jwed/central-unifi
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Remove the page-access matrix: routes, controller methods, model

Browse Source 
The last of the hand-rolled Access tabs. Its UI went in the previous commit; this
removes what sat behind it — the five settings/pages-access routes, the controller
methods serving them, the grant model, and the orphaned nav-visibility resolver that
read it. The table itself is dropped by a shell migration.

Nothing consulted any of it. Page access is a permission held through a group.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RDA3fQbsa3gaHCFoV1Q8Gg
This commit is contained in:
jwed
2026-07-29 14:31:07 -04:00
parent cac47b74bd
commit c93f73ce02
4 changed files with 0 additions and 316 deletions
Download Patch File Download Diff File Expand all files Collapse all files

207
src/Http/Controllers/UnifiPagesAccessController.php
View File

@@ -1,207 +0,0 @@
<?php
namespace Dashboard\Unifi\Http\Controllers;
use App\Models\DashboardApp;
use App\Models\Group;
use App\Models\NavItem;
use App\Models\Role;
use App\Models\User;
use Dashboard\Unifi\Models\UnifiPageGrant;
use Illuminate\Http\Request;
use Illuminate\Routing\Controller;
use Illuminate\Support\Facades\DB;
/**
* Super-admin-only endpoints for managing per-page access on unifi
* pages. Pages here = nav_items where app_id = unifi's DashboardApp row.
*/
class UnifiPagesAccessController extends Controller
{
public function index()
{
$app = DashboardApp::where('slug', 'unifi')->first();
if (! $app) {
return response()->json(['pages' => [], 'users' => [], 'groups' => [], 'roles' => []]);
}
$pages = NavItem::where('app_id', $app->id)
->where('is_folder', false)
->whereNotNull('route_name')
->orderBy('sort_order')
->get(['id', 'label', 'route_name']);
$grants = UnifiPageGrant::whereIn('nav_item_id', $pages->pluck('id'))
->get()
->groupBy('nav_item_id');
// Only return users that ALREADY have grants. The full users list
// can be enormous (thousands of rows); the operator adds more via
// the searchUsers endpoint as needed.
$grantedUserIds = $grants->flatten(1)->where('grantee_type', 'user')->pluck('grantee_id')->unique();
$users = User::whereIn('id', $grantedUserIds)->orderBy('name')->get(['id', 'name', 'email']);
// Groups: always include super-admin groups (locked-on across all
// pages) plus any group with at least one grant. Other groups are
// added via searchGroups.
$grantedGroupIds = $grants->flatten(1)->where('grantee_type', 'group')->pluck('grantee_id')->unique();
$groups = Group::where(function ($q) use ($grantedGroupIds) {
$q->where('is_super', true)
->orWhereIn('id', $grantedGroupIds);
})->orderBy('name')->get(['id', 'name', 'is_super']);
// Roles: only ones with at least one grant — more added via searchRoles.
$grantedRoleIds = $grants->flatten(1)->where('grantee_type', 'role')->pluck('grantee_id')->unique();
$roles = Role::whereIn('id', $grantedRoleIds)->orderBy('label')->get(['id', 'slug', 'label']);
return response()->json([
'pages' => $pages->map(function ($p) use ($grants) {
$pageGrants = $grants->get($p->id, collect());
$defaultRow = $pageGrants->firstWhere('grantee_type', 'default');
return [
'id' => $p->id,
'label' => $p->label,
'route_name' => $p->route_name,
'default_allow' => (bool) ($defaultRow?->can_view ?? false),
'user_ids' => $pageGrants->where('grantee_type', 'user')->where('can_view', true)->pluck('grantee_id')->values()->all(),
'group_ids' => $pageGrants->where('grantee_type', 'group')->where('can_view', true)->pluck('grantee_id')->values()->all(),
'role_ids' => $pageGrants->where('grantee_type', 'role')->where('can_view', true)->pluck('grantee_id')->values()->all(),
];
})->values(),
'users' => $users,
'groups' => $groups,
'roles' => $roles,
]);
}
/**
* Typeahead-style search for users to add to the access matrix.
* Returns up to 20 matches against name or email. Empty query returns
* an empty array — caller must enter at least 2 chars.
*/
public function searchUsers(Request $request)
{
$q = trim((string) $request->query('q', ''));
if (strlen($q) < 2) {
return response()->json(['users' => []]);
}
$users = User::where(function ($w) use ($q) {
$w->where('name', 'like', '%' . $q . '%')
->orWhere('email', 'like', '%' . $q . '%');
})
->orderBy('name')
->limit(20)
->get(['id', 'name', 'email']);
return response()->json(['users' => $users]);
}
/**
* Typeahead-style search for groups to add to the access matrix.
* Excludes super-admin groups (they're already in the matrix and
* locked-on across every page).
*/
public function searchGroups(Request $request)
{
$q = trim((string) $request->query('q', ''));
if (strlen($q) < 2) {
return response()->json(['groups' => []]);
}
$groups = Group::where('name', 'like', '%' . $q . '%')
->where(function ($w) { $w->where('is_super', false)->orWhereNull('is_super'); })
->orderBy('name')
->limit(20)
->get(['id', 'name', 'is_super']);
return response()->json(['groups' => $groups]);
}
/**
* Typeahead-style search for roles to add to the access matrix.
* An empty query returns every role (the role list is small).
*/
public function searchRoles(Request $request)
{
$q = trim((string) $request->query('q', ''));
if (strlen($q) < 1) {
return response()->json(['roles' => Role::orderBy('label')->get(['id', 'slug', 'label'])]);
}
$roles = Role::where('label', 'like', '%' . $q . '%')
->orWhere('slug', 'like', '%' . $q . '%')
->orderBy('label')
->limit(20)
->get(['id', 'slug', 'label']);
return response()->json(['roles' => $roles]);
}
public function update(Request $request, NavItem $navItem)
{
$app = DashboardApp::where('slug', 'unifi')->first();
if (! $app || $navItem->app_id !== $app->id) {
return response()->json(['error' => 'Not a unifi page.'], 422);
}
$data = $request->validate([
'default_allow' => 'boolean',
'user_ids' => 'present|array',
'user_ids.*' => 'integer|exists:users,id',
'group_ids' => 'present|array',
'group_ids.*' => 'integer|exists:groups,id',
'role_ids' => 'array',
'role_ids.*' => 'integer|exists:roles,id',
]);
$grantedBy = $request->user()?->id;
DB::transaction(function () use ($navItem, $data, $grantedBy) {
// Upsert the default row (one per nav_item). firstOrCreate can't
// match on grantee_id=NULL reliably in MySQL, so look it up first.
$default = UnifiPageGrant::where('nav_item_id', $navItem->id)
->where('grantee_type', 'default')
->first();
if ($default) {
$default->update(['can_view' => (bool) ($data['default_allow'] ?? false)]);
} else {
UnifiPageGrant::create([
'nav_item_id' => $navItem->id,
'grantee_type' => 'default',
'grantee_id' => null,
'can_view' => (bool) ($data['default_allow'] ?? false),
'granted_by_user_id' => $grantedBy,
]);
}
$this->syncGrantsOfType($navItem->id, 'user', $data['user_ids'] ?? [], $grantedBy);
$this->syncGrantsOfType($navItem->id, 'group', $data['group_ids'] ?? [], $grantedBy);
$this->syncGrantsOfType($navItem->id, 'role', $data['role_ids'] ?? [], $grantedBy);
});
return response()->json(['ok' => true]);
}
private function syncGrantsOfType(int $navItemId, string $type, array $ids, ?int $actorId): void
{
UnifiPageGrant::where('nav_item_id', $navItemId)
->where('grantee_type', $type)
->whereNotIn('grantee_id', $ids ?: [0])
->delete();
foreach ($ids as $id) {
UnifiPageGrant::updateOrCreate(
[
'nav_item_id' => $navItemId,
'grantee_type' => $type,
'grantee_id' => $id,
],
[
'can_view' => true,
'granted_by_user_id' => $actorId,
],
);
}
}
}