diff --git a/app/Http/Controllers/V2/Dashboard/GetProjectsController.php b/app/Http/Controllers/V2/Dashboard/GetProjectsController.php index 21bbdadb2..7e612f715 100644 --- a/app/Http/Controllers/V2/Dashboard/GetProjectsController.php +++ b/app/Http/Controllers/V2/Dashboard/GetProjectsController.php @@ -14,7 +14,10 @@ public function __invoke(Request $request) { /** @var User $user */ $user = Auth::user(); - if ($user->hasRole('government') && data_get($request, 'filter.projectUuid', '')) { + + if (is_null($user)) { + $request = new Request(['filter' => []]); + } elseif ($user->hasRole('government') && data_get($request, 'filter.projectUuid', '')) { $request = new Request(['filter' => []]); } else { $frameworks = data_get($request, 'filter.programmes', []); diff --git a/app/Http/Controllers/V2/Dashboard/ViewProjectController.php b/app/Http/Controllers/V2/Dashboard/ViewProjectController.php index 70c4fb701..8e2cee69b 100644 --- a/app/Http/Controllers/V2/Dashboard/ViewProjectController.php +++ b/app/Http/Controllers/V2/Dashboard/ViewProjectController.php @@ -18,16 +18,13 @@ public function getIfUserIsAllowedToProject(String $uuid) { /** @var User $user */ $user = Auth::user(); - if ($user->hasRole('government')) { + if (is_null($user)) { $response = (object)[ 'allowed' => false, ]; - } elseif ($user->hasRole('funder')) { - $isAllowed = Project::where('uuid', $uuid) - ->where('framework_key', $user->program) - ->exists(); + } elseif ($user->hasRole('government') || $user->hasRole('funder')) { $response = (object)[ - 'allowed' => $isAllowed, + 'allowed' => true, ]; } elseif ($user->hasRole('project-developer')) { $projectId = Project::where('uuid', $uuid) diff --git a/routes/api_v2.php b/routes/api_v2.php index 8c668b1af..e209d758e 100644 --- a/routes/api_v2.php +++ b/routes/api_v2.php @@ -722,7 +722,7 @@ function () { Route::delete('/{auditable}/{uuid}/delete', DeleteAuditStatusController::class); }); -Route::prefix('dashboard')->group(function () { +Route::prefix('dashboard')->withoutMiddleware('auth:service-api-key,api')->group(function () { Route::get('/restoration-strategy', ViewRestorationStrategyController::class); Route::get('/jobs-created', GetJobsCreatedController::class); Route::get('/volunteers-survival-rate', VolunteersAndAverageSurvivalRateController::class);