first

app/Policies/CommentPolicy.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\ProjectComment;
+use App\Models\TranscriptionProject;
+use App\Models\User;
+
+class CommentPolicy
+{
+    public function view(User $user, TranscriptionProject $project): bool
+    {
+        return $project->isAccessibleBy($user);
+    }
+
+    public function create(User $user, TranscriptionProject $project): bool
+    {
+        return $project->isAccessibleBy($user);
+    }
+
+    public function delete(User $user, ProjectComment $comment): bool
+    {
+        $project = $comment->project;
+        return $comment->user_id === $user->id || $project->isOwnedBy($user);
+    }
+}

app/Policies/TranscriptVersionPolicy.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\TranscriptVersion;
+use App\Models\User;
+
+class TranscriptVersionPolicy
+{
+    public function view(User $user, TranscriptVersion $version): bool
+    {
+        return $version->project->isAccessibleBy($user);
+    }
+
+    public function restore(User $user, TranscriptVersion $version): bool
+    {
+        $project = $version->project;
+        if ($project->isOwnedBy($user)) {
+            return true;
+        }
+        return $project->collaborators()
+            ->where('user_id', $user->id)
+            ->wherePivot('role', 'editor')
+            ->exists();
+    }
+}

app/Policies/TranscriptionProjectPolicy.php

@@ -0,0 +1,90 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\TranscriptionProject;
+use App\Models\User;
+
+class TranscriptionProjectPolicy
+{
+    // Admin TIDAK boleh view detail (kandungan)
+    public function view(User $user, TranscriptionProject $project): bool
+    {
+        return $project->isAccessibleBy($user);
+    }
+
+    // Admin TIDAK boleh view metadata content — hanya metadata minimum via viewMetadata
+    public function viewMetadata(User $user, TranscriptionProject $project): bool
+    {
+        return $user->isAdmin() || $project->isAccessibleBy($user);
+    }
+
+    public function create(User $user): bool
+    {
+        // Admin juga kakitangan — boleh cipta projek sendiri
+        return $user->isActive();
+    }
+
+    public function update(User $user, TranscriptionProject $project): bool
+    {
+        return $project->isAccessibleBy($user);
+    }
+
+    public function delete(User $user, TranscriptionProject $project): bool
+    {
+        return $project->isOwnedBy($user);
+    }
+
+    public function viewAudio(User $user, TranscriptionProject $project): bool
+    {
+        return $project->isAccessibleBy($user);
+    }
+
+    public function viewTranscript(User $user, TranscriptionProject $project): bool
+    {
+        return $project->isAccessibleBy($user);
+    }
+
+    public function editTranscript(User $user, TranscriptionProject $project): bool
+    {
+        if ($project->isOwnedBy($user)) {
+            return true;
+        }
+        // Viewer collaborator tidak boleh edit — editor sahaja
+        return $project->collaborators()
+            ->where('user_id', $user->id)
+            ->wherePivot('role', 'editor')
+            ->exists();
+    }
+
+    public function manageCollaborators(User $user, TranscriptionProject $project): bool
+    {
+        return $project->isOwnedBy($user);
+    }
+
+    public function retryTranscription(User $user, TranscriptionProject $project): bool
+    {
+        return $project->isOwnedBy($user) && $project->isFailed();
+    }
+
+    public function transferOwner(User $user, TranscriptionProject $project): bool
+    {
+        return $user->isAdmin();
+    }
+
+    public function viewVersionHistory(User $user, TranscriptionProject $project): bool
+    {
+        return $project->isAccessibleBy($user);
+    }
+
+    public function restoreVersion(User $user, TranscriptionProject $project): bool
+    {
+        if ($project->isOwnedBy($user)) {
+            return true;
+        }
+        return $project->collaborators()
+            ->where('user_id', $user->id)
+            ->wherePivot('role', 'editor')
+            ->exists();
+    }
+}

app/Policies/UserPolicy.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\User;
+
+class UserPolicy
+{
+    public function viewAny(User $actor): bool
+    {
+        return $actor->isAdmin();
+    }
+
+    public function create(User $actor): bool
+    {
+        return $actor->isAdmin();
+    }
+
+    public function update(User $actor, User $target): bool
+    {
+        return $actor->isAdmin() && $actor->id !== $target->id;
+    }
+
+    public function delete(User $actor, User $target): bool
+    {
+        return $actor->isAdmin()
+            && $actor->id !== $target->id
+            && ! $target->hasUsage();
+    }
+
+    public function activate(User $actor, User $target): bool
+    {
+        return $actor->isAdmin() && $actor->id !== $target->id;
+    }
+
+    public function deactivate(User $actor, User $target): bool
+    {
+        return $actor->isAdmin() && $actor->id !== $target->id;
+    }
+
+    public function changeEmail(User $actor, User $target): bool
+    {
+        return $actor->isAdmin() && $actor->id !== $target->id;
+    }
+}