From ccd6fc49b28a0ace990d508ffc3218117a70aae7 Mon Sep 17 00:00:00 2001 From: jwed Date: Fri, 21 Aug 2026 13:13:15 -0400 Subject: [PATCH] Wi-Fi access becomes an explicit per-role allow-list --- src/Http/Controllers/PortalController.php | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/src/Http/Controllers/PortalController.php b/src/Http/Controllers/PortalController.php index e1d5d3d..96fdd94 100644 --- a/src/Http/Controllers/PortalController.php +++ b/src/Http/Controllers/PortalController.php @@ -32,7 +32,7 @@ class PortalController extends Controller { $data = $request->validate([ 'group_name' => 'required|string|max:255', - 'match_type' => 'required|in:ou,group,email_domain,default', + 'match_type' => 'required|in:ou,group,email_domain,role', 'match_value' => 'required|string|max:255', 'vlan_id' => 'required|integer|min:1|max:4094', 'max_devices' => 'required|integer|min:1|max:50', @@ -51,7 +51,7 @@ class PortalController extends Controller { $data = $request->validate([ 'group_name' => 'required|string|max:255', - 'match_type' => 'required|in:ou,group,email_domain,default', + 'match_type' => 'required|in:ou,group,email_domain,role', 'match_value' => 'required|string|max:255', 'vlan_id' => 'required|integer|min:1|max:4094', 'max_devices' => 'required|integer|min:1|max:50', @@ -256,7 +256,16 @@ class PortalController extends Controller 'email_domain' => str_ends_with($user->email ?? '', '@' . $mapping->match_value), 'group' => $user->groups?->contains('name', $mapping->match_value) ?? false, 'ou' => str_contains($user->ou ?? '', $mapping->match_value), - 'default' => true, + /* + * Roles are the platform's own authority and need no external + * sync to be correct, which is why quotas key off them. + * + * `default` is deliberately absent. It matched everybody, so its + * existence made this an advisory list rather than an allow-list. + * Returning null here is already the deny path: captiveCallback + * renders "No WiFi access configured for your account." + */ + 'role' => $user->hasRole($mapping->match_value), default => false, }; if ($matched) return $mapping;