From cac6179ad464ba4a343bbeeaad53b20e31341c8f Mon Sep 17 00:00:00 2001 From: Ryan Scherler Date: Mon, 6 Apr 2020 16:07:07 -0700 Subject: [PATCH] field level permissions via ->enable() method. --- database/data/permissions.php | 2 +- resources/views/components/fields.blade.php | 14 +++++---- routes/api.php | 4 +-- routes/web.php | 6 ++-- src/Http/Controllers/ImageController.php | 1 - src/Http/Controllers/UserController.php | 1 - src/Http/Fieldsets/UserEditFieldset.php | 6 ++-- src/Http/Livewire/UserEdit.php | 11 +++++-- src/Policies/PermissionPolicy.php | 35 +++++++++++++++++++++ src/Support/Fields/BaseField.php | 7 +++++ 10 files changed, 69 insertions(+), 18 deletions(-) create mode 100644 src/Policies/PermissionPolicy.php diff --git a/database/data/permissions.php b/database/data/permissions.php index e8cd71ed6a..8af613c7b7 100644 --- a/database/data/permissions.php +++ b/database/data/permissions.php @@ -31,7 +31,7 @@ return [ ], [ - 'name' => 'edit user permissions', + 'name' => 'edit user roles', 'guard_name' => 'web', 'is_system' => 1, ], diff --git a/resources/views/components/fields.blade.php b/resources/views/components/fields.blade.php index 7e4cd6bd5a..9796376c06 100644 --- a/resources/views/components/fields.blade.php +++ b/resources/views/components/fields.blade.php @@ -1,11 +1,13 @@
@foreach ($fields as $field) - @if ($group) - @if ($group === $field->group) + @if ($field->enabled) + @if ($group) + @if ($group === $field->group) + @include($field->getView()) + @endif + @else @include($field->getView()) - @endif - @else - @include($field->getView()) - @endisset + @endisset + @endif @endforeach
diff --git a/routes/api.php b/routes/api.php index 574abd8340..899d5be255 100644 --- a/routes/api.php +++ b/routes/api.php @@ -14,10 +14,10 @@ use Illuminate\Http\Request; | */ -// protected routes... +// Authenticated routes... Route::middleware('auth.filament:api')->group(function () { - // curl -H "Accept: application/json" -X GET http://localhost:8000/cp/api/user + // curl -H "Accept: application/json" -X GET http://127.0.0.1:8000/filament/api/user Route::get('/user', function (Request $request) { return $request->user(); }); diff --git a/routes/web.php b/routes/web.php index da8d3a8ec2..eebb8aec2b 100644 --- a/routes/web.php +++ b/routes/web.php @@ -13,7 +13,7 @@ use Illuminate\Support\Facades\Route; | */ -// asset routes... +// Asset routes... Route::name('assets.')->group(function () { Route::get('filament.css', 'AssetController@css')->name('css'); @@ -21,7 +21,7 @@ Route::name('assets.')->group(function () { }); -// authentication routes... +// Authentication routes... Route::name('auth.')->namespace('Auth')->group(function () { Route::get('login', 'LoginController@showLoginForm')->name('login'); @@ -37,7 +37,7 @@ Route::name('auth.')->namespace('Auth')->group(function () { }); -// protected admin routes... +// Authenticated routes... Route::name('admin.')->middleware('auth.filament')->group(function () { Route::get('/', 'DashboardController')->name('dashboard'); diff --git a/src/Http/Controllers/ImageController.php b/src/Http/Controllers/ImageController.php index 05138d2987..25218e6206 100644 --- a/src/Http/Controllers/ImageController.php +++ b/src/Http/Controllers/ImageController.php @@ -18,7 +18,6 @@ class ImageController extends Controller */ public function __invoke($path) { - try { // Validate HTTP signature SignatureFactory::create(config('app.key'))->validateRequest($path, request()->all()); diff --git a/src/Http/Controllers/UserController.php b/src/Http/Controllers/UserController.php index 95689cecc9..e623107289 100644 --- a/src/Http/Controllers/UserController.php +++ b/src/Http/Controllers/UserController.php @@ -7,7 +7,6 @@ use Illuminate\Support\Str; class UserController extends Controller { - /** * Show the users. * diff --git a/src/Http/Fieldsets/UserEditFieldset.php b/src/Http/Fieldsets/UserEditFieldset.php index 44bb04d9d6..090e50de04 100644 --- a/src/Http/Fieldsets/UserEditFieldset.php +++ b/src/Http/Fieldsets/UserEditFieldset.php @@ -54,7 +54,8 @@ class UserEditFieldset implements Fieldset Field::make('filament::permissions.super_admin', 'is_super_admin') ->checkbox() ->help(__('filament::permissions.super_admin_info')) - ->group('permissions'), + ->group('permissions') + ->enabled(auth()->user()->is_super_admin), Field::make('filament::permissions.roles', 'roles') ->checkboxes(app(RoleContract::class)::orderBy('name') ->pluck('id', 'name') @@ -63,7 +64,8 @@ class UserEditFieldset implements Fieldset ->pluck('id') ->all())) ->rules([Rule::exists('roles', 'id')]) - ->group('permissions'), + ->group('permissions') + ->enabled(auth()->user()->can('edit user roles')), ]; } diff --git a/src/Http/Livewire/UserEdit.php b/src/Http/Livewire/UserEdit.php index 7af51fddc7..ce94c4d719 100644 --- a/src/Http/Livewire/UserEdit.php +++ b/src/Http/Livewire/UserEdit.php @@ -10,12 +10,19 @@ class UserEdit extends FormComponent { $input = collect($this->form_data); + if (!auth()->user()->is_super_admin) { + $input->forget('is_super_admin'); + } + if (is_null($input->get('password'))) { $input->forget('password'); } - + $this->model->update($input->all()); - $this->model->syncRoles($input->get('roles')); + + if (auth()->user()->can('edit user roles')) { + $this->model->syncRoles($input->get('roles')); + } $this->emit('filament.notification.notify', [ 'type' => 'success', diff --git a/src/Policies/PermissionPolicy.php b/src/Policies/PermissionPolicy.php new file mode 100644 index 0000000000..95b1826eb9 --- /dev/null +++ b/src/Policies/PermissionPolicy.php @@ -0,0 +1,35 @@ +can('view permissions') + ? Response::allow() + : Response::deny(__('You are not allowed to view permissions.')); + } + + /** + * Determine if the authenticated user can update a user. + * + * @param User $authenticated + * @return bool + */ + public function edit($authenticated): Response + { + return $authenticated->can('edit permissions') + ? Response::allow() + : Response::deny(__('You are not allowed to edit permissions.')); + } +} \ No newline at end of file diff --git a/src/Support/Fields/BaseField.php b/src/Support/Fields/BaseField.php index 7491756006..dd315f9d47 100644 --- a/src/Support/Fields/BaseField.php +++ b/src/Support/Fields/BaseField.php @@ -24,6 +24,7 @@ class BaseField protected $file_rules = ['file']; protected $file_validation_messages = ['file' => 'Must be a valid file.']; protected $disabled = false; + protected $enabled = true; public function __get($property) { @@ -83,6 +84,12 @@ class BaseField return $this; } + public function enabled($enabled) + { + $this->enabled = (bool) $enabled; + return $this; + } + public function fileRules($rules) { $this->file_rules = (array) $rules;