Enable users with 'View all' to see w/o editing

app/Models/User.php

@@ -425,7 +425,7 @@ class User extends Model implements AuthenticatableContract, AuthorizableContrac
 
     public function caddAddUsers()
     {
-        if ( ! Utils::isNinja()) {
+        if ( ! Utils::isNinjaProd()) {
             return true;
         } elseif ( ! $this->hasFeature(FEATURE_USERS)) {
             return false;
@@ -441,6 +441,12 @@ class User extends Model implements AuthenticatableContract, AuthorizableContrac
 
         return $numUsers < $company->num_users;
     }
+
+    public function canCreateOrEdit($entityType, $entity = false)
+    {
+        return (($entity && $this->can('edit', $entity))
+            || (!$entity && $this->can('create', $entityType)));
+    }
 }
 
 User::updating(function ($user) {

app/Ninja/Datatables/ExpenseDatatable.php

@@ -46,7 +46,7 @@ class ExpenseDatatable extends EntityDatatable
             [
                 'expense_date',
                 function ($model) {
-                    if(!Auth::user()->can('editByOwner', [ENTITY_EXPENSE, $model->user_id])){
+                    if(!Auth::user()->can('viewByOwner', [ENTITY_EXPENSE, $model->user_id])){
                         return Utils::fromSqlDate($model->expense_date);
                     }
 

app/Ninja/Datatables/InvoiceDatatable.php

@@ -16,7 +16,7 @@ class InvoiceDatatable extends EntityDatatable
             [
                 'invoice_number',
                 function ($model) use ($entityType) {
-                    if(!Auth::user()->can('editByOwner', [ENTITY_INVOICE, $model->user_id])){
+                    if(!Auth::user()->can('viewByOwner', [ENTITY_INVOICE, $model->user_id])){
                         return $model->invoice_number;
                     }
 

app/Ninja/Datatables/PaymentDatatable.php

@@ -21,7 +21,7 @@ class PaymentDatatable extends EntityDatatable
             [
                 'invoice_number',
                 function ($model) {
-                    if(!Auth::user()->can('editByOwner', [ENTITY_INVOICE, $model->invoice_user_id])){
+                    if(!Auth::user()->can('viewByOwner', [ENTITY_INVOICE, $model->invoice_user_id])){
                         return $model->invoice_number;
                     }
 

app/Ninja/Datatables/TaskDatatable.php

@@ -26,6 +26,9 @@ class TaskDatatable extends EntityDatatable
             [
                 'created_at',
                 function ($model) {
+                    if(!Auth::user()->can('viewByOwner', [ENTITY_EXPENSE, $model->user_id])){
+                        return Task::calcStartTime($model);
+                    }
                     return link_to("tasks/{$model->public_id}/edit", Task::calcStartTime($model))->toHtml();
                 }
             ],

resources/views/expenses/edit.blade.php

@@ -171,6 +171,7 @@
         </div>
     </div>
 
+    @if (Auth::user()->canCreateOrEdit(ENTITY_EXPENSE, $expense))
     	<center class="buttons">
             {!! Button::normal(trans('texts.cancel'))
                     ->asLinkTo(URL::to('/expenses'))
@@ -191,6 +192,7 @@
                 @endif
             @endif
     	</center>
+    @endif
 
 	{!! Former::close() !!}
 
@@ -214,7 +216,11 @@
                 return false;
             }
 
+            @if (Auth::user()->canCreateOrEdit(ENTITY_EXPENSE, $expense))
                 return true;
+            @else
+                return false
+            @endif
         }
 
         function onClientChange() {

resources/views/invoices/edit.blade.php

@@ -537,6 +537,7 @@
                     ->appendIcon(Icon::create('download-alt')) !!}
         @endif
 
+        @if (Auth::user()->canCreateOrEdit(ENTITY_INVOICE, $invoice))
             @if ($invoice->isClientTrashed())
                 <!-- do nothing -->
             @elseif ($invoice->trashed())
@@ -550,6 +551,7 @@
                           ->dropup() !!}
                 @endif
     	    @endif
+        @endif
 
 	</div>
 	<p>&nbsp;</p>
@@ -1337,7 +1339,11 @@
 
         onPartialChange(true);
 
+        @if (Auth::user()->canCreateOrEdit(ENTITY_INVOICE, $invoice))
             return true;
+        @else
+            return false;
+        @endif
     }
 
     function submitBulkAction(value) {

resources/views/tasks/edit.blade.php

@@ -18,13 +18,15 @@
 
     </style>
 
-
     @if ($errors->first('time_log'))
         <div class="alert alert-danger"><li>{{ trans('texts.task_errors') }}  </li></div>
     @endif
 
+    {!! Former::open($url)
+            ->addClass('col-md-10 col-md-offset-1 warn-on-exit task-form')
+            ->onsubmit('return onFormSubmit(event)')
+            ->method($method) !!}
 
-    {!! Former::open($url)->addClass('col-md-10 col-md-offset-1 warn-on-exit task-form')->method($method)->rules(array()) !!}
     @if ($task)
         {!! Former::populate($task) !!}
         {!! Former::populateField('id', $task->public_id) !!}
@@ -126,6 +128,7 @@
     </div>
 
 
+    @if (Auth::user()->canCreateOrEdit(ENTITY_TASK, $task))
         <center class="buttons">
             @if (Auth::user()->hasFeature(FEATURE_TASKS))
                 @if ($task && $task->is_running)
@@ -152,6 +155,7 @@
                 {!! Button::normal(trans('texts.cancel'))->large()->asLinkTo(URL::to('/tasks'))->appendIcon(Icon::create('remove-circle')) !!}
             @endif
         </center>
+    @endif
 
     {!! Former::close() !!}
 
@@ -204,6 +208,14 @@
         timeLabels['{{ $period }}s'] = '{{ trans("texts.{$period}s") }}';
     @endforeach
 
+    function onFormSubmit(event) {
+        @if (Auth::user()->canCreateOrEdit(ENTITY_TASK, $task))
+            return true;
+        @else
+            return false
+        @endif
+    }
+
     function tock(duration) {
         var str = convertDurationToString(duration);
         $('#duration-text').html(str);