diff --git a/database/data/permissions.php b/database/data/permissions.php index da7fee6392..1183255a3a 100644 --- a/database/data/permissions.php +++ b/database/data/permissions.php @@ -33,6 +33,13 @@ return [ 'is_system' => 1, ], + [ + 'name' => 'delete users', + 'description' => 'Allow a user to delete users.', + 'guard_name' => 'web', + 'is_system' => 1, + ], + [ 'name' => 'edit user roles', 'description' => 'Allow a user to edit user roles.', @@ -47,6 +54,13 @@ return [ 'is_system' => 1, ], + [ + 'name' => 'edit roles', + 'description' => 'Allow a user to edit roles.', + 'guard_name' => 'web', + 'is_system' => 1, + ], + [ 'name' => 'create roles', 'description' => 'Allow a user to create roles.', @@ -54,6 +68,13 @@ return [ 'is_system' => 1, ], + [ + 'name' => 'delete roles', + 'description' => 'Allow a user to delete roles.', + 'guard_name' => 'web', + 'is_system' => 1, + ], + [ 'name' => 'view permissions', 'description' => 'Allow a user to view permissions.', @@ -61,6 +82,13 @@ return [ 'is_system' => 1, ], + [ + 'name' => 'edit permissions', + 'description' => 'Allow a user to edit permissions.', + 'guard_name' => 'web', + 'is_system' => 1, + ], + [ 'name' => 'create permissions', 'description' => 'Allow a user to create permissions.', @@ -68,4 +96,11 @@ return [ 'is_system' => 1, ], + [ + 'name' => 'delete permissions', + 'description' => 'Allow a user to delete permissions.', + 'guard_name' => 'web', + 'is_system' => 1, + ], + ]; \ No newline at end of file diff --git a/resources/lang/en/permissions.php b/resources/lang/en/permissions.php index faaa29c7ae..ba079d40e3 100644 --- a/resources/lang/en/permissions.php +++ b/resources/lang/en/permissions.php @@ -12,7 +12,7 @@ return [ | */ - 'super_admin' => 'Super admin', + 'super_admin' => 'super admin', 'super_admin_info' => 'Super admins supersede all assigned roles and permissions.', diff --git a/resources/views/livewire/roles/edit.blade.php b/resources/views/livewire/roles/edit.blade.php index b0af7ec17f..16b5e155bc 100644 --- a/resources/views/livewire/roles/edit.blade.php +++ b/resources/views/livewire/roles/edit.blade.php @@ -1,7 +1,7 @@
\ No newline at end of file diff --git a/src/Http/Fieldsets/RoleEditFieldset.php b/src/Http/Fieldsets/RoleEditFieldset.php new file mode 100644 index 0000000000..012112eb12 --- /dev/null +++ b/src/Http/Fieldsets/RoleEditFieldset.php @@ -0,0 +1,38 @@ +input() + ->rules([ + 'required', + 'string', + 'max:255', + Rule::unique('roles', 'name')->ignore($model->id), + ]), + Field::make('Description') + ->textarea() + ->rules(['string']) + ]; + } + + public static function rulesIgnoreRealtime(): array + { + return []; + } +} \ No newline at end of file diff --git a/src/Http/Fieldsets/UserEditFieldset.php b/src/Http/Fieldsets/UserEditFieldset.php index 1783c16a2a..443b3c9419 100644 --- a/src/Http/Fieldsets/UserEditFieldset.php +++ b/src/Http/Fieldsets/UserEditFieldset.php @@ -5,7 +5,7 @@ namespace Filament\Http\Fieldsets; use Filament\Contracts\Fieldset; use Filament\Support\Fields\Field; use Illuminate\Validation\Rule; -use Spatie\Permission\Contracts\Role as RoleContract; +use Filament\Models\Role; class UserEditFieldset implements Fieldset { @@ -57,7 +57,7 @@ class UserEditFieldset implements Fieldset ->group('permissions') ->disabled(!auth()->user()->is_super_admin), Field::make('filament::permissions.roles', 'roles') - ->checkboxes(app(RoleContract::class)::orderBy('name') + ->checkboxes(Role::orderBy('name') ->pluck('id', 'name') ->all()) ->default(array_map('strval', $model->roles diff --git a/src/Http/Livewire/RoleEdit.php b/src/Http/Livewire/RoleEdit.php index b5f4db2a7a..2faf15b5cd 100644 --- a/src/Http/Livewire/RoleEdit.php +++ b/src/Http/Livewire/RoleEdit.php @@ -18,15 +18,10 @@ class RoleEdit extends FormComponent public function success() { - $input = collect($this->form_data); - $this->model->update($input->all()); + $this->model->update($this->form_data); + $this->emit('filament.roleUpdated', $this->model); $this->emit('filament.toggleModal', $this->model->id); - - $this->emit('filament.notification.notify', [ - 'type' => 'success', - 'message' => __('filament::notifications.updated', ['item' => $this->model->name]), - ]); } public function render() diff --git a/src/Http/Livewire/Roles.php b/src/Http/Livewire/Roles.php index cbea99a227..af29430e09 100644 --- a/src/Http/Livewire/Roles.php +++ b/src/Http/Livewire/Roles.php @@ -12,6 +12,18 @@ class Roles extends Component { use AuthorizesRequests, WithDataTable; + protected $listeners = ['filament.roleUpdated' => 'showRoleUpdatedNotification']; + + public function showRoleUpdatedNotification($role) + { + $this->emit('filament.notification.notify', [ + 'type' => 'success', + 'message' => __('filament::notifications.updated', ['item' => $role['name']]), + ]); + + $this->render(); + } + public function render() { $this->authorize('view', Role::class); diff --git a/src/Policies/PermissionPolicy.php b/src/Policies/PermissionPolicy.php index ef6ce3908c..5571afa240 100644 --- a/src/Policies/PermissionPolicy.php +++ b/src/Policies/PermissionPolicy.php @@ -23,12 +23,40 @@ class PermissionPolicy * Determine if the authenticated user can edit a permission. * * @param User $authenticated + * @param Permission $permission * @return bool */ - public function edit($authenticated): Response + public function edit($authenticated, $permission): Response { - return $authenticated->can('edit permissions') + return !$permission->is_system && $authenticated->can('edit permissions') ? Response::allow() : Response::deny(__('You are not allowed to edit permissions.')); } + + /** + * Determine if the authenticated user can create a permission. + * + * @param User $authenticated + * @return bool + */ + public function create($authenticated): Response + { + return $authenticated->can('create permissions') + ? Response::allow() + : Response::deny(__('You are not allowed to create a permission.')); + } + + /** + * Determine if the authenticated user can delete a permission. + * + * @param User $authenticated + * @param Permission $permission + * @return bool + */ + public function delete($authenticated, $permission): Response + { + return !$permission->is_system && $authenticated->can('delete permissions') + ? Response::allow() + : Response::deny(__('You are not allowed to delete permissions.')); + } } \ No newline at end of file diff --git a/src/Policies/RolePolicy.php b/src/Policies/RolePolicy.php index 113ef330a2..7890cba681 100644 --- a/src/Policies/RolePolicy.php +++ b/src/Policies/RolePolicy.php @@ -4,7 +4,7 @@ namespace Filament\Policies; use Illuminate\Auth\Access\Response; -class RolePolicy +class RolePolicy { /** * Determine if the authenticated user can view roles. @@ -23,12 +23,40 @@ class RolePolicy * Determine if the authenticated user can edit a role. * * @param User $authenticated + * @param Role $role * @return bool */ - public function edit($authenticated): Response + public function edit($authenticated, $role): Response { - return $authenticated->can('edit roles') + return !$role->is_system && $authenticated->can('edit roles') ? Response::allow() : Response::deny(__('You are not allowed to edit roles.')); } + + /** + * Determine if the authenticated user can create a role. + * + * @param User $authenticated + * @return bool + */ + public function create($authenticated): Response + { + return $authenticated->can('create roles') + ? Response::allow() + : Response::deny(__('You are not allowed to create a role.')); + } + + /** + * Determine if the authenticated user can delete a role. + * + * @param User $authenticated + * @param Role $role + * @return bool + */ + public function delete($authenticated, $role): Response + { + return !$role->is_system && $authenticated->can('delete roles') + ? Response::allow() + : Response::deny(__('You are not allowed to delete roles.')); + } } \ No newline at end of file diff --git a/src/Policies/UserPolicy.php b/src/Policies/UserPolicy.php index ee2682cbdb..c8c1b64b21 100644 --- a/src/Policies/UserPolicy.php +++ b/src/Policies/UserPolicy.php @@ -37,4 +37,36 @@ class UserPolicy ? Response::allow() : Response::deny(__('You are not allowed to edit other users.')); } + + /** + * Determine if the authenticated user can create users. + * + * @param User $authenticated + * @param User $user + * @return bool + */ + public function create($authenticated): Response + { + return $authenticated->can('create users') + ? Response::allow() + : Response::deny(__('You are not allowed to create users.')); + } + + /** + * Determine if the authenticated user can delete a user. + * + * @param User $authenticated + * @param User $user + * @return bool + */ + public function delete($authenticated, $user): Response + { + if ($authenticated->can('delete users')) { + return Response::allow(); + } + + return $authenticated->id === $user->id + ? Response::allow() + : Response::deny(__('You are not allowed to delete other users.')); + } } \ No newline at end of file