/CategoriesController.php index 9b4fa51349a5..500449067696 100644 --- a/app/Http/Controllers/Api/CategoriesController.php +++ b/app/Http/Controllers/Api/CategoriesController.php @@ -148,7 +148,7 @@ public function destroy($id) */ public function selectlist(Request $request, $category_type = 'asset') { - + $this->authorize('view.selectlists'); $categories = Category::select([ 'id', 'name', diff --git a/app/Http/Controllers/Api/CompaniesController.php b/app/Http/Controllers/Api/CompaniesController.php index 8b471f27b362..baf740dfcb17 100644 --- a/app/Http/Controllers/Api/CompaniesController.php +++ b/app/Http/Controllers/Api/CompaniesController.php @@ -159,7 +159,7 @@ public function destroy($id) */ public function selectlist(Request $request) { - + $this->authorize('view.selectlists'); $companies = Company::select([ 'companies.id', 'companies.name', diff --git a/app/Http/Controllers/Api/DepartmentsController.php b/app/Http/Controllers/Api/DepartmentsController.php index 04b806d406de..e48a3df8390a 100644 --- a/app/Http/Controllers/Api/DepartmentsController.php +++ b/app/Http/Controllers/Api/DepartmentsController.php @@ -168,6 +168,7 @@ public function destroy($id) public function selectlist(Request $request) { + $this->authorize('view.selectlists'); $departments = Department::select([ 'id', 'name', diff --git a/app/Http/Controllers/Api/LocationsController.php b/app/Http/Controllers/Api/LocationsController.php index 6d70e7aaf180..ec91310e6f00 100644 --- a/app/Http/Controllers/Api/LocationsController.php +++ b/app/Http/Controllers/Api/LocationsController.php @@ -223,6 +223,8 @@ public function destroy($id) public function selectlist(Request $request) { + $this->authorize('view.selectlists'); + $locations = Location::select([ 'locations.id', 'locations.name', diff --git a/app/Http/Controllers/Api/ManufacturersController.php b/app/Http/Controllers/Api/ManufacturersController.php index 0301ae587c7b..5fa4560fe642 100644 --- a/app/Http/Controllers/Api/ManufacturersController.php +++ b/app/Http/Controllers/Api/ManufacturersController.php @@ -155,6 +155,7 @@ public function destroy($id) public function selectlist(Request $request) { + $this->authorize('view.selectlists'); $manufacturers = Manufacturer::select([ 'id', 'name', diff --git a/app/Http/Controllers/Api/SuppliersController.php b/app/Http/Controllers/Api/SuppliersController.php index 54784a4e3736..d04bb61f03ed 100644 --- a/app/Http/Controllers/Api/SuppliersController.php +++ b/app/Http/Controllers/Api/SuppliersController.php @@ -155,6 +155,8 @@ public function destroy($id) public function selectlist(Request $request) { + $this->authorize('view.selectlists'); + $suppliers = Supplier::select([ 'id', 'name', diff --git a/app/Providers/AuthServiceProvider.php b/app/Providers/AuthServiceProvider.php index b24df173c310..6352e65dcb6d 100644 --- a/app/Providers/AuthServiceProvider.php +++ b/app/Providers/AuthServiceProvider.php @@ -156,6 +156,8 @@ public function boot() return $user->hasAccess('self.checkout_assets'); }); + // This is largely used to determine whether to display the gear icon sidenav + // in the left-side navigation Gate::define('backend.interact', function ($user) { return $user->can('view', Statuslabel::class) || $user->can('view', AssetModel::class) @@ -168,7 +170,21 @@ public function boot() || $user->can('view', Manufacturer::class) || $user->can('view', CustomField::class) || $user->can('view', CustomFieldset::class) - || $user->can('view', Depreciation::class); + || $user->can('view', Depreciation::class); + }); + + + // This determines whether or not an API user should be able to get the selectlists. + // This can seem a little confusing, since view properties may not have been granted + // to the logged in API user, but creating assets, licenses, etc won't work + // if the user can't view and interact with the select lists. + Gate::define('view.selectlists', function ($user) { + return $user->can(['create','update'], Asset::class) + || $user->can(['create','update'], License::class) + || $user->can(['create','update'], Component::class) + || $user->can(['create','update'], Consumable::class) + || $user->can(['create','update'], Accessory::class) + || $user->can(['create','update'], User::class); }); } }