5.2.16 RecommendationsTablePolicy Reference
Source: app/plugins/Awards/src/Policy/RecommendationsTablePolicy.php
RecommendationsTablePolicy is the collection counterpart to RecommendationPolicy. Its scopeIndex() returns all rows for a super user; otherwise it combines:
- authorized branches;
- dynamic award-level approval authority;
- recommendations visible because the member is a current or retained workflow approver; and
- active-approval visibility restrictions.
The branch/level part is expressed as an award-ID subquery so callers do not need to pre-join Awards or Levels. Request-local caches avoid repeatedly resolving approval/workflow IDs.
canAdd() supports the configured recommendation-submission contract, and canExport() remains a separate decision. Always authorize the action and pass the same scoped query to index, grid, count, and export paths. Never derive a second unscoped query from request filters.
Tests should cover each scope source alone and in combination, no-scope identities, super users, current/prior approval visibility, hidden data, exports, and query isolation between tenants.