From bf6deadbc01491f831ced2e1a04e0bc8aca8e05f Mon Sep 17 00:00:00 2001
From: Giovanni-Josserand <josserand.giovanni@gmail.com>
Date: Mon, 12 Jan 2026 09:55:19 +0100
Subject: [PATCH] add policies for getInvalidUsers route

---
 app/Http/Controllers/UserController.php | 3 +++
 app/Policies/UsersPolicy.php            | 5 +++++
 2 files changed, 8 insertions(+)

diff --git a/app/Http/Controllers/UserController.php b/app/Http/Controllers/UserController.php
index 6116c4d..dc18c32 100644
--- a/app/Http/Controllers/UserController.php
+++ b/app/Http/Controllers/UserController.php
@@ -218,6 +218,9 @@ class UserController extends Controller
     }
 
     public function getInvalidUsers(Request $request): JsonResponse {
+        if(Gate::denies('getInvalidUsers', $request->user())){
+            return response()->json(["message" => "Can't add role to this user"], 403);
+        }
 
         try {
 
diff --git a/app/Policies/UsersPolicy.php b/app/Policies/UsersPolicy.php
index d5578ba..feeb5d2 100644
--- a/app/Policies/UsersPolicy.php
+++ b/app/Policies/UsersPolicy.php
@@ -21,4 +21,9 @@ class UsersPolicy
     {
         return $user->role === 1;
     }
+
+    public function getInvalidUsers(User $user) : bool
+    {
+        return $user->role === 1 || $user->role === 2;
+    }
 }