任务校验团队用户是否被限制

app/Http/Controllers/API/TaskController.php

@@ -54,6 +54,13 @@ class TaskController extends Controller
      */
     public function store(FileAssociationService $service, CreateOrUpdateRequest $request, CustomFieldRepository $customFieldRepo)
     {
+        $isAction=true;
+        $projectId=$request->get("project_id");
+        $project = Project::allowed($projectId,$isAction)->find($projectId);
+        if($project==null){
+            return $this->badRequest('Permission denied or project not found. Please contact the administrator.');
+        };
+
         $requirement = $request->has('requirement_id')
             ? Requirement::query()->findOrFail($request->get("requirement_id"))
             : null;
@@ -102,7 +109,11 @@ class TaskController extends Controller
 
     public function start(Request $request, string $id)
     {
-        $task = Task::query()->allowed($id)->findOrFail($id);
+        $isAction=true;
+        $task = Task::query()->allowed($id,$isAction)->find($id);
+        if($task==null){
+            return $this->badRequest('Permission denied or task not found. Please contact the administrator.');
+        };
         $task->status = TaskStatus::DOING->value;
         $changes = ModelChangeDetector::detector(ActionObjectType::TASK, $task);
         $task->save();
@@ -119,7 +130,11 @@ class TaskController extends Controller
 
     public function pause(Request $request, string $id)
     {
-        $task = Task::query()->allowed($id)->findOrFail($id);
+        $isAction=true;
+        $task = Task::query()->allowed($id,$isAction)->find($id);
+        if($task==null){
+            return $this->badRequest('Permission denied or task not found. Please contact the administrator.');
+        };
 
         $task->status = TaskStatus::PAUSE->value;
         $changes = ModelChangeDetector::detector(ActionObjectType::TASK, $task);
@@ -136,7 +151,11 @@ class TaskController extends Controller
 
     public function closed(Request $request, string $id)
     {
-        $task = Task::query()->allowed($id)->findOrFail($id);
+        $isAction=true;
+        $task = Task::query()->allowed($id,$isAction)->find($id);
+        if($task==null){
+            return $this->badRequest('Permission denied or task not found. Please contact the administrator.');
+        };
 
         $task->status = TaskStatus::CLOSED->value;
         $changes = ModelChangeDetector::detector(ActionObjectType::TASK, $task);
@@ -153,7 +172,11 @@ class TaskController extends Controller
 
     public function done(Request $request, string $id)
     {
-        $task = Task::query()->allowed($id)->findOrFail($id);
+        $isAction=true;
+        $task = Task::query()->allowed($id,$isAction)->find($id);
+        if($task==null){
+            return $this->badRequest('Permission denied or task not found. Please contact the administrator.');
+        };
 
         $task->fill([
             'status' => TaskStatus::DONE->value,
@@ -175,7 +198,11 @@ class TaskController extends Controller
 
     public function cancel(Request $request, string $id)
     {
-        $task = Task::query()->allowed($id)->findOrFail($id);
+        $isAction=true;
+        $task = Task::query()->allowed($id,$isAction)->find($id);
+        if($task==null){
+            return $this->badRequest('Permission denied or task not found. Please contact the administrator.');
+        };
 
         $task->fill([
             'status' => TaskStatus::CANCEL->value,
@@ -196,7 +223,11 @@ class TaskController extends Controller
     }
 
     public function  wait(Request $request,string $id){
-        $task = Task::query()->allowed($id)->findOrFail($id);
+        $isAction=true;
+        $task = Task::query()->allowed($id,$isAction)->find($id);
+        if($task==null){
+            return $this->badRequest('Permission denied or task not found. Please contact the administrator.');
+        };
         $task->status=TaskStatus::WAIT->value;
 
         $changes = ModelChangeDetector::detector(ActionObjectType::TASK, $task);
@@ -213,7 +244,11 @@ class TaskController extends Controller
     }
 
     public function assign(AssignRequest $request,string $id){
-        $task = Task::query()->allowed($id)->findOrFail($id);
+        $isAction=true;
+        $task = Task::query()->allowed($id,$isAction)->find($id);
+        if($task==null){
+            return $this->badRequest('Permission denied or task not found. Please contact the administrator.');
+        };
         $task->fill([
             'assign'=>$request->get('assign'),
               ...$request->all(),
@@ -236,7 +271,11 @@ class TaskController extends Controller
      */
     public function update(CreateOrUpdateRequest $request, string $id, CustomFieldRepository $customFieldRepo)
     {
-        $task = Task::query()->allowed($id)->findOrFail($id);
+        $isAction=true;
+        $task = Task::query()->allowed($id,$isAction)->find($id);
+        if($task==null){
+            return $this->badRequest('Permission denied or task not found. Please contact the administrator.');
+        };
 
         $requirement = $request->has('requirement_id') && $task->requirement_id != $request->get('requirement_id')
             ? Requirement::query()->findOrFail($request->get("requirement_id"))
@@ -267,7 +306,11 @@ class TaskController extends Controller
      */
     public function destroy(string $id)
     {
-        $task = Task::query()->allowed($id)->findOrFail($id);
+        $isAction=true;
+        $task = Task::query()->allowed($id,$isAction)->find($id);
+        if($task==null){
+            return $this->badRequest('Permission denied or task not found. Please contact the administrator.');
+        };
 
         $task->delete();
 
@@ -278,7 +321,12 @@ class TaskController extends Controller
 
     public function batchStore(BatchCreateRequest $request, CustomFieldRepository $customFieldRepo)
     {
-        $project = Project::query()->allowed($request->project_id)->find($request->project_id);
+        $isAction=true;
+        $projectId=$request->get("project_id");
+        $project = Project::allowed($projectId,$isAction)->find($projectId);
+        if($project==null){
+            return $this->badRequest('Permission denied or project not found. Please contact the administrator.');
+        };
         $parsedItems = [];
         $previousItem = [];
         foreach ($request->items as $index => $item) {
@@ -344,7 +392,11 @@ class TaskController extends Controller
      */
     public function linkContainer(LinkContainerRequest $request, string $id)
     {
-        $task = Task::query()->allowed($id)->findOrFail($id);
+        $isAction=true;
+        $task = Task::query()->allowed($id,$isAction)->find($id);
+        if($task==null){
+            return $this->badRequest('Permission denied or task not found. Please contact the administrator.');
+        };
 
         $libraryIds = Library::query()->allowed()->where("project_id", $task->project_id)->pluck("id");
         if ($libraryIds->isEmpty()) {
@@ -375,8 +427,12 @@ class TaskController extends Controller
     public function unlinkContainer(string $id)
     {
         $taskContainer = TaskContainer::query()->findOrFail($id);
-
-        Task::query()->allowed($taskContainer->task_id)->findOrFail($taskContainer->task_id);
+        $taskId=$taskContainer->task_id;
+        $isAction=true;
+        $task = Task::query()->allowed($taskId,$isAction)->find($taskId);
+        if($task==null){
+            return $this->badRequest('Permission denied or task not found. Please contact the administrator.');
+        };
 
         $taskContainer->delete();
 

app/Models/Task.php

@@ -36,11 +36,15 @@ class Task extends Model
      * @param string $id 单个操作时使用，限制范围
      * @return void
      */
-    public function scopeAllowed(Builder $query, string $id = null): void
+    public function scopeAllowed(Builder $query, string $id = null,bool $isAction=false): void
     {
         $taskIds = Task::query()->leftJoin("team_members", "tasks.project_id", "=", "team_members.project_id")
             ->when($id == null, fn($query) => $query->filter(request()->query()))
+            ->when($isAction===false,fn($query)=>$query->filter(request()->query()))
             ->when($id, fn($query) => $query->where("tasks.id", $id))
+            ->when($isAction,fn($query)=>$query->where(function ($query){
+            $query->where("team_members.user_id", Auth::id())->where('team_members.limited',1);
+            }))
             ->where(function($query) {
                 $query->where("team_members.user_id", Auth::id())
                     ->orWhere(fn($query) => $query->where("tasks.acl", TaskACL::CUSTOM->value)->where("whitelist", "like", "%,".Auth::id().",%"));