kang
5b6d4cb74d
- Updated AGENTS.md to clarify agent account restrictions and permissions. - Implemented checks in AgentNodeAdminUserStoreController and AgentNodeRoleStoreController to restrict admin user and role creation to the agent's own node. - Enhanced validation in AdminPlayerStoreController and AdminPlayerUpdateController to enforce credit limit and rebate rate rules based on player funding mode. - Refactored various request classes to utilize shared admin account field rules for consistency. - Improved error handling in services related to credit allocation and rebate limits to ensure proper validation and messaging.
71 lines
2.0 KiB
PHP
71 lines
2.0 KiB
PHP
<?php
|
|
|
|
namespace App\Support;
|
|
|
|
use App\Models\AdminUser;
|
|
use App\Models\AgentNode;
|
|
|
|
final class AgentAdminUserAuthorization
|
|
{
|
|
public static function userVisibleTo(AdminUser $admin, AdminUser $target): bool
|
|
{
|
|
if ($admin->isSuperAdmin()) {
|
|
return true;
|
|
}
|
|
|
|
$agent = $target->primaryAgentNode();
|
|
if ($agent === null) {
|
|
// Target is a platform account (site admin)
|
|
// Check if admin can access the same sites
|
|
$adminSiteIds = $admin->accessibleAdminSiteIds();
|
|
$targetSiteIds = $target->accessibleAdminSiteIds();
|
|
if ($adminSiteIds === null || $targetSiteIds === null) {
|
|
return false;
|
|
}
|
|
// Check if they share any accessible sites
|
|
return !empty(array_intersect($adminSiteIds, $targetSiteIds));
|
|
}
|
|
|
|
return AdminAgentScope::nodeVisibleTo($admin, $agent);
|
|
}
|
|
|
|
public static function userManageableBy(AdminUser $admin, AdminUser $target): bool
|
|
{
|
|
if (! self::userVisibleTo($admin, $target)) {
|
|
return false;
|
|
}
|
|
|
|
if ($admin->isSuperAdmin()) {
|
|
return true;
|
|
}
|
|
|
|
if (! $admin->hasPermissionCode('agent.user.manage')) {
|
|
return false;
|
|
}
|
|
|
|
$agent = $target->primaryAgentNode();
|
|
if ($agent === null) {
|
|
// Target is a platform account (site admin)
|
|
// Platform accounts can manage other platform accounts in the same site
|
|
return true;
|
|
}
|
|
|
|
return AdminAgentScope::nodeManageableBy($admin, $agent);
|
|
}
|
|
|
|
public static function denyUnlessUserManageable(AdminUser $admin, AdminUser $target): ?\Illuminate\Http\JsonResponse
|
|
{
|
|
if (self::userManageableBy($admin, $target)) {
|
|
return null;
|
|
}
|
|
|
|
return ApiMessage::errorResponse(
|
|
request(),
|
|
'admin.agent_user_manage_denied',
|
|
\App\Lottery\ErrorCode::AdminForbidden->value,
|
|
null,
|
|
403,
|
|
);
|
|
}
|
|
}
|