show unconfirmed episodes to privileged users

diff --git a/app/Http/Controllers/EpisodeController.php b/app/Http/Controllers/EpisodeController.php
index 159629f560afdd2476c751c8e0b1e74d7658eb94..97d2aad5bad170f606392f832d18bd843bd1a2c3 100644 (file)
--- a/app/Http/Controllers/EpisodeController.php
+++ b/app/Http/Controllers/EpisodeController.php
@@ -244,14 +244,16 @@ class EpisodeController extends Controller {
                if (isset($validatedData['before'])) {
                        $episodes = $episodes->where('episodes.start', '<=', $validatedData['before']);
                }
-               $privIDs = $this->getUserPrivilegedEvents($request);
-               if (!empty($privIDs)) {
-                       $episodes->where(function (Builder $query) use ($privIDs) {
-                               $query->where('episodes.confirmed', '=', true);
-                               $query->orWhereIn('episodes.event_id', $privIDs);
-                       });
-               } else {
-                       $episodes->where('episodes.confirmed', '=', true);
+               if (!$this->userMaySeeAllEvents($request)) {
+                       $privIDs = $this->getUserPrivilegedEvents($request);
+                       if (!empty($privIDs)) {
+                               $episodes->where(function (Builder $query) use ($privIDs) {
+                                       $query->where('episodes.confirmed', '=', true);
+                                       $query->orWhereIn('episodes.event_id', $privIDs);
+                               });
+                       } else {
+                               $episodes->where('episodes.confirmed', '=', true);
+                       }
                }
                if (!empty($validatedData['event'])) {
                        if (isset($validatedData['eventInvert']) && $validatedData['eventInvert']) {
@@ -301,6 +303,13 @@ class EpisodeController extends Controller {
                return $episode->toJson();
        }
 
+       private function userMaySeeAllEvents(Request $request) {
+               if (!$request->user()) {
+                       return false;
+               }
+               return $request->user()->isPrivileged();
+       }
+
        private function getUserPrivilegedEvents(Request $request): array {
                if (!$request->user()) {
                        return [];