user()->Guru; if (!$guru) { abort(403, 'Akses ditolak. Anda bukan terdaftar sebagai Guru.'); } $guru_id = $guru->id; // Query classes where the teacher is the PIC or where they taught a session (logbook) $kelas = Kelas::where(function($query) use ($guru_id) { $query->where('guru_id', $guru_id) ->orWhereHas('logbooks', function($q) use ($guru_id) { $q->where('guru_id', $guru_id); }); }) ->when($request->filled('semester'), function ($q) use ($request) { $q->where('semester', $request->semester); }) ->when($request->filled('tahun'), function ($q) use ($request) { $q->where('tahun_ajaran', $request->tahun); }) ->when($request->filled('is_ekstrakurikuler'), function ($q) use ($request) { $q->where('is_ekstrakurikuler', $request->is_ekstrakurikuler); }) ->when($request->filled('program_id'), function ($q) use ($request) { $q->where('program_id', $request->program_id); }) ->with(['logbooks' => function($query) { $query->has('FotoLogbook') ->with('FotoLogbook') ->orderBy('tanggal', 'desc'); }]) ->orderBy('created_at', 'desc') ->get(); $semesters = Kelas::whereNotNull('semester')->distinct()->pluck('semester'); $years = Kelas::whereNotNull('tahun_ajaran')->distinct()->pluck('tahun_ajaran'); $programs = Programs::all(); return view('guru.pages.galeri', compact('kelas', 'semesters', 'years', 'programs')); } public function download($id) { $foto = FotoLogbooks::findOrFail($id); $guru = auth()->user()->Guru; if (!$guru) { abort(403, 'Akses ditolak. Anda bukan terdaftar sebagai Guru.'); } $guru_id = $guru->id; // Security check: Verify if the teacher has access to this logbook's class $logbook = $foto->Logbooks; if ($logbook) { $kelas = $logbook->Kelas; if ($kelas) { $isPIC = $kelas->guru_id == $guru_id; $hasTaught = $logbook->guru_id == $guru_id; if ($isPIC || $hasTaught) { $path = storage_path('app/public/' . $foto->foto); if (file_exists($path)) { return response()->download($path); } } } } abort(404, 'File tidak ditemukan atau Anda tidak memiliki akses.'); } }