Share Vehicle Appraisals with Users and Public Links

Avalúo Vehicular includes a full-featured sharing system that lets evaluators distribute completed appraisals in two distinct modes: internal sharing, where specific registered users are granted access, and public token links, where a unique, unauthenticated URL is generated so anyone with the link can view the appraisal without logging in. Both modes support expiration dates, status lifecycle management, and a per-link view counter.

The `AvaluoCompartido` Model

Every sharing record is stored in the avaluo_compartido table, managed by the AvaluoCompartido Eloquent model. Each row represents one user’s access grant to one appraisal.

// app/Models/AvaluoCompartido.php
protected $fillable = [
    'avaluo_id',        // Foreign key → avaluos.id
    'user_id',          // The user being granted access
    'token',            // 40-character random token (only for 'acceso publico')
    'fecha_inicio',     // Start date of the access window (cast to datetime)
    'fecha_fin',        // Expiry date of the access window (cast to datetime)
    'estado',           // 'activo' | 'vencido' | 'renovado'
    'fecha_compartido', // Timestamp when the sharing was created / renewed (cast to datetime)
    'motivo',           // Reason / access type, e.g. 'revision', 'acceso publico'
    'contador_vistas',  // Number of times the public link has been viewed (cast to integer)
    'observaciones',    // Optional free-text notes
];

Field	Type	Description
`avaluo_id`	integer (FK)	The appraisal being shared
`user_id`	integer (FK)	The user receiving access
`token`	string \| null	Unique 40-character token for public links; `null` for internal shares
`fecha_inicio`	datetime	When the access period begins
`fecha_fin`	datetime \| null	When the access expires; `null` means no expiry
`estado`	enum	`activo`, `vencido`, or `renovado`
`fecha_compartido`	datetime	Created / last renewed timestamp
`motivo`	string	Reason for sharing; `"acceso publico"` triggers token generation
`contador_vistas`	integer	Incremented on each public-link page load
`observaciones`	string \| null	Optional notes visible to the sharer

Routes

Authenticated sharing routes live under the /avaluo prefix (middleware auth, verified). The public view route has no authentication middleware.

Method	URI	Name	Controller	Purpose
`GET`	`/avaluo/share`	`avaluo.share.index`	`ShareController@index`	List shared appraisals (mine + shared with me)
`POST`	`/avaluo/share/{id}`	`avaluo.share.store`	`ShareController@store`	Share an appraisal with one or more users
`POST`	`/avaluo/share/update/{id}`	`avaluo.share.update`	`ShareController@update`	Update sharing settings (dates, estado, motivo)
`POST`	`/avaluo/share/renovar/{id}`	`avaluo.share.renovar`	`ShareController@renovar`	Renew an expired sharing record
`DELETE`	`/avaluo/share/destroy/{id}`	`avaluo.share.destroy`	`ShareController@destroy`	Remove a sharing record
`GET`	`/avaluo/publico/{token}`	`avaluo.publico`	`AvaluoPublicoController@verPublico`	View appraisal via public token (no auth required)

Complete an appraisal

Ensure all steps of the appraisal are finished: vehicle registration, mechanical evaluation, visual inspection, accessories, and image upload. Only completed appraisals should be shared.

Go to the sharing dashboard

Navigate to /avaluo/share. You will see a summary of all appraisals you have shared and all appraisals that have been shared with you, along with statistics for total, active, expired, renewed, and token-linked shares.

Initiate a share

Click the share action on an appraisal. This opens a form that posts to POST /avaluo/share/{id}.

Select users and set the reason

Choose one or more registered users to grant access. Set the motivo field to describe the purpose. To generate a public link, set motivo to exactly "acceso publico" — this triggers automatic token generation.

$token = null;
if ($request->motivo === 'acceso publico') {
    $token = Str::random(40);
}

Set the access window

Provide fecha_inicio and optionally fecha_fin. Leaving fecha_fin empty grants indefinite access. When fecha_fin is in the past at the time of a public-link visit, the estado is automatically updated to vencido and access is denied.

Confirm and share

Submit the form. The controller creates one AvaluoCompartido record per user, skipping duplicates that already have activo or renovado access, and skipping the appraisal owner. A flash message reports exactly how many users were granted access and how many were skipped.

Public Access via Token

When motivo is set to "acceso publico", the system generates a 40-character cryptographically random token using Str::random(40). The resulting public URL is:

/avaluo/publico/{token}

This route is declared outside all authentication middleware groups in routes/web.php, making it fully accessible to unauthenticated visitors:

// routes/web.php — no auth middleware
Route::get('/avaluo/publico/{token}', [AvaluoPublicoController::class, 'verPublico'])
    ->name('avaluo.publico');

The AvaluoPublicoController@verPublico validates the token on every request:

Looks up the AvaluoCompartido record by token — 404 if not found.
Checks that estado is activo or renovado — 403 otherwise.
Checks that fecha_fin is not in the past — if it is, updates estado to vencido and returns 403.
Increments contador_vistas.
Renders the full public appraisal view, including all depreciation factors recalculated live.

if (! in_array($compartido->estado, ['activo', 'renovado'])) {
    abort(403, 'Este enlace ya no está disponible');
}

if ($compartido->fecha_fin && $compartido->fecha_fin->isPast()) {
    $compartido->update(['estado' => 'vencido']);
    abort(403, 'Este enlace ha expirado');
}

$compartido->increment('contador_vistas');

Public token links are accessible without any login. Anyone who obtains the URL can view the full appraisal, including vehicle data, inspection results, images, and the calculated value. Treat these links as sensitive and share them only with intended recipients. Use fecha_fin to limit the exposure window, and revoke access by setting estado to vencido via the update route if a link is compromised.

Each sharing record moves through a defined state machine:

activo ──(fecha_fin reached)──► vencido
  │                                │
  │                                └──(renovar)──► renovado
  │
  └──(manual update)──► vencido / renovado

Estado	Meaning	Access Granted
`activo`	Currently within the access window	✅ Yes
`vencido`	Access window has expired or was manually revoked	❌ No
`renovado`	Previously expired, renewed with a new `fecha_fin`	✅ Yes

Renewal is performed via POST /avaluo/share/renovar/{id}, which sets estado = 'renovado', updates fecha_fin, and refreshes fecha_compartido to now().

Admin vs. Evaluator Views

ShareController@index adapts its response based on the authenticated user’s role. Admin

The compartidos collection passed to the view contains all AvaluoCompartido records across the entire system.
misCompartidos contains only the records for avaluos belonging to the admin’s own vehicles.
compartidosConmigo is empty for admins — admins are not recipients of shared appraisals.
Statistics (total, activos, vencidos, renovados, conToken) are computed over the full compartidos collection.

Evaluator

Mis compartidos (tipo: compartido_por_mi) — appraisals belonging to the evaluator’s own vehicles that they have shared with others.
Compartidos conmigo (tipo: compartido_conmigo) — appraisals owned by other evaluators that have been shared with them (matched by user_id).
Each “shared with me” record is decorated with the propietario (the owning evaluator) for display.

// Evaluator: appraisals shared with me
$compartidosConmigo = AvaluoCompartido::with([...])
    ->where('user_id', $user->id)
    ->orderBy('fecha_compartido', 'desc')
    ->get()
    ->map(function ($item) {
        $item->tipo = 'compartido_conmigo';
        $item->propietario = $item->avaluo->vehiculo->evaluador ?? null;
        return $item;
    });

Statistics Dashboard

The stats array returned to the view provides a quick summary for the sharing dashboard:

Key	Description
`total`	Total sharing records visible to the current user
`activos`	Records with `estado = 'activo'`
`vencidos`	Records with `estado = 'vencido'`
`renovados`	Records with `estado = 'renovado'`
`conToken`	Records that have a non-null `token` (public links)
`misCompartidos`	Count of appraisals shared by the current user
`compartidosConmigo`	Count of appraisals shared with the current user (0 for admins)

Required Permissions

Certain sharing actions are protected by explicit permission checks using Spatie Laravel Permission:

Action	Required Permission
Update sharing settings (`update`)	`update_avaluocompartido`
Renew a sharing (`renovar`)	`update_avaluocompartido`
Delete a sharing (`destroy`)	`delete_avaluocompartido`

if (!Auth::user()->hasPermissionTo('update_avaluocompartido')) {
    return redirect()->back()->with('error', 'No tienes permiso para actualizar el avalúo compartido');
}

The owner of an appraisal cannot share it with themselves. The store action filters out the appraisal owner’s user ID from any submitted user_ids array before creating records. If the owner is the only user selected, the request is rejected with an explanatory error message rather than creating a no-op record.

Introducción

Instalación

Configuración

Características

Administración

Share Vehicle Appraisals with Users and Public Links

The `AvaluoCompartido` Model

Routes

Public Access via Token

Admin vs. Evaluator Views

Statistics Dashboard

Required Permissions

Build docs developers (and LLMs) love

Introducción

Instalación

Configuración

Características

Administración

Documentation Index

​The AvaluoCompartido Model

​Routes

​Sharing Workflow

​Public Access via Token

​Sharing Status Lifecycle

​Admin vs. Evaluator Views

​Statistics Dashboard

​Required Permissions

Build docs developers (and LLMs) love

The `AvaluoCompartido` Model

Routes

Sharing Workflow

Public Access via Token

Sharing Status Lifecycle

Admin vs. Evaluator Views

Statistics Dashboard

Required Permissions