From fcf4684ca91c622d56742cea4f901316e3410f86 Mon Sep 17 00:00:00 2001 From: Tomasz Boruc Date: Fri, 4 Sep 2026 22:09:18 +0200 Subject: [PATCH] Poprawki w rolach Extended view widzi wszystko --- app/Http/Controllers/AdvanceController.php | 16 +++++----- app/Http/Controllers/DashboardController.php | 2 +- app/Http/Controllers/UserController.php | 18 +++++++++++ app/Http/Controllers/VehicleController.php | 23 ++++++++++--- app/Http/Requests/StoreAdvanceRequest.php | 2 +- ...3_rename_show_all_dashboard_permission.php | 32 +++++++++++++++++++ database/seeders/DatabaseSeeder.php | 4 +-- tests/Feature/AdvanceTest.php | 7 ++-- tests/Feature/UserSoftDeleteTest.php | 9 ++++-- tests/Feature/VehicleTest.php | 7 ++-- 10 files changed, 95 insertions(+), 25 deletions(-) create mode 100644 database/migrations/2026_09_04_000003_rename_show_all_dashboard_permission.php diff --git a/app/Http/Controllers/AdvanceController.php b/app/Http/Controllers/AdvanceController.php index 558b5e9..cffc4e7 100644 --- a/app/Http/Controllers/AdvanceController.php +++ b/app/Http/Controllers/AdvanceController.php @@ -14,7 +14,7 @@ class AdvanceController extends Controller { $query = Advance::with(['user', 'type']); - if ($request->user()->hasRole('pracownik')) { + if (! $request->user()->can('extended_view')) { $query->where('user_id', $request->user()->id); } @@ -52,9 +52,9 @@ class AdvanceController extends Controller public function create() { $types = AdvanceType::orderBy('name')->get(); - $users = request()->user()->hasRole('pracownik') - ? collect() - : User::orderBy('name')->orderBy('surname')->get(); + $users = request()->user()->can('extended_view') + ? User::orderBy('name')->orderBy('surname')->get() + : collect([request()->user()]); return view('zaliczki.create', compact('types', 'users')); } @@ -75,9 +75,9 @@ class AdvanceController extends Controller { $this->authorizeAccess($request, $advance); $types = AdvanceType::orderBy('name')->get(); - $users = $request->user()->hasRole('pracownik') - ? collect() - : User::orderBy('name')->orderBy('surname')->get(); + $users = $request->user()->can('extended_view') + ? User::orderBy('name')->orderBy('surname')->get() + : collect([$request->user()]); return view('zaliczki.edit', compact('advance', 'types', 'users')); } @@ -100,6 +100,6 @@ class AdvanceController extends Controller private function authorizeAccess(Request $request, Advance $advance): void { - abort_if($request->user()->hasRole('pracownik') && $advance->user_id !== $request->user()->id, 403); + abort_if(! $request->user()->can('extended_view') && $advance->user_id !== $request->user()->id, 403); } } diff --git a/app/Http/Controllers/DashboardController.php b/app/Http/Controllers/DashboardController.php index b96d3a3..e1ed040 100644 --- a/app/Http/Controllers/DashboardController.php +++ b/app/Http/Controllers/DashboardController.php @@ -16,7 +16,7 @@ class DashboardController extends Controller { $user = auth()->user(); - $showAllDashboard = $user?->hasPermissionTo('show_all_dashbaord') ?? false; + $showAllDashboard = $user?->hasPermissionTo('extended_view') ?? false; if (! $showAllDashboard) { $myVehicles = $user->vehicles()->orderBy('brand')->orderBy('model')->get(); diff --git a/app/Http/Controllers/UserController.php b/app/Http/Controllers/UserController.php index d239f67..f56fdf7 100644 --- a/app/Http/Controllers/UserController.php +++ b/app/Http/Controllers/UserController.php @@ -24,6 +24,10 @@ class UserController extends Controller $query = User::with('roles')->whereNull('deleted_at'); + if (! $request->user()->can('extended_view')) { + $query->whereKey($request->user()->id); + } + // Wyszukiwanie w imieniu, nazwisku i adresie email if ($search) { $query->where(function ($q) use ($search) { @@ -56,6 +60,10 @@ class UserController extends Controller $query = User::with('roles')->onlyTrashed(); + if (! $request->user()->can('extended_view')) { + $query->whereKey($request->user()->id); + } + if ($search) { $query->where(function ($q) use ($search) { $q->where('name', 'like', "%{$search}%") @@ -117,6 +125,7 @@ class UserController extends Controller */ public function show(User $user) { + $this->authorizeUserAccess($user); $user->load(['roles', 'advances.type']); return view('users.show', [ @@ -127,6 +136,7 @@ class UserController extends Controller public function edit(User $user) { + $this->authorizeUserAccess($user); $roles = Role::all(); return view('users.edit', compact('user', 'roles')); @@ -137,6 +147,7 @@ class UserController extends Controller */ public function update(Request $request, User $user) { + $this->authorizeUserAccess($user); $validated = $request->validate([ 'name' => ['required', 'string', 'max:255'], 'surname' => ['required', 'string', 'max:255'], @@ -161,6 +172,7 @@ class UserController extends Controller */ public function destroy(User $user) { + $this->authorizeUserAccess($user); // Blokada usunięcia samego siebie if (auth()->id() === $user->id) { return redirect()->back()->with('error', 'Nie możesz usunąć własnego konta!'); @@ -174,8 +186,14 @@ class UserController extends Controller public function restore($userId) { $user = User::withTrashed()->findOrFail($userId); + $this->authorizeUserAccess($user); $user->restore(); return redirect()->route('users.deleted')->with('status', 'Użytkownik został przywrócony.'); } + + private function authorizeUserAccess(User $user): void + { + abort_unless(auth()->user()->can('extended_view') || auth()->id() === $user->id, 403); + } } \ No newline at end of file diff --git a/app/Http/Controllers/VehicleController.php b/app/Http/Controllers/VehicleController.php index 17ef39e..7a0cf5d 100644 --- a/app/Http/Controllers/VehicleController.php +++ b/app/Http/Controllers/VehicleController.php @@ -13,7 +13,7 @@ class VehicleController extends Controller { $query = Vehicle::with('user'); - if ($request->user()->hasRole('pracownik')) { + if (! $request->user()->can('extended_view')) { $query->where('user_id', $request->user()->id); } @@ -34,7 +34,7 @@ class VehicleController extends Controller } $vehicles = $query->orderBy('brand')->orderBy('registration_number')->paginate(15)->withQueryString(); - $users = User::orderBy('name')->orderBy('surname')->get(); + $users = $this->availableUsers($request); return view('flota', compact('vehicles', 'users')); } @@ -43,7 +43,7 @@ class VehicleController extends Controller { $this->authorizeVehicleManagement($request); - $users = User::orderBy('name')->orderBy('surname')->get(); + $users = $this->availableUsers($request); return view('flota.create', compact('users')); } @@ -52,6 +52,10 @@ class VehicleController extends Controller { $this->authorizeVehicleManagement($request); + if (! $request->user()->can('extended_view')) { + $request->merge(['user_id' => $request->user()->id]); + } + $validated = $request->validate([ 'brand' => ['required', 'string', 'max:255'], 'model' => ['nullable', 'string', 'max:255'], @@ -87,6 +91,10 @@ class VehicleController extends Controller $this->authorizeVehicleManagement($request); $this->authorizeVehicleAccess($request, $vehicle); + if (! $request->user()->can('extended_view')) { + $request->merge(['user_id' => $request->user()->id]); + } + $validated = $request->validate([ 'brand' => ['required', 'string', 'max:255'], 'model' => ['nullable', 'string', 'max:255'], @@ -124,8 +132,15 @@ class VehicleController extends Controller private function authorizeVehicleAccess(Request $request, Vehicle $vehicle): void { - if ($request->user()->hasRole('pracownik') && $vehicle->user_id !== $request->user()->id) { + if (! $request->user()->can('extended_view') && $vehicle->user_id !== $request->user()->id) { abort(403); } } + + private function availableUsers(Request $request) + { + return $request->user()->can('extended_view') + ? User::orderBy('name')->orderBy('surname')->get() + : User::whereKey($request->user()->id)->get(); + } } diff --git a/app/Http/Requests/StoreAdvanceRequest.php b/app/Http/Requests/StoreAdvanceRequest.php index 22d6644..682e2e2 100644 --- a/app/Http/Requests/StoreAdvanceRequest.php +++ b/app/Http/Requests/StoreAdvanceRequest.php @@ -23,7 +23,7 @@ class StoreAdvanceRequest extends FormRequest protected function prepareForValidation(): void { - if ($this->user()?->hasRole('pracownik')) { + if (! $this->user()?->can('extended_view')) { $this->merge(['user_id' => $this->user()->id]); } } diff --git a/database/migrations/2026_09_04_000003_rename_show_all_dashboard_permission.php b/database/migrations/2026_09_04_000003_rename_show_all_dashboard_permission.php new file mode 100644 index 0000000..3117e1b --- /dev/null +++ b/database/migrations/2026_09_04_000003_rename_show_all_dashboard_permission.php @@ -0,0 +1,32 @@ +where('name', 'show_all_dashbaord') + ->where('guard_name', 'web') + ->update(['name' => 'extended_view', 'updated_at' => now()]); + + app(PermissionRegistrar::class)->forgetCachedPermissions(); + } + + public function down(): void + { + $permissionsTable = config('permission.table_names.permissions', 'permissions'); + + DB::table($permissionsTable) + ->where('name', 'extended_view') + ->where('guard_name', 'web') + ->update(['name' => 'show_all_dashbaord', 'updated_at' => now()]); + + app(PermissionRegistrar::class)->forgetCachedPermissions(); + } +}; \ No newline at end of file diff --git a/database/seeders/DatabaseSeeder.php b/database/seeders/DatabaseSeeder.php index b1bbadc..98971ec 100644 --- a/database/seeders/DatabaseSeeder.php +++ b/database/seeders/DatabaseSeeder.php @@ -24,7 +24,7 @@ class DatabaseSeeder extends Seeder 'zaliczki_access', 'users_access', 'setting_access', - 'show_all_dashbaord', + 'extended_view', ]; foreach ($permissions as $permission) { @@ -42,7 +42,7 @@ class DatabaseSeeder extends Seeder $kierownikRole->syncPermissions([ 'users_access', 'setting_access', - 'show_all_dashbaord', + 'extended_view', 'raporty_access', 'flota_access', 'zaliczki_access', diff --git a/tests/Feature/AdvanceTest.php b/tests/Feature/AdvanceTest.php index 0790347..888e965 100644 --- a/tests/Feature/AdvanceTest.php +++ b/tests/Feature/AdvanceTest.php @@ -17,8 +17,8 @@ function userWithAdvanceAccess(string $roleName = 'pracownik'): User $role->givePermissionTo('zaliczki_access'); if ($roleName === 'kierownik') { - Permission::firstOrCreate(['name' => 'show_all_dashbaord']); - $role->givePermissionTo('show_all_dashbaord'); + Permission::firstOrCreate(['name' => 'extended_view']); + $role->givePermissionTo('extended_view'); } $user->assignRole($role); @@ -246,10 +246,11 @@ test('manager can filter advances by text type and date range', function () { test('manager can open employee profile and see current advance balance', function () { Permission::firstOrCreate(['name' => 'users_access']); + Permission::firstOrCreate(['name' => 'extended_view']); $manager = User::factory()->create(); $managerRole = Role::firstOrCreate(['name' => 'kierownik']); - $managerRole->givePermissionTo(['zaliczki_access', 'users_access']); + $managerRole->givePermissionTo(['zaliczki_access', 'users_access', 'extended_view']); $manager->assignRole($managerRole); $employee = User::factory()->create(['name' => 'Jan', 'surname' => 'Kowalski']); diff --git a/tests/Feature/UserSoftDeleteTest.php b/tests/Feature/UserSoftDeleteTest.php index 05188f1..00cbef2 100644 --- a/tests/Feature/UserSoftDeleteTest.php +++ b/tests/Feature/UserSoftDeleteTest.php @@ -6,11 +6,12 @@ use Spatie\Permission\Models\Role; test('user can be soft deleted and hidden from the list', function () { Permission::firstOrCreate(['name' => 'users_access']); + Permission::firstOrCreate(['name' => 'extended_view']); $admin = User::factory()->create(); $adminRole = Role::firstOrCreate(['name' => 'admin']); $admin->assignRole($adminRole); - $admin->givePermissionTo('users_access'); + $admin->givePermissionTo(['users_access', 'extended_view']); $user = User::factory()->create(); @@ -25,11 +26,12 @@ test('user can be soft deleted and hidden from the list', function () { test('deleted users can be listed and restored', function () { Permission::firstOrCreate(['name' => 'users_access']); + Permission::firstOrCreate(['name' => 'extended_view']); $admin = User::factory()->create(); $adminRole = Role::firstOrCreate(['name' => 'admin']); $admin->assignRole($adminRole); - $admin->givePermissionTo('users_access'); + $admin->givePermissionTo(['users_access', 'extended_view']); $user = User::factory()->create(); $user->delete(); @@ -45,11 +47,12 @@ test('deleted users can be listed and restored', function () { test('edit page does not render nested forms for user actions', function () { Permission::firstOrCreate(['name' => 'users_access']); + Permission::firstOrCreate(['name' => 'extended_view']); $admin = User::factory()->create(); $adminRole = Role::firstOrCreate(['name' => 'admin']); $admin->assignRole($adminRole); - $admin->givePermissionTo('users_access'); + $admin->givePermissionTo(['users_access', 'extended_view']); $user = User::factory()->create(); diff --git a/tests/Feature/VehicleTest.php b/tests/Feature/VehicleTest.php index a504d23..4565c2f 100644 --- a/tests/Feature/VehicleTest.php +++ b/tests/Feature/VehicleTest.php @@ -16,8 +16,8 @@ function createFleetUser(string $roleName = 'pracownik'): User $role->givePermissionTo('flota_access'); if ($roleName === 'kierownik') { - Permission::firstOrCreate(['name' => 'show_all_dashbaord']); - $role->givePermissionTo('show_all_dashbaord'); + Permission::firstOrCreate(['name' => 'extended_view']); + $role->givePermissionTo('extended_view'); } $user->assignRole($role); @@ -181,10 +181,11 @@ test('dashboard shows vehicles with upcoming technical inspection or oc expiry w test('employee profile shows assigned vehicle with expire dates and insurance details', function () { Permission::firstOrCreate(['name' => 'users_access']); + Permission::firstOrCreate(['name' => 'extended_view']); $manager = User::factory()->create(); $managerRole = Role::firstOrCreate(['name' => 'kierownik']); - $managerRole->givePermissionTo(['users_access', 'flota_access']); + $managerRole->givePermissionTo(['users_access', 'flota_access', 'extended_view']); $manager->assignRole($managerRole); $user = User::factory()->create();