Update on security, user to edit their own system

app/Http/Controllers/SystemController.php

@@ -3,7 +3,9 @@
 namespace App\Http\Controllers;
 
 use Carbon\Carbon;
+use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Database\QueryException;
+use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Arr;
 use Illuminate\Support\Collection;
@@ -14,7 +16,7 @@ use Illuminate\Support\Facades\Notification;
 use Illuminate\Support\ViewErrorBag;
 
 use App\Classes\FTN\Message;
-use App\Http\Requests\{AddressMerge,AreafixRequest,SystemRegister};
+use App\Http\Requests\{AddressMerge,AreafixRequest,SystemRegister,SystemSessionRequest};
 use App\Jobs\AddressPoll;
 use App\Models\{Address,Echoarea,Echomail,Filearea,Netmail,Setup,System,Zone};
 use App\Notifications\Netmails\AddressLink;
@@ -29,8 +31,6 @@ class SystemController extends Controller
 	 */
 	public function add_edit(SystemRegister $request,System $o)
 	{
-		$this->authorize('update',$o);
-
 		if ($request->post()) {
 			foreach (['name','location','sysop','hold','phone','address','port','active','method','notes','zt_id','pkt_type','heartbeat'] as $key)
 				$o->{$key} = $request->post($key);
@@ -836,26 +836,14 @@ class SystemController extends Controller
 	/**
 	 * Add Session details
 	 *
-	 * @param Request $request
+	 * @param SystemSessionRequest $request
 	 * @param System $o
 	 * @return \Illuminate\Http\RedirectResponse
 	 * @throws \Illuminate\Auth\Access\AuthorizationException
 	 */
-	public function session_add(Request $request,System $o)
+	public function session_add(SystemSessionRequest $request,System $o)
 	{
-		// @todo This should be admin of the zone
-		$this->authorize('update',$o);
-		session()->flash('accordion','session');
-
-		$validate = $request->validate([
-			'zone_id' => 'required|exists:zones,id',
-			'sespass' => 'required|string|min:4',
-			'pktpass' => 'required|string|min:4|max:8',
-			'ticpass' => 'required|string|min:4',
-			'fixpass' => 'required|string|min:4',
-		]);
-
-		$zo = Zone::findOrFail($validate['zone_id']);
+		$zo = Zone::findOrFail($request->zone_id);
 
 		/*
 		// @todo Disabling this, it needs improvement. If the new node is the ZC it becomes the default for the zone (and therefore remove all defaults from other addresses in the same zone), otherwise default should be false
@@ -866,7 +854,7 @@ class SystemController extends Controller
 		}
 		*/
 
-		$o->sessions()->attach($zo,$validate);
+		$o->sessions()->attach($zo,$request->validated());
 
 		return redirect()->to(sprintf('system/addedit/%d',$o->id));
 	}
@@ -874,9 +862,10 @@ class SystemController extends Controller
 	/**
 	 * Delete address assigned to a host
 	 *
-	 * @param Address $o
-	 * @return \Illuminate\Http\RedirectResponse
-	 * @throws \Illuminate\Auth\Access\AuthorizationException
+	 * @param System $o
+	 * @param Zone $zo
+	 * @return RedirectResponse
+	 * @throws AuthorizationException
 	 */
 	public function session_del(System $o,Zone $zo)
 	{