Files
InvoiceShelf/app/Http/Controllers/Company/Estimate/EstimatesController.php
Darko Gjorgjijoski c6a00df120 fix(security): enforce company scope on notes, doc-convert, and member bulk-delete (#668)
v3 port of the v2 authorization fixes.

- Notes IDOR (GHSA-85wc): NotePolicy checks the note's company_id and
  NotesController passes the bound model to authorize() on show/update/destroy.
- Estimate<->Invoice convert IDOR (GHSA-j2vg): EstimatesController::convertToInvoice
  and InvoicesController::convertToEstimate authorize 'view' on the source
  document before creating the target.
- Member bulk-delete (GHSA-wxrv): MembersController scopes ids via
  User::whereCompany() before MemberService::delete.

Adds feature tests for cross-company 403s + same-company happy paths.
2026-06-12 11:02:08 +02:00

145 lines
4.2 KiB
PHP

<?php
namespace App\Http\Controllers\Company\Estimate;
use App\Http\Controllers\Controller;
use App\Http\Requests\DeleteEstimatesRequest;
use App\Http\Requests\EstimatesRequest;
use App\Http\Requests\SendEstimatesRequest;
use App\Http\Resources\EstimateResource;
use App\Http\Resources\InvoiceResource;
use App\Jobs\GenerateEstimatePdfJob;
use App\Models\Estimate;
use App\Models\Invoice;
use App\Services\Document\EstimateService;
use Illuminate\Http\Request;
use Illuminate\Mail\Markdown;
class EstimatesController extends Controller
{
public function __construct(
private readonly EstimateService $estimateService,
) {}
public function index(Request $request)
{
$this->authorize('viewAny', Estimate::class);
$limit = $request->has('limit') ? $request->limit : 10;
$estimates = Estimate::whereCompany()
->join('customers', 'customers.id', '=', 'estimates.customer_id')
->applyFilters($request->all())
->select('estimates.*', 'customers.name')
->latest()
->paginateData($limit);
return EstimateResource::collection($estimates)
->additional(['meta' => [
'estimate_total_count' => Estimate::whereCompany()->count(),
]]);
}
public function store(EstimatesRequest $request)
{
$this->authorize('create', Estimate::class);
$estimate = $this->estimateService->create($request);
if ($request->has('estimateSend')) {
$this->estimateService->send($estimate, $request->only(['title', 'body']));
}
GenerateEstimatePdfJob::dispatch($estimate);
return new EstimateResource($estimate);
}
public function show(Request $request, Estimate $estimate)
{
$this->authorize('view', $estimate);
return new EstimateResource($estimate);
}
public function update(EstimatesRequest $request, Estimate $estimate)
{
$this->authorize('update', $estimate);
$estimate = $this->estimateService->update($estimate, $request);
GenerateEstimatePdfJob::dispatch($estimate, true);
return new EstimateResource($estimate);
}
public function delete(DeleteEstimatesRequest $request)
{
$this->authorize('delete multiple estimates');
$ids = Estimate::whereCompany()
->whereIn('id', $request->ids)
->pluck('id');
Estimate::destroy($ids);
return response()->json([
'success' => true,
]);
}
public function send(SendEstimatesRequest $request, Estimate $estimate)
{
$this->authorize('send estimate', $estimate);
$response = $this->estimateService->send($estimate, $request->all());
return response()->json($response);
}
public function sendPreview(SendEstimatesRequest $request, Estimate $estimate)
{
$this->authorize('send estimate', $estimate);
$markdown = new Markdown(view(), config('mail.markdown'));
$data = $this->estimateService->sendEstimateData($estimate, $request->all());
$data['url'] = $estimate->estimatePdfUrl;
return $markdown->render('emails.send.estimate', ['data' => $data]);
}
public function clone(Request $request, Estimate $estimate)
{
$this->authorize('view', $estimate);
$this->authorize('create', Estimate::class);
$newEstimate = $this->estimateService->clone($estimate);
return new EstimateResource($newEstimate);
}
public function convertToInvoice(Request $request, Estimate $estimate)
{
// Authorize access to the source estimate (tenant isolation) in addition
// to the ability to create an invoice.
$this->authorize('view', $estimate);
$this->authorize('create', Invoice::class);
$invoice = $this->estimateService->convertToInvoice($estimate);
return new InvoiceResource($invoice);
}
public function changeStatus(Request $request, Estimate $estimate)
{
$this->authorize('send estimate', $estimate);
$this->estimateService->changeStatus($estimate, $request->status);
return response()->json([
'success' => true,
]);
}
}