Course plan deletion by a trainer

A trainer can now delete a user course plan. A trainer can only delete course plans of an apprentice he trains.

orif/plafor/Controllers/CoursePlan.php

@@ -375,50 +375,85 @@ public function delete_operational_competence($operational_comp_id = 0, $action
      *      - 1 for deleting (hard delete)
      * @return void
      */
-    public function delete_user_course($user_course_id = 0, $action = 0) {
-        // Access permissions
-        if ($_SESSION['user_access'] >= config('\User\Config\UserConfig')->access_lvl_admin) {
-            // Gets data of the user's course if it exists
-            $user_course = $this->user_course_model->find($user_course_id);
+    public function delete_user_course($user_course_id = 0, $action = 0) 
+    {
+        $user_course = $this->user_course_model->find($user_course_id);
 
-            // Redirection
-            if (is_null($user_course)) {
-                return redirect()->to(base_url('plafor/courseplan/list_user_courses'));
+        // Redirection
+        if (is_null($user_course)) {
+            return redirect()->to(base_url('plafor/courseplan/list_user_courses'));
+        }
+
+        // Checks if a currently logged trainer is the trainer of the apprentice
+        if($_SESSION['user_access'] === 2)
+        {
+            $trainer = $this->trainer_apprentice_model->getTrainer($_SESSION['user_id']);
+            $doesTrainerTrainsApprentice = false;
+
+            if(isset($trainer))
+            {
+                $trainer_apprentices = $this->trainer_apprentice_model->getApprenticeIdsFromTrainer($trainer['id']);
+
+                if(isset($trainer_apprentices))
+                {
+                    foreach($trainer_apprentices as $id_apprentice)
+                    {
+                        if($id_apprentice === $user_course['fk_user'])
+                        {
+                            $doesTrainerTrainsApprentice = true;
+                            break;
+                        }
+                    }
+                }
             }
+        }
 
+        // Access permissions
+        if ($_SESSION['user_access'] >= config('\User\Config\UserConfig')->access_lvl_admin || (isset($doesTrainerTrainsApprentice) && $doesTrainerTrainsApprentice))
+        {
             // Gets data for the confirmation view
             $course_plan = $this->course_plan_model->find($user_course['fk_course_plan']);
             $apprentice = $this->user_model->find($user_course['fk_user']);
             $status = $this->user_course_status_model->find($user_course['fk_status']);
 
             // Action to perform
-            switch ($action) {
+            switch ($action)
+            {
                 case 0: // Displays confirmation
                     $output = array(
                         'user_course' => $user_course,
                         'course_plan' => $course_plan,
-                        'apprentice' => $apprentice,
-                        'status' => $status,
-                        'title' => lang('plafor_lang.title_user_course_delete')
+                        'apprentice'  => $apprentice,
+                        'status'      => $status,
+                        'title'       => lang('plafor_lang.title_user_course_delete')
                     );
+
                     return $this->display_view('Plafor\user_course/delete', $output);
+
                 case 1: // Deletes user's course and the corresponding comments and acquisition status
                     // Deletes comments
-                    foreach ($this->acquisition_status_model->where('fk_user_course', $user_course_id)->find() as $acquisition_status) {
+                    foreach ($this->acquisition_status_model->where('fk_user_course', $user_course_id)->find() as $acquisition_status)
+                    {
                         $this->comment_model->where('fk_acquisition_status', $acquisition_status['id'])->delete();
                     };
+
                     // Deletes acquisition status
                     $this->acquisition_status_model->where('fk_user_course', $user_course_id)->delete();
+
                     // Deletes user's course
                     $this->user_course_model->delete($user_course_id);
+
                     break;
-                default: // Do nothing
-                    break;
+
+                default: 
+                    // Do nothing
             }
+
             return redirect()->to(base_url('plafor/apprentice/list_apprentice'));
-        } else {
+        } 
+
+        else
             return $this->display_view('\User\errors\403error');
-        }
     }
 
     /**