[Permissions] Refunds: allow users with role=referent to see their related refunds and do some actions

Problem

A Refund can be related to a specific Local Section (refunds.section_id), but users that are referent of that section cannot see these refunds.

Proposal

In the RefundController: if the viewer has role referent, allow to edit also all refunds under its Section (users.section_id).

The goal is to allow both the author, and the coordinator, to adjust documents, etc.

The referent MUST NOT be allowed to act like admins, in this phase.

Code References

Note that referents are usually not admins.

Pseudo-code - untested:

// Admins can see everything.
// Restrict my view if I'm not an admin.
if (!$user->hasRole('admin')) {
    $query->where(function ($query) use ($user) {
        // Show only my stuff
        $query->where('user_id', $user->id);

        // Plus, show stuff related to my section if I'm its referent
        if ($user->hasRole('referent') && $user->section_id) {
            $query->orWhere('section_id', $user->section_id);
        } );
    });
}

So, once integrated, it should be something like:

Probably we can just change the method RefundController#query() - and remove this comment:

https://gitlab.com/ItalianLinuxSociety/ilsmanager/-/blob/master/app/Http/Controllers/RefundController.php#L170

Bonus Points

NOT under the scope of this task, but it would be nice to understand who is changing what.

E.g. https://github.com/spatie/laravel-activitylog

Please share an opinion if you have extra time.

Quality Assurance

  1. referents finally see/edit refunds that are set on their local section
  2. normal users still see only their stuff
  3. referents still cannot approve none of the refunds (only admins can)
  4. admin still can see/edit everything and approve
  5. if one referent saves an already-existing refund, the refund is still owned by the original author
  6. if one admin saves an already-existing refund, the refund is still owned by the original author

Time Estimation

Edited by Valerio Bozzolan