Skip to content

update policies #184

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ht3aa merged 1 commit into from
Apr 3, 2026
Merged

update policies #184

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions app/Policies/CompanyJobPolicy.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,6 @@ class CompanyJobPolicy
public function viewAny(User $user): bool
{
return $user->isSuperAdmin()
|| $user->hasVerifiedEmail()
|| $user->can('ViewAny:Jobs');
Comment on lines 16 to 17
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist bot Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

Removing the access check for regular users in viewAny while still allowing them to own and update jobs (as seen in the update and view methods) creates a logical inconsistency. Users who own jobs (such as HR or Admin users) will no longer be able to access the list view in the dashboard (Filament resource). If the intention is to remove the dependency on email verification, it is recommended to replace it with explicit role checks for HR and Admin users to ensure they maintain access to their job listings.

        return $user->isSuperAdmin()
            || $user->isAdmin()
            || $user->isHR()
            || $user->can('ViewAny:Jobs');

}

Expand Down Expand Up @@ -44,7 +43,7 @@ public function view(?User $user, CompanyJob $job): bool

public function create(User $user): bool
{
return $user->hasVerifiedEmail();
return true;
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist bot Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

Changing the create policy to return true is overly permissive as it allows any authenticated user, including those with the DEVELOPER role, to post jobs. This could lead to spam and data integrity issues. It is recommended to restrict job creation to specific roles like HR or Admin, or to users with a specific permission, consistent with the other methods in this policy.

        return $user->isSuperAdmin()
            || $user->isAdmin()
            || $user->isHR()
            || $user->can('Create:Jobs');

}

public function update(User $user, CompanyJob $job): bool
Expand Down
Loading