Fix authorization type mismatch in PostController

[Copilot]

Authorization checks compared a User object with a string, causing type mismatch that always evaluates true, bypassing access control.

Changes

• Updated authorization logic in edit(), update(), and delete() methods to compare integer IDs instead of object-to-string comparison

Before:

if( !$user->isAdmin() && !$user->isEditor() && $post->getAuthor() !== $user->getUsername() )

After:

if( !$user->isAdmin() && !$user->isEditor() && $post->getAuthorId() !== $user->getId() )

This ensures non-admin/non-editor users can only modify posts they authored.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}