Laravel - How to ensure that logged in user can only access his company data

Question

I am developing a client portal application using Angular-7 as frontend and Laravel-5.8. I am using Larave Spatie for User Management. I have these three tables:

CREATE TABLE `company` (
  `id` bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
  `company_id` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
  `company_name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

CREATE TABLE `trips` (
  `id` bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
  `dispatch_datetime` datetime DEFAULT NULL,
  `loading_date` date DEFAULT NULL,
  `loaded_from` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
  `destination` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
  `company_id` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

CREATE TABLE `users` (
  `id` bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
  `name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
  `email` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
  `password` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
  `company_id` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

From the tables above, I have three classes: User, Company and Trip.

1. Each user belong to a company, but not more that one.

2. Each company embark on several trips.

3. company_id in company is also a Primary Key.

From the ApiController, I have used Laravel Spatie to enable users to only have access to data they are given permission. This is working perfectly:

ApiController.php

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use App\Trip;
use App\User;
use App\Company;

use Illuminate\Support\Facades\Auth;

class TripController extends Controller
{
    public function index(Request $request){
        if(!Auth::user()->hasPermissionTo('View Trip')){
            return response()->json([ "message" => 'User do not have permission'], 401);
        }
        if(($request->get('sort')!='null' && $request->get('sort')!='') && $request->get('search')){
            $trip = Trip::where("trip_number", "LIKE", "%{$request->get('search')}%")->orderby($request->get('sort'), $request->get('order'))->paginate(10);
        } else if(($request->get('sort')!='null' && $request->get('sort')!='')){
            $trip = Trip::orderby($request->get('sort'), $request->get('order'))->paginate(10);
        }
        else if($request->get('search'))
            $trip = Trip::where("trip_number", "LIKE", "%{$request->get('search')}%")->paginate(10);
        else
            $trip = Trip::paginate(10);
        return response()->json($trip, 200);
    }
}

Now, I want to achieve the following from the code above:

1. The Logged-in user should be able to view only the trips that his company embark on.

2. If the Logged-In user belongs to the Company that has company_id as MBB, he should be able to view all the trips for all the companies in the database, except he doesn't have permission to view trips.

How can I modify my code to achieve this?

Answer 1

I assume unauthenticate users can not reach this endpoint. You just need to create a starting trip query builderfor all cases with a starting where condition about company_id. So you can add other conditions to this starting trip query builder.

$user = Auth::user();
if(!$user->hasPermissionTo('View Trip')){
    return response()->json([ "message" => 'User do not have permission'], 401);
}

$trip = Trip::where('company_id', $user->company_id);
if(($request->get('sort')!='null' && $request->get('sort')!='') && $request->get('search')){
    $trip = $trip->where("trip_number", "LIKE", "%{$request->get('search')}%")->orderby($request->get('sort'), $request->get('order'));
} else if(($request->get('sort')!='null' && $request->get('sort')!='')){
    $trip = $trip->orderby($request->get('sort'), $request->get('order'));
} else if($request->get('search')) {
    $trip = $trip->where("trip_number", "LIKE", "%{$request->get('search')}%");
}

return response()->json($trip->paginate(10), 200);