diff --git a/src/Http/Middleware/EnforceUnifiPageGrant.php b/src/Http/Middleware/EnforceUnifiPageGrant.php deleted file mode 100644 index ce6297c..0000000 --- a/src/Http/Middleware/EnforceUnifiPageGrant.php +++ /dev/null @@ -1,51 +0,0 @@ -user() is still null. - */ -class EnforceUnifiPageGrant -{ - public function handle(Request $request, Closure $next): Response - { - $user = $request->user(); - $routeName = $request->route()?->getName(); - - if (! $routeName || ! $user || $user->is_super_admin) { - return $next($request); - } - - try { - $item = NavItem::where('route_name', $routeName)->first(); - if ($item) { - // Permission holders keep access — grants extend, never revoke. - $holdsPermission = $item->required_permission - && UnifiServiceProvider::realPermissionKeysFor($user)->contains($item->required_permission); - - if (! $holdsPermission && ! UnifiPageGrant::userCanAccess($user, $item)) { - // 404 instead of 403 — don't leak that the page exists. - abort(404); - } - } - } catch (\Symfony\Component\HttpKernel\Exception\HttpException $e) { - throw $e; - } catch (\Throwable) { - // unifi_page_grants may not exist yet on first install — fail - // open in that narrow window (permission middleware still - // guards the route). - } - - return $next($request); - } -} diff --git a/src/UnifiServiceProvider.php b/src/UnifiServiceProvider.php index 00deb6d..a2e08d2 100644 --- a/src/UnifiServiceProvider.php +++ b/src/UnifiServiceProvider.php @@ -4,8 +4,6 @@ namespace Dashboard\Unifi; use App\Models\NavItem; use Dashboard\Unifi\Models\UnifiPageGrant; -use Illuminate\Routing\Events\RouteMatched; -use Illuminate\Support\Facades\Event; use Illuminate\Support\ServiceProvider; class UnifiServiceProvider extends ServiceProvider @@ -55,20 +53,6 @@ class UnifiServiceProvider extends ServiceProvider // Sidebar will fall back to legacy permission filter. } - // Per-page enforcement for unifi pages. Settings stays on its - // permission:unifi.settings route middleware (the Access tab - // itself lives there and must not be able to lock itself out). - // The user-dependent check lives in middleware appended to the - // matched route: RouteMatched fires before the session/auth - // middleware run, so request->user() is null here and any check - // at this point silently fails open. - Event::listen(RouteMatched::class, function (RouteMatched $event) { - $routeName = $event->route->getName(); - if (! $routeName || ! str_starts_with($routeName, 'unifi.')) return; - if (str_starts_with($routeName, 'unifi.settings')) return; - - $event->route->middleware(\Dashboard\Unifi\Http\Middleware\EnforceUnifiPageGrant::class); - }); if ($this->app->runningInConsole()) { $this->commands([