Enable Non-faculty Profiles to Access Associated Student Applications and Feedback

app/Http/Livewire/StudentFeedback.php

@@ -24,7 +24,7 @@ public function getFeedbackProperty()
 
     public function add()
     {
-        $this->authorize('create', StudentFeedbackEntry::class);
+        $this->authorize('create', [StudentFeedbackEntry::class, $this->student]);
 
         $feedback = $this->student->feedback()->create([
             'data' => $this->new_feedback + ['submitted_by' => auth()->user()->id ?? 'system'],

app/Policies/StudentFeedbackPolicy.php

@@ -2,6 +2,7 @@
 
 namespace App\Policies;
 
+use App\Student;
 use App\StudentFeedback;
 use App\User;
 use Illuminate\Auth\Access\HandlesAuthorization;
@@ -55,9 +56,11 @@ public function view(User $user, StudentFeedback $studentFeedback)
      * @param  \App\User  $user
      * @return mixed
      */
-    public function create(User $user)
+    public function create(User $user, Student $student)
     {
-        return $user->userOrDelegatorhasRole(['faculty', 'students_admin']);
+        $assoc_profile_can_add_feedback = $student->isAssociatedToUserProfiles($user);
+
+        return $user->userOrDelegatorhasRole(['faculty', 'students_admin']) || $assoc_profile_can_add_feedback;
     }
 
     /**

app/Policies/StudentPolicy.php

@@ -2,6 +2,7 @@
 
 namespace App\Policies;
 
+use App\Profile;
 use App\Student;
 use App\User;
 use Illuminate\Auth\Access\HandlesAuthorization;
@@ -35,6 +36,17 @@ public function viewAny(User $user)
         return $user->userOrDelegatorhasRole(['faculty', 'students_admin']);
     }
 
+    /**
+     * Determine whether the student can be viewed by the associated profile's user.
+     *
+     * @param  \App\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function viewForAssociatedProfile(User $user, Student $student)
+    {
+        return $student->isAssociatedToUserProfiles($user);
+    }
+
     /**
      * Determine whether the user can view the student.
      *
@@ -44,7 +56,7 @@ public function viewAny(User $user)
      */
     public function view(User $user, Student $student)
     {
-        return $this->viewAny($user) || $user->owns($student, true);
+        return $this->viewAny($user) || $user->owns($student, true) || $this->viewForAssociatedProfile($user, $student);
     }
 
     /**

app/Student.php

@@ -188,6 +188,16 @@ public function tagTypes(): array
             ->all();
     }
 
+    /**
+     * Determine whether the profile(s) of a given user is associated to the student.
+     */
+    public function isAssociatedToUserProfiles(User $user)
+    {
+        $profile_ids = $user->profiles()->pluck('id');
+
+        return $this->faculty()->whereKey($profile_ids)->exists();
+    }
+
     ////////////////////////////////////
     // Mutators and Virtual Attributes//
     ////////////////////////////////////

resources/views/livewire/student-feedback.blade.php

@@ -1,6 +1,6 @@
 <div>
     {{-- Feedback form --}}
-    @can('create', App\StudentFeedback::class)
+    @can('create', [App\StudentFeedback::class, $student])
         <div class="add-feedback mb-5">
             <button type="button" class="btn btn-primary" data-toggle="collapse" data-target="#student_{{ $student->id }}_feedback_form" aria-expanded="false" aria-controls="student_{{ $student->id }}_feedback_form">
                 <i class="fas fa-comment-medical"></i> Add feedback <i class="fas fa-caret-down"></i>

tests/Feature/ProfileStudentTest.php

@@ -64,4 +64,54 @@ public function testProfileStudentView(): void
             ->assertViewIs('students.profile-students')
             ->assertSee($student->full_name);
     }
+
+    /**
+     * Test Profile (non-faculty) specific view of students
+     *
+     * @return void
+     */
+    public function testNonFcultyProfileStudentView(): void
+    {
+        $associated_profile = Profile::factory()
+            ->hasData()
+            ->create();
+
+        $non_associated_profile= Profile::factory()
+            ->hasData()
+            ->create();
+
+        $student = Student::factory()
+            ->submitted()
+            ->has(StudentData::factory(), 'research_profile')
+            ->hasAttached($associated_profile, [], 'faculty')
+            ->create();
+
+        $profile_student_route = route('profiles.students', ['profile' => $non_associated_profile]);
+        $show_route = route('students.show', ['student' => $student]);
+
+        $this->loginAsUserWithRole('staff', $non_associated_profile->user);
+        $this->get($show_route)
+            ->assertStatus(403);
+
+        $this->loginAsUserWithRole('faculty', $non_associated_profile->user);
+        $this->get($profile_student_route)
+            ->assertStatus(200)
+            ->assertViewIs('students.profile-students')
+            ->assertDontSee($student->full_name);
+
+        $this->get($show_route)
+            ->assertStatus(200);
+
+        $profile_student_route = route('profiles.students', ['profile' => $associated_profile]);
+
+        $this->loginAsUserWithRole('staff', $associated_profile->user);
+        $this->get($profile_student_route)
+            ->assertStatus(200)
+            ->assertViewIs('students.profile-students')
+            ->assertSee($student->full_name);
+
+            $this->get($show_route)
+            ->assertStatus(200)
+            ->assertSee($student->full_name);
+    }
 }