profile dan lahan

app/Http/Controllers/Api/LahanController.php

@@ -21,18 +21,22 @@ class LahanController extends Controller
      */
     public function index(Request $request): AnonymousResourceCollection
     {
-        Gate::authorize('petani');
+        if (!Gate::any(['petani', 'fasilitator'])) {
+            abort(403);
+        }
 
         $user = Auth::user();
         $profile = $user->profile;
 
+        $profileId = $user->role === 'petani' ? $profile->id : $request->profile_id;
+
         $size = $request->integer('size') ?: 10;
 
-        $listLahan = Lahan::where('profile_id', $profile->id)
-            ->when($request->search, function ($q, $search) {
+        $listLahan = Lahan::when($request->search, function ($q, $search) {
                 $search = strtolower($search);
                 $q->whereRaw('lower(nama) like ?', ["%{$search}%"]);
             })
+            ->when($profileId, fn($q,$v) => $q->where('profile_id',$v))
             ->when($request->status_kepemilikan, fn($q,$v) => $q->where('status_kepemilikan',$v))
             ->when($request->desa_kelurahan_id, fn($q,$v) => $q->where('desa_kelurahan_id',$v))
             ->when($request->kecamatan_id, fn ($q, $v) =>
@@ -46,7 +50,7 @@ class LahanController extends Controller
                 )
             )
             ->when($request->provinsi_id, fn ($q, $v) =>
-                $q->whereHas('desaKelurahan.kecamatan.kabupatenkota', fn ($k) =>
+                $q->whereHas('desaKelurahan.kecamatan.kabupatenota', fn ($k) =>
                     $k->where('provinsi_id', $v)
                 )
             );
@@ -65,7 +69,6 @@ class LahanController extends Controller
 
         $listLahan = $listLahan->paginate($size);
 
-
         return LahanResource::collection($listLahan);
     }
 
@@ -74,11 +77,19 @@ class LahanController extends Controller
      */
     public function store(Request $request): JsonResponse
     {
-        Gate::authorize('petani');
+        if (!Gate::any(['petani', 'fasilitator'])) {
+            abort(403);
+        }
 
         $user = Auth::user();
         $profile = $user->profile;
 
+        if (!$profile) {
+            abort(404, 'Profile tidak ditemukan');
+        }
+
+        $profileRule = $user->role === 'fasilitator' ? ['required', 'numeric', 'exists:profiles,id'] : ['nullable'];
+
         $validated = $request->validate([
             'nama' => ['required', 'string', 'max:255'],
             'status_kepemilikan' => ['required', new Enum(StatusLahan::class)],
@@ -86,11 +97,29 @@ class LahanController extends Controller
             'path' => ['nullable', 'array'],
             'path.*' => ['array'],
             'luas_lahan' => ['nullable', 'numeric'],
+            'profile_id' => $profileRule,
         ]);
 
+        $targetProfileId = $user->role === 'fasilitator'
+            ? $validated['profile_id']
+            : $profile->id;
+
+        if ($user->role === 'fasilitator') {
+            $targetProfile = Profile::findOrFail($targetProfileId);
+
+            if ($targetProfile->desa_kelurahan_id !== $profile->desa_kelurahan_id) {
+                abort(403, 'Tidak boleh lintas desa');
+            }
+        }
+
+        $desaKelurahanId = $user->role === 'fasilitator'
+            ? $profile->desa_kelurahan_id
+            : ($validated['desa_kelurahan_id'] ?? $profile->desa_kelurahan_id);
+
         $lahan = Lahan::create([
             ...$validated,
             'profile_id' => $profile->id,
+            'desa_kelurahan_id' => $desaKelurahanId,
         ]);
 
         return (new LahanResource($lahan))
@@ -103,12 +132,16 @@ class LahanController extends Controller
      */
     public function show(string $id): JsonResponse
     {
-        Gate::authorize('petani');
+        if (!Gate::any(['petani', 'fasilitator'])) {
+            abort(403);
+        }
 
         $lahan = Lahan::with('desaKelurahan')->findOrFail($id);
-        if ($lahan->profile_id !== Auth::user()->profile->id) {
+        if ($lahan->profile_id !== Auth::user()->profile->id && Auth::user()->role === 'petani') {
             return response()->json(['message' => 'Unauthorized'], 403);
-        } 
+        } else if (Auth::user()->role === 'fasilitator' && $lahan->desa_kelurahan_id !== Auth::user()->profile->desa_kelurahan_id) {
+            return response()->json(['message' => 'Unauthorized'], 403);
+        }
 
         return (new LahanResource($lahan))->response();
     }
@@ -118,12 +151,16 @@ class LahanController extends Controller
      */
     public function update(Request $request, string $id): JsonResponse
     {
-        Gate::authorize('petani');
+        if (!Gate::any(['petani', 'fasilitator'])) {
+            abort(403);
+        }
 
         $lahan = Lahan::findOrFail($id);
-        if ($lahan->profile_id !== Auth::user()->profile->id) {
+        if ($lahan->profile_id !== Auth::user()->profile->id && Auth::user()->role === 'petani') {
             return response()->json(['message' => 'Unauthorized'], 403);
-        } 
+        } else if (Auth::user()->role === 'fasilitator' && $lahan->desa_kelurahan_id !== Auth::user()->profile->desa_kelurahan_id) {
+            return response()->json(['message' => 'Unauthorized'], 403);
+        }
 
         $validated = $request->validate([
             'nama' => ['required', 'string', 'max:255'],
@@ -144,12 +181,16 @@ class LahanController extends Controller
      */
     public function destroy(string $id): JsonResponse
     {
-        Gate::authorize('petani');
+        if (!Gate::any(['petani', 'fasilitator'])) {
+            abort(403);
+        }
 
         $lahan = Lahan::findOrFail($id);
-        if ($lahan->profile_id !== Auth::user()->profile->id) {
+        if ($lahan->profile_id !== Auth::user()->profile->id && Auth::user()->role === 'petani') {
             return response()->json(['message' => 'Unauthorized'], 403);
-        } 
+        } else if (Auth::user()->role === 'fasilitator' && $lahan->desa_kelurahan_id !== Auth::user()->profile->desa_kelurahan_id) {
+            return response()->json(['message' => 'Unauthorized'], 403);
+        }
 
         $lahan->delete();
 
@@ -158,7 +199,10 @@ class LahanController extends Controller
 
     public function batchUpsert(Request $request): JsonResponse
     {
-        Gate::authorize('petani');
+        if (!Gate::any(['petani', 'fasilitator'])) {
+            abort(403);
+        }
+        
         $user = Auth::user();
         $profile = $user->profile;