Added API

app/Http/Controllers/Api/UserApiController.php

@@ -3,22 +3,27 @@
 namespace App\Http\Controllers\Api;
 
 use App\Http\Controllers\ApiController;
+use App\Http\Controllers\UserFlightController;
 use App\Models\User;
 use App\Models\UserFlight;
 use Carbon\Carbon;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Gate;
 
 class UserApiController extends ApiController
 {
-    public function nextFlight(string $username): JsonResponse
+    public function nextFlight(User $user): JsonResponse
     {
-        $user = User::where('name', 'ilike', $username)->first();
 
-        if (!$user) {
+        if (!$user->id) {
             return response()->json(['message' => 'User not found'], 404);
         }
 
+        if (Gate::denies('viewProfileData', $user)) {
+            return response()->json(['message' => 'Cannot access private user.'], 403);
+        }
+
         $flight = UserFlight::with(['departureAirport', 'arrivalAirport', 'airline', 'aircraft'])
             ->where('user_id', $user->id)
             ->where('departure_date', '>', now()->utc())
@@ -50,4 +55,20 @@ class UserApiController extends ApiController
         ]);
     }
 
+    public function viewableFlights(User $user)
+    {
+        if (Gate::denies('viewProfileData', $user)) {
+            return collect([]);
+        }
+        return $user->flightsWithRelationshipsLoaded();
+    }
+
+    public function viewableDepartedFlights(User $user)
+    {
+        if (Gate::denies('viewProfileData', $user)) {
+            return collect([]);
+        }
+        return $user->flightsWithRelationshipsLoaded('departed');
+    }
+
 }