Fix authorisation for resellers to only see their own accounts

2022-04-22 16:35:01 +10:00
parent 16cc0c9f8d
commit 03f37f33ff
5 changed files with 12 additions and 12 deletions
--- a/app/Models/Policies/ServicePolicy.php
+++ b/app/Models/Policies/ServicePolicy.php
@@ -25,8 +25,8 @@ class ServicePolicy
 			// The user is the wholesaler
 			OR $uo->isWholesaler()

-			// The user is the reseller
-			OR  $uo->isReseller();
+			// The user has this as one of their accounts
+			OR $uo->accounts->pluck('id')->contains($so->account_id);
 	}

 	/**