standardization of policies/permissions

app/Http/Resources/MutationResource.php

@@ -13,6 +13,13 @@ class MutationResource extends BaseResource
      */
     public function toArray(Request $request): array
     {
-        return parent::toArray($request);
+        $data = parent::toArray($request);
+
+        $data['can'] = [
+            'update' => $request->user()?->can('update', $this->resource) ?? false,
+            'void' => $request->user()?->can('void', $this->resource) ?? false,
+        ];
+
+        return $data;
     }
 }

app/Policies/MutationPolicy.php

@@ -24,8 +24,9 @@ class MutationPolicy
     public function update(User $user, Mutation $mutation): bool
     {
         $dynamic = $mutation->ledger->dynamic;
+        $isOwner = $dynamic->participants()->where('user_id', $user->id)->where('role', 'owner')->exists();
 
-        return $dynamic->participants()->where('user_id', $user->id)->where('role', 'owner')->exists();
+        return $isOwner && $mutation->status === 'pending';
     }
 
     /**
@@ -34,7 +35,8 @@ class MutationPolicy
     public function void(User $user, Mutation $mutation): bool
     {
         $dynamic = $mutation->ledger->dynamic;
+        $isOwner = $dynamic->participants()->where('user_id', $user->id)->where('role', 'owner')->exists();
 
-        return $dynamic->participants()->where('user_id', $user->id)->where('role', 'owner')->exists();
+        return $isOwner && $mutation->status !== 'voided';
     }
 }