新增职务权限管理与聊天室管理权限控制

app/Http/Controllers/Admin/BaccaratLossCoverEventController.php

@@ -13,9 +13,14 @@ use App\Http\Controllers\Controller;
 use App\Http\Requests\StoreBaccaratLossCoverEventRequest;
 use App\Models\BaccaratLossCoverEvent;
 use App\Services\BaccaratLossCoverService;
+use App\Services\PositionPermissionService;
+use App\Support\PositionPermissionRegistry;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 
+/**
+ * 类功能：处理聊天室顶部快捷入口创建与结束百家乐买单活动。
+ */
 class BaccaratLossCoverEventController extends Controller
 {
     /**
@@ -23,6 +28,7 @@ class BaccaratLossCoverEventController extends Controller
      */
     public function __construct(
         private readonly BaccaratLossCoverService $lossCoverService,
+        private readonly PositionPermissionService $positionPermissionService,
     ) {}
 
     /**
@@ -30,6 +36,13 @@ class BaccaratLossCoverEventController extends Controller
      */
     public function store(StoreBaccaratLossCoverEventRequest $request): JsonResponse
     {
+        if (! $this->positionPermissionService->hasPermission($request->user(), PositionPermissionRegistry::ROOM_BACCARAT_LOSS_COVER)) {
+            return response()->json([
+                'ok' => false,
+                'message' => '当前职务无权创建买单活动。',
+            ], 403);
+        }
+
         try {
             $event = $this->lossCoverService->createEvent($request->user(), $request->validated());
         } catch (\RuntimeException $exception) {
@@ -51,6 +64,13 @@ class BaccaratLossCoverEventController extends Controller
      */
     public function close(Request $request, BaccaratLossCoverEvent $event): JsonResponse
     {
+        if (! $this->positionPermissionService->hasPermission($request->user(), PositionPermissionRegistry::ROOM_BACCARAT_LOSS_COVER)) {
+            return response()->json([
+                'ok' => false,
+                'message' => '当前职务无权结束买单活动。',
+            ], 403);
+        }
+
         $event = $this->lossCoverService->forceCloseEvent($event, $request->user());
 
         return response()->json([