*/ private const BLOCKING_RELATIONS = [ 'invoiceItems', 'estimateItems', 'taxes', ]; /** * Access is settled by the standalone bulk-delete ability in the * controller. */ public function authorize(): bool { return true; } /** * Every submitted id has to name a real item and be free of the relations * above. * * Quirk kept as is: existence is checked against the whole table, not * within the acting company, so an id owned by another company passes * validation here and is then dropped by the company-scoped deletion. * * @return array */ public function rules(): array { $unreferenced = array_map( fn (string $relation) => new RelationNotExist(Item::class, $relation), self::BLOCKING_RELATIONS, ); return [ 'ids' => ['required'], 'ids.*' => array_merge( ['required', Rule::exists('items', 'id')], $unreferenced, ), ]; } }