feat(1.13.0): page grants on the standard admissions-style pattern
unifi_page_grants gains role + default grantee types and can_view (deny-by-default "Everyone else" row); enforcement moves from the RouteMatched listener — where request->user() is always null and the check silently failed open — into route-appended middleware with the permission-holder pass. Pages-access endpoints gain role search + default-row handling. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
@@ -5,6 +5,7 @@ namespace Dashboard\Unifi\Http\Controllers;
|
||||
use App\Models\DashboardApp;
|
||||
use App\Models\Group;
|
||||
use App\Models\NavItem;
|
||||
use App\Models\Role;
|
||||
use App\Models\User;
|
||||
use Dashboard\Unifi\Models\UnifiPageGrant;
|
||||
use Illuminate\Http\Request;
|
||||
@@ -21,7 +22,7 @@ class UnifiPagesAccessController extends Controller
|
||||
{
|
||||
$app = DashboardApp::where('slug', 'unifi')->first();
|
||||
if (! $app) {
|
||||
return response()->json(['pages' => [], 'users' => [], 'groups' => []]);
|
||||
return response()->json(['pages' => [], 'users' => [], 'groups' => [], 'roles' => []]);
|
||||
}
|
||||
|
||||
$pages = NavItem::where('app_id', $app->id)
|
||||
@@ -49,16 +50,27 @@ class UnifiPagesAccessController extends Controller
|
||||
->orWhereIn('id', $grantedGroupIds);
|
||||
})->orderBy('name')->get(['id', 'name', 'is_super']);
|
||||
|
||||
// Roles: only ones with at least one grant — more added via searchRoles.
|
||||
$grantedRoleIds = $grants->flatten(1)->where('grantee_type', 'role')->pluck('grantee_id')->unique();
|
||||
$roles = Role::whereIn('id', $grantedRoleIds)->orderBy('label')->get(['id', 'slug', 'label']);
|
||||
|
||||
return response()->json([
|
||||
'pages' => $pages->map(fn ($p) => [
|
||||
'id' => $p->id,
|
||||
'label' => $p->label,
|
||||
'route_name' => $p->route_name,
|
||||
'user_ids' => $grants->get($p->id, collect())->where('grantee_type', 'user')->pluck('grantee_id')->all(),
|
||||
'group_ids' => $grants->get($p->id, collect())->where('grantee_type', 'group')->pluck('grantee_id')->all(),
|
||||
])->values(),
|
||||
'pages' => $pages->map(function ($p) use ($grants) {
|
||||
$pageGrants = $grants->get($p->id, collect());
|
||||
$defaultRow = $pageGrants->firstWhere('grantee_type', 'default');
|
||||
return [
|
||||
'id' => $p->id,
|
||||
'label' => $p->label,
|
||||
'route_name' => $p->route_name,
|
||||
'default_allow' => (bool) ($defaultRow?->can_view ?? false),
|
||||
'user_ids' => $pageGrants->where('grantee_type', 'user')->where('can_view', true)->pluck('grantee_id')->values()->all(),
|
||||
'group_ids' => $pageGrants->where('grantee_type', 'group')->where('can_view', true)->pluck('grantee_id')->values()->all(),
|
||||
'role_ids' => $pageGrants->where('grantee_type', 'role')->where('can_view', true)->pluck('grantee_id')->values()->all(),
|
||||
];
|
||||
})->values(),
|
||||
'users' => $users,
|
||||
'groups' => $groups,
|
||||
'roles' => $roles,
|
||||
]);
|
||||
}
|
||||
|
||||
@@ -106,6 +118,26 @@ class UnifiPagesAccessController extends Controller
|
||||
return response()->json(['groups' => $groups]);
|
||||
}
|
||||
|
||||
/**
|
||||
* Typeahead-style search for roles to add to the access matrix.
|
||||
* An empty query returns every role (the role list is small).
|
||||
*/
|
||||
public function searchRoles(Request $request)
|
||||
{
|
||||
$q = trim((string) $request->query('q', ''));
|
||||
if (strlen($q) < 1) {
|
||||
return response()->json(['roles' => Role::orderBy('label')->get(['id', 'slug', 'label'])]);
|
||||
}
|
||||
|
||||
$roles = Role::where('label', 'like', '%' . $q . '%')
|
||||
->orWhere('slug', 'like', '%' . $q . '%')
|
||||
->orderBy('label')
|
||||
->limit(20)
|
||||
->get(['id', 'slug', 'label']);
|
||||
|
||||
return response()->json(['roles' => $roles]);
|
||||
}
|
||||
|
||||
public function update(Request $request, NavItem $navItem)
|
||||
{
|
||||
$app = DashboardApp::where('slug', 'unifi')->first();
|
||||
@@ -114,28 +146,62 @@ class UnifiPagesAccessController extends Controller
|
||||
}
|
||||
|
||||
$data = $request->validate([
|
||||
'user_ids' => 'present|array',
|
||||
'user_ids.*' => 'integer|exists:users,id',
|
||||
'group_ids' => 'present|array',
|
||||
'group_ids.*' => 'integer|exists:groups,id',
|
||||
'default_allow' => 'boolean',
|
||||
'user_ids' => 'present|array',
|
||||
'user_ids.*' => 'integer|exists:users,id',
|
||||
'group_ids' => 'present|array',
|
||||
'group_ids.*' => 'integer|exists:groups,id',
|
||||
'role_ids' => 'array',
|
||||
'role_ids.*' => 'integer|exists:roles,id',
|
||||
]);
|
||||
|
||||
$grantedBy = $request->user()?->id;
|
||||
|
||||
DB::transaction(function () use ($navItem, $data, $grantedBy) {
|
||||
UnifiPageGrant::where('nav_item_id', $navItem->id)->delete();
|
||||
// Upsert the default row (one per nav_item). firstOrCreate can't
|
||||
// match on grantee_id=NULL reliably in MySQL, so look it up first.
|
||||
$default = UnifiPageGrant::where('nav_item_id', $navItem->id)
|
||||
->where('grantee_type', 'default')
|
||||
->first();
|
||||
if ($default) {
|
||||
$default->update(['can_view' => (bool) ($data['default_allow'] ?? false)]);
|
||||
} else {
|
||||
UnifiPageGrant::create([
|
||||
'nav_item_id' => $navItem->id,
|
||||
'grantee_type' => 'default',
|
||||
'grantee_id' => null,
|
||||
'can_view' => (bool) ($data['default_allow'] ?? false),
|
||||
'granted_by_user_id' => $grantedBy,
|
||||
]);
|
||||
}
|
||||
|
||||
$rows = [];
|
||||
$now = now();
|
||||
foreach ($data['user_ids'] as $uid) {
|
||||
$rows[] = ['nav_item_id' => $navItem->id, 'grantee_type' => 'user', 'grantee_id' => $uid, 'granted_by_user_id' => $grantedBy, 'created_at' => $now, 'updated_at' => $now];
|
||||
}
|
||||
foreach ($data['group_ids'] as $gid) {
|
||||
$rows[] = ['nav_item_id' => $navItem->id, 'grantee_type' => 'group', 'grantee_id' => $gid, 'granted_by_user_id' => $grantedBy, 'created_at' => $now, 'updated_at' => $now];
|
||||
}
|
||||
if ($rows) UnifiPageGrant::insert($rows);
|
||||
$this->syncGrantsOfType($navItem->id, 'user', $data['user_ids'] ?? [], $grantedBy);
|
||||
$this->syncGrantsOfType($navItem->id, 'group', $data['group_ids'] ?? [], $grantedBy);
|
||||
$this->syncGrantsOfType($navItem->id, 'role', $data['role_ids'] ?? [], $grantedBy);
|
||||
});
|
||||
|
||||
return response()->json(['ok' => true]);
|
||||
}
|
||||
|
||||
private function syncGrantsOfType(int $navItemId, string $type, array $ids, ?int $actorId): void
|
||||
{
|
||||
UnifiPageGrant::where('nav_item_id', $navItemId)
|
||||
->where('grantee_type', $type)
|
||||
->whereNotIn('grantee_id', $ids ?: [0])
|
||||
->delete();
|
||||
|
||||
foreach ($ids as $id) {
|
||||
UnifiPageGrant::updateOrCreate(
|
||||
[
|
||||
'nav_item_id' => $navItemId,
|
||||
'grantee_type' => $type,
|
||||
'grantee_id' => $id,
|
||||
],
|
||||
[
|
||||
'can_view' => true,
|
||||
'granted_by_user_id' => $actorId,
|
||||
],
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user