over naar uuids, policies, predefined mutations aan kunnen passen

app/Http/Controllers/MutationController.php

@@ -2,15 +2,19 @@
 
 namespace App\Http\Controllers;
 
+use App\Http\Resources\MutationResource;
 use App\Http\Requests\StoreMutationRequest;
 use App\Models\Dynamic;
 use App\Models\Ledger;
 use App\Models\Mutation;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 
 class MutationController extends Controller
 {
+    use AuthorizesRequests;
+
     /**
      * Display a listing of the resource.
      */
@@ -32,13 +36,10 @@ class MutationController extends Controller
      */
     public function store(StoreMutationRequest $request, Dynamic $dynamic, Ledger $ledger)
     {
-        $isOwner = $dynamic->participants()
-            ->where('user_id', $request->user()->id)
-            ->where('role', 'owner')
-            ->exists();
+        $this->authorize('create', [Mutation::class, $ledger]);
 
         // If the user is an owner, default status to 'approved'. Otherwise default to 'pending'.
-        $status = $isOwner ? 'approved' : 'pending';
+        $status = $request->user()->can('update', $ledger) ? 'approved' : 'pending';
 
         $mutation = DB::transaction(function () use ($request, $ledger, $status) {
             $mutation = $ledger->mutations()->create([
@@ -78,7 +79,9 @@ class MutationController extends Controller
      */
     public function show(Dynamic $dynamic, Ledger $ledger, Mutation $mutation)
     {
-        //
+        $this->authorize('view', $mutation);
+        
+        return new MutationResource($mutation);
     }
 
     /**
@@ -94,15 +97,7 @@ class MutationController extends Controller
      */
     public function update(Request $request, Dynamic $dynamic, Ledger $ledger, Mutation $mutation)
     {
-        // 1. Authorize - only owners can update mutation status!
-        $isOwner = $dynamic->participants()
-            ->where('user_id', $request->user()->id)
-            ->where('role', 'owner')
-            ->exists();
-
-        if (!$isOwner) {
-            abort(403, 'Only dynamic owners can approve or reject mutations.');
-        }
+        $this->authorize('update', $mutation);
 
         $request->validate([
             'status' => ['required', 'string', 'in:approved,rejected'],
@@ -157,6 +152,15 @@ class MutationController extends Controller
         return redirect()->back();
     }
 
+    public function void(Request $request, Dynamic $dynamic, Ledger $ledger, Mutation $mutation)
+    {
+        $this->authorize('void', $mutation);
+
+        $mutation->update(['status' => 'voided']);
+
+        return redirect()->route('dynamics.ledgers.show', [$dynamic, $ledger]);
+    }
+
     /**
      * Remove the specified resource from storage.
      */