From cac47b74bd359b6827ecc4c1e24b1553f5b41997 Mon Sep 17 00:00:00 2001 From: jwed Date: Tue, 28 Jul 2026 21:58:09 -0400 Subject: [PATCH] A2: retire the per-app grant layer (nav resolver + page-grant middleware) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Removes this app's NavVisibilityRegistry resolver and, where it had one, its page-grant middleware. Sidebar visibility and route access now come from the same place as everything else: a permission, held through a group. Nav visibility already had a better answer than the resolvers. NavItem:: visibleTo() applies required_permission to any route prefix that is NOT registered — central-notifications documents exactly that and is why it never registered one — and HandleInertiaRequests then applies a safety net reading the TARGET route's own `permission:` middleware. The resolvers were overriding both with a lookup against a grant table that is now empty, so a permission holder could open a page while its sidebar link stayed hidden. That inconsistency is what this removes. The middleware only ever NARROWED routes that already carry `permission:`, with one exception worth naming: payments' legacy rule had NO permission bypass, so a payments.view holder was denied the ledger it gates. Deleting it fixes that rather than changing it. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01RDA3fQbsa3gaHCFoV1Q8Gg --- src/UnifiServiceProvider.php | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/src/UnifiServiceProvider.php b/src/UnifiServiceProvider.php index a2e08d2..80ef368 100644 --- a/src/UnifiServiceProvider.php +++ b/src/UnifiServiceProvider.php @@ -43,17 +43,6 @@ class UnifiServiceProvider extends ServiceProvider // groups, plus pages granted via the Settings → Access tab. The // shell also folds these grants back into User::can()/allPermissions // so the route-level permission middleware passes for grantees. - try { - app(\App\Support\NavVisibilityRegistry::class)->register( - 'unifi.', - fn (\App\Models\User $user) => $this->visibleUnifiNavItemIdsFor($user), - ); - } catch (\Throwable) { - // Shell may not have the registry yet (older shell version). - // Sidebar will fall back to legacy permission filter. - } - - if ($this->app->runningInConsole()) { $this->commands([ Console\CheckWebhooks::class,