feat: further restrict permissions to view and access reports

app/Http/Controllers/ReportsController.php

@@ -13,15 +13,26 @@ public function index()
                 'name' => 'Member Status',
                 'description' => 'A view of all members in the database and current membership status.',
                 'route' => route('reports.member-status-report'),
+                'permission' => 'view-user-reports',
             ],
             [
                 'name' => 'Member Activity',
                 'description' => 'A view of all gatekeeper authentications in the database by member.',
                 'route' => route('reports.member-activity-report'),
+                'permission' => 'view-gatekeeper-reports',
             ],
         ];
 
-        return view('reports.index', ['reports' => $reports]);
+        $filtered_reports = [];
+
+        foreach ($reports as $report) {
+            // if no additional permissions are required or the user has the permission
+            if (! isset($report['permission']) || \Gate::allows($report['permission'])) {
+                $filtered_reports[] = $report;
+            }
+        }
+
+        return view('reports.index', ['reports' => $filtered_reports]);
     }
 
     public function member_status_report()
@@ -49,13 +60,15 @@ public function member_status_report()
 
     public function member_activity_report(Request $request)
     {
+        $report_name = 'Member Activity Report';
+
         if ($request->has('fromDate', 'toDate')) {
             $validated = $request->validate([
                 'fromDate' => 'required|date',
                 'toDate' => 'required|date',
             ]);
 
-            $report_name = 'Member Activity Report ('.$validated['fromDate'].' - '.$validated['toDate'].')';
+            $report_name = $report_name.' ('.$validated['fromDate'].' - '.$validated['toDate'].')';
             $data = \App\Models\Authentication::where('lock_in', '>=', $validated['fromDate'])
                 ->where('lock_in', '<=', $validated['toDate'])
                 ->orderBy('lock_in', 'desc')
@@ -80,7 +93,6 @@ public function member_activity_report(Request $request)
                 'fields' => $fields,
             ]);
         } else {
-            $report_name = 'Member Activity Report';
             $filters = ['daterange'];
 
             return view('reports.filter', [

app/Providers/AuthServiceProvider.php

@@ -57,6 +57,14 @@ public function boot()
             return Auth::user()->is_allowed('reports', 'manage');
         });
 
+        Gate::define('view-user-reports', function ($user) {
+            return Auth::user()->is_allowed('reports', 'users');
+        });
+
+        Gate::define('view-gatekeeper-reports', function ($user) {
+            return Auth::user()->is_allowed('reports', 'gatekeepers');
+        });
+
         Gate::define('manage-users-keys', function ($user) {
             if (Auth::user()->is_allowed('users', 'manage')) {
                 return true;

routes/web.php

@@ -91,8 +91,8 @@
 // Reports
 Route::middleware(['auth', 'can:manage-reports'])->group(function () {
     Route::get('/reports', [ReportsController::class, 'index'])->name('reports');
-    Route::get('/reports/member-status-report', [ReportsController::class, 'member_status_report'])->name('reports.member-status-report');
-    Route::get('/reports/member-activity-report', [ReportsController::class, 'member_activity_report'])->name('reports.member-activity-report');
+    Route::get('/reports/member-status-report', [ReportsController::class, 'member_status_report'])->middleware(['auth', 'can:view-user-reports'])->name('reports.member-status-report');
+    Route::get('/reports/member-activity-report', [ReportsController::class, 'member_activity_report'])->middleware(['auth', 'can:view-gatekeeper-reports'])->name('reports.member-activity-report');
 });
 
 // Gatekeeper sync and key authentication routes