From aef3bfdd9465a21a37ff0b63bedfadb61c576c64 Mon Sep 17 00:00:00 2001
From: joddyabott <faezehzafarbakhsh@gmail.com>
Date: Tue, 22 Apr 2025 13:45:04 +0330
Subject: [PATCH] create new middlware and add in route and kernel

---
 .../Dashboard/SafetyAndPrivacyController.php  | 24 --------------
 app/Http/Kernel.php                           |  1 +
 app/Http/Middleware/ValidateStoreAccess.php   | 32 +++++++++++++++++++
 routes/v3.php                                 |  8 +++--
 4 files changed, 38 insertions(+), 27 deletions(-)
 create mode 100644 app/Http/Middleware/ValidateStoreAccess.php

diff --git a/app/Http/Controllers/V3/Dashboard/SafetyAndPrivacyController.php b/app/Http/Controllers/V3/Dashboard/SafetyAndPrivacyController.php
index 693a1864..ce39c5e3 100644
--- a/app/Http/Controllers/V3/Dashboard/SafetyAndPrivacyController.php
+++ b/app/Http/Controllers/V3/Dashboard/SafetyAndPrivacyController.php
@@ -52,14 +52,6 @@ class SafetyAndPrivacyController extends Controller
     {
         $user = auth()->user();
 
-        if ($user->edarate_ostani_id || is_null($user->city_id)) {
-            return $this->errorResponse('امکان ثبت این مورد برای ادارات استانی و ستادی وجود ندارد!');
-        }
-
-        if (is_null($user->edarate_shahri_id)) {
-            return $this->errorResponse('اداره شهری برای شما در سامانه ثبت نشده است!');
-        }
-
         $coordinates = explode(',', $request->point);
         $item = InfoItem::query()
             ->where('id', $request->info_id)
@@ -104,14 +96,6 @@ class SafetyAndPrivacyController extends Controller
     {
         $user = auth()->user();
 
-        if ($user->edarate_ostani_id || is_null($user->city_id)) {
-            return $this->errorResponse('امکان ثبت این مورد برای ادارات استانی و ستادی وجود ندارد!');
-        }
-
-        if (is_null($user->edarate_shahri_id)) {
-            return $this->errorResponse('اداره شهری برای شما در سامانه ثبت نشده است!');
-        }
-
         DB::transaction(function () use ($request, $safetyAndPrivacy, $user)
         {
             $judiciary_document = [];
@@ -135,14 +119,6 @@ class SafetyAndPrivacyController extends Controller
     {
         $user = auth()->user();
 
-        if ($user->edarate_ostani_id || is_null($user->city_id)) {
-            return $this->errorResponse('امکان ثبت این مورد برای ادارات استانی و ستادی وجود ندارد!');
-        }
-
-        if (is_null($user->edarate_shahri_id)) {
-            return $this->errorResponse('اداره شهری برای شما در سامانه ثبت نشده است!');
-        }
-
         DB::transaction(function () use ($request, $safetyAndPrivacy, $user) {
             $safetyAndPrivacy->update([
                 'step' => 3,
diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php
index bc9e3c68..04705bf0 100644
--- a/app/Http/Kernel.php
+++ b/app/Http/Kernel.php
@@ -77,6 +77,7 @@ class Kernel extends HttpKernel
         'role' => \Spatie\Permission\Middlewares\RoleMiddleware::class,
         'permission' => \Spatie\Permission\Middlewares\PermissionMiddleware::class,
         'role_or_permission' => \Spatie\Permission\Middlewares\RoleOrPermissionMiddleware::class,
+        'validate-store-access' => \App\Http\Middleware\ValidateStoreAccess::class,
     ];
 
     /**
diff --git a/app/Http/Middleware/ValidateStoreAccess.php b/app/Http/Middleware/ValidateStoreAccess.php
new file mode 100644
index 00000000..ec57469f
--- /dev/null
+++ b/app/Http/Middleware/ValidateStoreAccess.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Exceptions\ProhibitedAction;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Illuminate\Support\Facades\Auth;
+use Throwable;
+
+class ValidateStoreAccess
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param Closure(Request): (Response) $next
+     * @throws Throwable
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        $user = Auth::user();
+
+        throw_if ($user->edarate_ostani_id || is_null($user->city_id),
+            new ProhibitedAction('امکان ثبت این مورد برای ادارات استانی و ستادی وجود ندارد!'));
+
+        throw_if(is_null($user->edarate_shahri_id),
+            new ProhibitedAction('اداره شهری برای شما در سامانه ثبت نشده است!'));
+
+        return $next($request);
+    }
+}
diff --git a/routes/v3.php b/routes/v3.php
index a71859a2..5d58b5b5 100644
--- a/routes/v3.php
+++ b/routes/v3.php
@@ -339,11 +339,13 @@ Route::prefix('safety_and_privacy')
     ->group(function () {
         Route::get('/', 'index')->name('index')->middleware('permission:show-safety-and-privacy-operator-cartable|show-safety-and-privacy-operator-cartable-province|show-safety-and-privacy-operator-cartable-edarate-shahri');
         Route::get('/excel_report', 'excelReport')->name('excelReport')->middleware('permission:show-safety-and-privacy-operator-cartable|show-safety-and-privacy-operator-cartable-province|show-safety-and-privacy-operator-cartable-edarate-shahri');
-        Route::post('/first_step_store', 'firstStepStore')->name('firstStepStore')->middleware('permission:add-safety-and-privacy');
+        Route::post('/first_step_store', 'firstStepStore')->name('firstStepStore')
+            ->middleware(['validate-store-access', 'permission:add-safety-and-privacy']);
+
         Route::get('/sub_items', 'subItems')->name('subItems');
         Route::get('/map', 'map')->name('map');
-        Route::post('/second_step_store/{safetyAndPrivacy}', 'secondStepStore')->name('secondStepStore')->middleware('permission:add-safety-and-privacy');
-        Route::post('/third_step_store/{safetyAndPrivacy}', 'thirdStepStore')->name('thirdStepStore')->middleware('permission:add-safety-and-privacy');
+        Route::post('/second_step_store/{safetyAndPrivacy}', 'secondStepStore')->name('secondStepStore')->middleware(['validate-store-access','permission:add-safety-and-privacy']);
+        Route::post('/third_step_store/{safetyAndPrivacy}', 'thirdStepStore')->name('thirdStepStore')->middleware(['validate-store-access','permission:add-safety-and-privacy']);
         Route::post('/{safetyAndPrivacy}', 'update')->name('update')->middleware('permission:update-safety-and-privacy');
         Route::get('/{safetyAndPrivacy}', 'show')->name('show');
         Route::delete('/{safetyAndPrivacy}', 'destroy')->name('destroy')->middleware('permission:delete-safety-and-privacy');