From de2157603576c3ffc9bc0f9bb55e8a6e575a8a2e Mon Sep 17 00:00:00 2001 From: snipe Date: Mon, 20 Jul 2026 13:59:51 +0100 Subject: [PATCH] Fixed maintenance files permission --- app/Policies/MaintenancePolicy.php | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/app/Policies/MaintenancePolicy.php b/app/Policies/MaintenancePolicy.php index 9436b1cdac..9a49699aaa 100644 --- a/app/Policies/MaintenancePolicy.php +++ b/app/Policies/MaintenancePolicy.php @@ -80,7 +80,7 @@ final class MaintenancePolicy } /** - * Determine whether the user can upload or manage files attached to a maintenance record. + * Determine whether the user can view files attached to a maintenance record. * Allowed if the user can edit the associated asset. */ public function files(User $user, Maintenance $maintenance): bool @@ -88,6 +88,18 @@ final class MaintenancePolicy return Gate::allows('update', $maintenance->asset); } + /** + * Determine whether the user can upload or delete files attached to a + * maintenance record. Mirrors files() here because maintenance file + * management follows the same asset-edit gate for both read and write. + * MaintenancePolicy is standalone (does not extend SnipePermissionsPolicy) + * so the base class fallback for manageFiles does not apply. + */ + public function manageFiles(User $user, Maintenance $maintenance): bool + { + return Gate::allows('update', $maintenance->asset); + } + /** * Determine whether the user can view history for a maintenance record. * Allowed when the user can view the maintenance itself, or has global activity view permission.