jwed/central-unifi
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Wi-Fi access becomes an explicit per-role allow-list

Browse Source
This commit is contained in:
jwed
2026-08-21 13:13:15 -04:00
parent 655d8dd50c
commit ccd6fc49b2
1 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/Http/Controllers/PortalController.php
View File

@@ -32,7 +32,7 @@ class PortalController extends Controller
{ {
$data = $request->validate([ $data = $request->validate([
'group_name' => 'required|string|max:255', 'group_name' => 'required|string|max:255',
'match_type' => 'required|in:ou,group,email_domain,default', 'match_type' => 'required|in:ou,group,email_domain,role',
'match_value' => 'required|string|max:255', 'match_value' => 'required|string|max:255',
'vlan_id' => 'required|integer|min:1|max:4094', 'vlan_id' => 'required|integer|min:1|max:4094',
'max_devices' => 'required|integer|min:1|max:50', 'max_devices' => 'required|integer|min:1|max:50',
@@ -51,7 +51,7 @@ class PortalController extends Controller
{ {
$data = $request->validate([ $data = $request->validate([
'group_name' => 'required|string|max:255', 'group_name' => 'required|string|max:255',
'match_type' => 'required|in:ou,group,email_domain,default', 'match_type' => 'required|in:ou,group,email_domain,role',
'match_value' => 'required|string|max:255', 'match_value' => 'required|string|max:255',
'vlan_id' => 'required|integer|min:1|max:4094', 'vlan_id' => 'required|integer|min:1|max:4094',
'max_devices' => 'required|integer|min:1|max:50', 'max_devices' => 'required|integer|min:1|max:50',
@@ -256,7 +256,16 @@ class PortalController extends Controller
'email_domain' => str_ends_with($user->email ?? '', '@' . $mapping->match_value), 'email_domain' => str_ends_with($user->email ?? '', '@' . $mapping->match_value),
'group' => $user->groups?->contains('name', $mapping->match_value) ?? false, 'group' => $user->groups?->contains('name', $mapping->match_value) ?? false,
'ou' => str_contains($user->ou ?? '', $mapping->match_value), 'ou' => str_contains($user->ou ?? '', $mapping->match_value),
'default' => true, /*
* Roles are the platform's own authority and need no external
* sync to be correct, which is why quotas key off them.
*
* `default` is deliberately absent. It matched everybody, so its
* existence made this an advisory list rather than an allow-list.
* Returning null here is already the deny path: captiveCallback
* renders "No WiFi access configured for your account."
*/
'role' => $user->hasRole($mapping->match_value),
default => false, default => false,
}; };
if ($matched) return $mapping; if ($matched) return $mapping;