user(); return (string) $user->public_id; } protected function actor(Request $request): User { return $request->user(); } protected function posMember(Request $request): ?PosMember { return $request->attributes->get('pos.member') ?? app(PosMemberResolver::class)->memberFor($this->actor($request), $this->ownerRef($request)); } protected function locationScope(Request $request): ?int { return $request->attributes->get('pos.locationScope') ?? app(PosMemberResolver::class)->locationScope( $this->posMember($request), $this->ownerRef($request), $this->actor($request), ); } protected function location(Request $request): PosLocation { $acting = $request->attributes->get('actingLocation'); if ($acting instanceof PosLocation) { return $acting; } return app(\App\Services\Pos\PosLocationService::class)->resolve($request); } protected function authorizeOwner(Request $request, Model $model): void { abort_unless($model->getAttribute('owner_ref') === $this->ownerRef($request), 404); $this->authorizeLocation($request, $model); } protected function authorizeLocation(Request $request, Model $model): void { $scope = $this->locationScope($request); if ($scope === null) { return; } $locationId = $model->getAttribute('location_id'); if ($locationId !== null) { abort_unless((int) $locationId === $scope, 404); } } protected function scopeToLocation(Request $request, Builder $query, string $column = 'location_id'): Builder { $scope = $this->locationScope($request); if ($scope !== null) { $query->where($column, $scope); } return $query; } }