silverstripe / deploynaut

		// check for specific permission depending on the current state of the deployment:

		// submitted => approved requires approval permissions

		// new => approved requires bypass permissions.

		if (

			$deployment->State === DNDeployment::STATE_SUBMITTED

			&& !$this->project->allowed(self::ALLOW_APPROVAL, Member::currentUser())

		) {

			return $this->getAPIResponse(['message' => 'You are not authorised to approve this deployment'], 403);

		}

		if (

			$deployment->State === DNDeployment::STATE_NEW

			&& !$this->project->allowed(self::ALLOW_APPROVAL_BYPASS, Member::currentUser())

		) {

			return $this->getAPIResponse(['message' => 'You are not authorised to approve this deployment'], 403);

		}

		if (

			$deployment->State === DNDeployment::STATE_NEW

			&& !$this->project->allowed(self::ALLOW_APPROVAL_BYPASS, Member::currentUser())

		) {

			return $this->getAPIResponse(['message' => 'You are not authorised to bypass approval of this deployment'], 403);

		}

		if ($deployment->State === DNDeployment::STATE_NEW) {

			// Bypassing approval: Ensure that approver is not set. This may happen when someone has requested approval,

			return $errorResponse;

		}

		// reject permissions are the same as can approve

		if (!$this->project->allowed(self::ALLOW_APPROVAL, Member::currentUser())) {

			return $this->getAPIResponse(['message' => 'You are not authorised to reject this deployment'], 403);

		}

		// if the current user is not the person who was selected for approval on submit, but they got

		// here because they still have permission, then change the approver to the current user