matt
/
auditionadmin
1
0
Fork 0
Code Issues 16 Pull Requests Packages Projects Releases Wiki Activity

Complete judging authorization through the AuditionPolicy 

Complete judging authorization through the AuditionPolicy
This commit is contained in:
Matt Young 2024-06-27 15:54:04 -05:00
parent e948bfe0c5
commit 5637e93a81
2 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
app/Http/Controllers/JudgingController.php
View File

@ -51,8 +51,9 @@ class JudgingController extends Controller
public function saveScoreSheet(Request $request, Entry $entry)
{
Gate::authorize('create', [ScoreSheet::class, $entry]);
// TODO verify user is assigned to judge this audition
if ($request->user()->cannot('judge', $entry->audition)) {
abort(403, 'You are not assigned to judge this entry');
}
$scoringGuide = $entry->audition->scoringGuide()->with('subscores')->first();
$scoreValidation = $scoringGuide->validateScores($request->input('score'));
if ($scoreValidation != 'success') {
@ -81,6 +82,9 @@ class JudgingController extends Controller
public function updateScoreSheet(Request $request, Entry $entry)
{
if ($request->user()->cannot('judge', $entry->audition)) {
abort(403, 'You are not assigned to judge this entry');
}
$scoreSheet = ScoreSheet::where('user_id', Auth::id())->where('entry_id', $entry->id)->first();
if (! $scoreSheet) {
return redirect()->back()->with('error', 'Attempt to edit non existent entry');
@ -112,6 +116,9 @@ class JudgingController extends Controller
protected function advancementVote(Request $request, Entry $entry)
{
if ($request->user()->cannot('judge', $entry->audition)) {
abort(403, 'You are not assigned to judge this entry');
}
if ($entry->for_advancement and auditionSetting('advanceTo')) {
$request->validate([

2
resources/views/judging/entry_score_sheet.blade.php
View File

@ -1,6 +1,4 @@
<x-layout.app>
{{-- TODO A user should only be able to get this form for an entry they're actually assigned to judge--}}
@php
$oldScores = session()->get('oldScores') ?? null;
@endphp