Refactorered methods

Signed-off-by: snipe <snipe@snipe.net>

app/Http/Controllers/Users/UsersController.php

@@ -183,8 +183,12 @@ class UsersController extends Controller
     public function edit($id)
     {
 
-        if ($user = Company::scopeCompanyables(User::find($id))) {
+        $this->authorize('update', User::class);
-            $this->authorize('update', $user);
+        $user = User::with('assets', 'assets.model', 'consumables', 'accessories', 'licenses', 'userloc')->withTrashed();
+        $user = Company::scopeCompanyables($user)->find($id);
+
+        if ($user) {
+
             $permissions = config('permissions');
             $groups = Group::pluck('name', 'id');
 
@@ -211,27 +215,30 @@ class UsersController extends Controller
      */
     public function update(SaveUserRequest $request, $id = null)
     {
-        // We need to reverse the UI specific logic for our
+        $this->authorize('update', User::class);
-        // permissions here before we update the user.
-        $permissions = $request->input('permissions', []);
-        app('request')->request->set('permissions', $permissions);
 
         // This is a janky hack to prevent people from changing admin demo user data on the public demo.
         // The $ids 1 and 2 are special since they are seeded as superadmins in the demo seeder.
         // Thanks, jerks. You are why we can't have nice things. - snipe
 
         if ((($id == 1) || ($id == 2)) && (config('app.lock_passwords'))) {
-            return redirect()->route('users.index')->with('error', 'Permission denied. You cannot update user information for superadmins on the demo.');
+            return redirect()->route('users.index')->with('error', trans('general.permission_denied_superuser_demo'));
         }
 
-        try {
-            $user = User::findOrFail($id);
-        } catch (ModelNotFoundException $e) {
-            return redirect()->route('users.index')
-                ->with('error', trans('admin/users/message.user_not_found', compact('id')));
-        }
 
+        // We need to reverse the UI specific logic for our
+        // permissions here before we update the user.
+        $permissions = $request->input('permissions', []);
+        app('request')->request->set('permissions', $permissions);
+
+
+        $user = User::with('assets', 'assets.model', 'consumables', 'accessories', 'licenses', 'userloc')->withTrashed();
+        $user = Company::scopeCompanyables($user)->find($id);
+
+        // User is valid - continue...
+        if ($user) {
             $this->authorize('update', $user);
+
             // Figure out of this user was an admin before this edit
             $orig_permissions_array = $user->decodePermissions();
             $orig_superuser = '0';
@@ -241,15 +248,13 @@ class UsersController extends Controller
                 }
             }
 
-        // Only save groups if the user is a super user
+            // Only save groups if the user is a superuser
             if (Auth::user()->isSuperUser()) {
                 $user->groups()->sync($request->input('groups'));
             }
 
-        // Update the user
+            // Update the user fields
-        if ($request->filled('username')) {
             $user->username = trim($request->input('username'));
-        }
             $user->email = trim($request->input('email'));
             $user->first_name = $request->input('first_name');
             $user->last_name = $request->input('last_name');
@@ -301,9 +306,6 @@ class UsersController extends Controller
             // Handle uploaded avatar
             app(ImageUploadRequest::class)->handleImages($user, 600, 'avatar', 'avatars', 'avatar');
 
-        //\Log::debug(print_r($user, true));
-
-        // Was the user updated?
             if ($user->save()) {
                 // Redirect to the user page
                 return redirect()->route('users.index')
@@ -311,6 +313,11 @@ class UsersController extends Controller
             }
 
             return redirect()->back()->withInput()->withErrors($user->getErrors());
+
+
+        }
+
+        return redirect()->route('users.index')->with('error', trans('admin/users/message.user_not_found', compact('id')));
     }
 
     /**
@@ -326,7 +333,7 @@ class UsersController extends Controller
     {
         try {
             // Get user information
-            $user = User::findOrFail($id);
+            $user = Company::scopeCompanyables(User::findOrFail($id));
             // Authorize takes care of many of our logic checks now.
             $this->authorize('delete', User::class);
 
@@ -429,17 +436,25 @@ class UsersController extends Controller
     public function show($userId = null)
     {
 
-        if (! $user = Company::scopeCompanyables(User::with('assets', 'assets.model', 'consumables', 'accessories', 'licenses', 'userloc')->withTrashed()->find($userId))) {
+        // We can use the more generic auth check here since the company scoping is happening at the query level
-            // Redirect to the user management page
+        $this->authorize('view', User::class);
-            return redirect()->route('users.index')
+
-                ->with('error', trans('admin/users/message.user_not_found', ['id' => $userId]));
+        $user = User::with('assets', 'assets.model', 'consumables', 'accessories', 'licenses', 'userloc')->withTrashed();
-        }
+        $user = Company::scopeCompanyables($user)->find($userId);
-        $this->authorize('view', $user);
+
+        //dd($user);
+
+        if ($user) {
+            \Log::debug('User '.$user->username.' is found - checking permission');
 
             $userlog = $user->userlog->load('item');
 
-        return view('users/view', compact('user', 'userlog'))
+            return view('users/view', compact('user', 'userlog'))->with('settings', Setting::getSettings());
-            ->with('settings', Setting::getSettings());
+        }
+
+        return redirect()->route('users.index')
+            ->with('error', trans('admin/users/message.user_not_found', ['id' => $userId]));
+
     }
 
     /**
@@ -547,8 +562,20 @@ class UsersController extends Controller
             // Open output stream
             $handle = fopen('php://output', 'w');
 
-            Company::scopeCompanyables(User::with('assets', 'accessories', 'consumables', 'department', 'licenses', 'manager', 'groups', 'userloc', 'company')
+            $users = User::with(
-                ->orderBy('created_at', 'DESC')
+                'assets',
+                'accessories',
+                'consumables',
+                'department',
+                'licenses',
+                'manager',
+                'groups',
+                'userloc',
+                'company'
+            )->orderBy('created_at', 'DESC');
+
+            // FMCS scoping
+            Company::scopeCompanyables($users)
                 ->chunk(500, function ($users) use ($handle) {
                     $headers = [
                         // strtolower to prevent Excel from trying to open it as a SYLK file
@@ -605,7 +632,7 @@ class UsersController extends Controller
 
                         fputcsv($handle, $values);
                     }
-                }));
+                });
 
             // Close the output stream
             fclose($handle);