saeid

app/Http/Controllers/UserController.php

@@ -20,8 +20,12 @@ class UserController extends Controller
 ␍
     public function index()␍
     {␍
+        if (!auth('api')->user()->can('list', User::class)) {␍
+            return \MessageResponse::error(trans('messages.access_denied'));␍
+        }␍
         $Users = User::with(['medical_center', 'roles'])->paginate(10);␍
         return \MessageResponse::data($Users);␍
+␍
     }␍
 ␍
     public function store(StoreUserRequest $request)␍
@@ -78,6 +82,9 @@ class UserController extends Controller
 ␍
     public function changeStatus(User $User)␍
     {␍
+        if (!auth('api')->user()->can('changeStatus', User::class)) {␍
+          return \MessageResponse::error(trans('messages.access_denied'));␍
+        }␍
         if ($User->status == 'Active') {␍
             $User->status = 'Suspended';␍
         } else {␍
@@ -89,6 +96,9 @@ class UserController extends Controller
 ␍
     public function changeRole(User $User, Request $request)␍
     {␍
+        if (!auth('api')->user()->can('changeRole', User::class)) {␍
+          return \MessageResponse::error(trans('messages.access_denied'));␍
+        }␍
         $User->syncRoles($request->roles);␍
         return \MessageResponse::data($User);␍
     }␍