minicms/core
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

FEATURE #2048: prepare routes for ACL, add some more permissions

Browse Source
This commit is contained in:
Michal Kváček
2017-08-11 02:07:31 +02:00
parent cccdbda543
commit 335ec4a167
41 changed files with 836 additions and 489 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/CMS/Handlers/BaseHandler.php
+61 -37
View File
@@ -1,16 +1,22 @@
<?php
namespace App\CMS\Handlers;
use App\CMS\Contracts\Modules\BaseModuleHandler;
use App\CMS\Enumerations\TemplatePathsHumanReadableRootOnly;
use App\CMS\Enumerations\WidgetTypes;
use App\Models\ActionLog\ActionLogType;
use App\Models\FileManager\File;
use App\Models\Settings;
use App\Models\Templates\Template;
use App\Models\User;
use App\Models\Widgets\Widget;
use App\Models\Widgets\WidgetArea;
abstract class BaseHandler implements BaseModuleHandler
{
/**
* Register admin menu (or multiple ones)
*
* This cannot be in ServiceProvider because Session is started at middleware. And ServiceProvider is called before
* starting any middleware..
*
@@ -25,12 +31,11 @@ abstract class BaseHandler implements BaseModuleHandler
}
// create instance of main menu
\Menu::create('mainMenu', function ($menu) {
\Menu::create('mainMenu', function ($menu) use ($user) {
// $menu->route('admin.dashboard', trans('admin/mainMenu.dashboard'), [], 10, ['icon' => 'fa fa-fw fa-dashboard']);
/**
* Content pages
*
* Submenus can be registered later
*/
$menu->dropdown(trans('admin/mainMenu.contentPages'), function ($sub) {
@@ -40,63 +45,82 @@ abstract class BaseHandler implements BaseModuleHandler
/**
* File manager
*/
$menu->route('upload.overview', trans('admin/mainMenu.fileManager'), [], 40, ['icon' => 'fa fa-fw fa-folder']);
if ($user->can('manage', File::class)) {
$menu->route('upload.overview', trans('admin/mainMenu.fileManager'), [], 40, ['icon' => 'fa fa-fw fa-folder']);
}
/**
* Widgets and widget areas
*/
$menu->dropdown(trans('admin/mainMenu.widgets'), function ($sub) {
// create list of all widget types
$widgets = WidgetTypes::getWithTranslations();
if ($user->can('manage', Widget::class) || $user->can('manage', WidgetArea::class)) {
$menu->dropdown(trans('admin/mainMenu.widgets'), function ($sub) use ($user) {
// create list of all widget types
$widgets = WidgetTypes::getWithTranslations();
if (!empty($widgets)) {
$sub->dropdown(trans('admin/mainMenu.newWidget'), function ($sub) use ($widgets) {
$i = 1;
foreach ($widgets as $type => $name) {
$sub->route('widgets.new', $name, ['type' => $type], $i++);
}
}, 10, ['icon' => 'fa fa-fw fa-plus']);
}
if (!empty($widgets) && $user->can('create-widgets', Widget::class)) {
$sub->dropdown(trans('admin/mainMenu.newWidget'), function ($sub) use ($widgets) {
$i = 1;
foreach ($widgets as $type => $name) {
$sub->route('widgets.new', $name, ['type' => $type], $i++);
}
}, 10, ['icon' => 'fa fa-fw fa-plus']);
}
$sub->route('widgets.overview', trans('admin/mainMenu.widgetsOverview'), [], 20, ['icon' => 'fa fa-fw fa-list']);
$sub->route('widgets.overview', trans('admin/mainMenu.widgetsOverview'), [], 20, ['icon' => 'fa fa-fw fa-list']);
// menu for widget areas
$sub->dropdown(trans('admin/mainMenu.widgetAreas'), function ($sub) {
$sub->route('widgetareas.new', trans('admin/mainMenu.newWidgetArea'), [], 1, ['icon' => 'fa fa-fw fa-plus']);
$sub->route('widgetareas.overview', trans('admin/mainMenu.widgetAreaOverview'), [], 2, ['icon' => 'fa fa-fw fa-list']);
}, 50, ['icon' => 'fa fa-fw fa-object-group']);
}, 50, ['icon' => 'fa fa-fw fa-puzzle-piece']);
// menu for widget areas
if ($user->can('manage', WidgetArea::class)) {
$sub->dropdown(trans('admin/mainMenu.widgetAreas'), function ($sub) use ($user) {
if ($user->can('create-widgetareas', WidgetArea::class)) {
$sub->route('widgetareas.new', trans('admin/mainMenu.newWidgetArea'), [], 1, ['icon' => 'fa fa-fw fa-plus']);
}
$sub->route('widgetareas.overview', trans('admin/mainMenu.widgetAreaOverview'), [], 2, ['icon' => 'fa fa-fw fa-list']);
}, 50, ['icon' => 'fa fa-fw fa-object-group']);
}
}, 50, ['icon' => 'fa fa-fw fa-puzzle-piece']);
}
/**
* Divide system entries and other links in menu
*/
$menu->addDivider(9999);
$menu->dropdown(trans('admin/mainMenu.system'), function ($sub) {
$menu->dropdown(trans('admin/mainMenu.system'), function ($sub) use ($user) {
/**
* User management
*/
$sub->dropdown(trans('admin/mainMenu.userManagement'), function ($sub) {
$sub->route('users.new', trans('admin/mainMenu.newUser'), [], 10, ['icon' => 'fa fa-fw fa-user-plus']);
$sub->route('users.overview', trans('admin/mainMenu.usersOverview'), [], 30, ['icon' => 'fa fa-fw fa-users']);
}, 20, ['icon' => 'fa fa-fw fa-users']);
if ($user->can('manage', User::class)) {
$sub->dropdown(trans('admin/mainMenu.userManagement'), function ($sub) use ($user) {
if ($user->can('create', User::class)) {
$sub->route('users.new', trans('admin/mainMenu.newUser'), [], 10, ['icon' => 'fa fa-fw fa-user-plus']);
}
$sub->route('users.overview', trans('admin/mainMenu.usersOverview'), [], 30, ['icon' => 'fa fa-fw fa-users']);
}, 20, ['icon' => 'fa fa-fw fa-users']);
}
/**
* Templates
*/
$templatePaths = TemplatePathsHumanReadableRootOnly::getWithTranslations();
if (!empty($templatePaths)) {
$sub->dropdown(trans('admin/mainMenu.templates'), function ($sub) use ($templatePaths) {
$i = 1;
foreach ($templatePaths as $id => $name) {
$sub->route('templates.overview', $name, ['id' => $id], $i++);
}
}, 60, ['icon' => 'fa fa-fw fa-file-code-o']);
if ($user->can('manage', Template::class)) {
$templatePaths = TemplatePathsHumanReadableRootOnly::getWithTranslations();
if (!empty($templatePaths)) {
$sub->dropdown(trans('admin/mainMenu.templates'), function ($sub) use ($templatePaths) {
$i = 1;
foreach ($templatePaths as $id => $name) {
$sub->route('templates.overview', $name, ['id' => $id], $i++);
}
}, 60, ['icon' => 'fa fa-fw fa-file-code-o']);
}
}
$sub->route('log.overview', trans('admin/mainMenu.actionLog'), [], 70, ['icon' => 'fa fa-fw fa-history']);
$sub->route('settings.overview', trans('admin/mainMenu.settings'), [], 80, ['icon' => 'fa fa-fw fa-gear']);
if ($user->can('manage', ActionLogType::class)) {
$sub->route('log.overview', trans('admin/mainMenu.actionLog'), [], 70, ['icon' => 'fa fa-fw fa-history']);
}
if ($user->can('manage', Settings::class)) {
$sub->route('settings.overview', trans('admin/mainMenu.settings'), [], 80, ['icon' => 'fa fa-fw fa-gear']);
}
}, 10000, ['icon' => 'fa fa-fw fa-gears']);
});
app/CMS/MenuPresenters/MetismenuPresenter.php
+5
View File
@@ -1,4 +1,5 @@
<?php
namespace App\CMS\MenuPresenters;
use Nwidart\Menus\MenuItem;
@@ -27,6 +28,10 @@ class MetismenuPresenter extends Presenter
*/
public function getMenuWithoutDropdownWrapper($item)
{
if (!is_string($item->getUrl())) {
return null;
}
return '<li' . $this->getActiveState($item) . '><a href="' . $item->getUrl() . '">' . $item->getIcon() . ' ' . $item->title . '</a></li>' . PHP_EOL;
}
app/CMS/Repositories/Content/Content.php
+2
View File
@@ -1,4 +1,5 @@
<?php
namespace App\CMS\Repositories\Content;
use App\CMS\Contracts\Repositories\Content as IContent;
@@ -113,6 +114,7 @@ class Content extends Repository implements IContent
->whereNull('contents.deleted_at')
->where('contents.language', LaravelLocalization::getCurrentLocale())
->where('modules.enabled', 1)
->with('module')
->orderBy('contents.created_at', 'DESC');
// filter results using handler
app/CMS/Repositories/Permissions/Permission.php
+15
View File
@@ -0,0 +1,15 @@
<?php
namespace App\CMS\Repositories\Permissions;
use App\Models\Permissions\Permission as PermissionModel;
class Permission
{
public function getRootPermissions()
{
return PermissionModel::whereNull('parent_id')
->with('subpermissions')
->get();
}
}
app/Http/Controllers/Admin/Permissions.php
+24 -69
View File
@@ -2,85 +2,40 @@
namespace App\Http\Controllers\Admin;
use Illuminate\Http\Request;
use App\Http\Controllers\Controller;
use Illuminate\Support\Facades\Auth;
use App\Models\Permissions\Permission;
use App\Models\User;
use Illuminate\Http\Request;
class Permissions extends Controller
{
/**
* Display a listing of the resource.
*
* @return \Illuminate\Http\Response
*/
public function index()
{
dd(Auth::user()->permissions);
}
/**
* Show the form for creating a new resource.
*
* @return \Illuminate\Http\Response
*/
public function create()
{
//
}
/**
* Store a newly created resource in storage.
*
* @param \Illuminate\Http\Request $request
* @return \Illuminate\Http\Response
*/
public function store(Request $request)
{
//
}
/**
* Display the specified resource.
*
* @param int $id
* @return \Illuminate\Http\Response
*/
public function show($id)
{
//
}
/**
* Show the form for editing the specified resource.
*
* @param int $id
* @return \Illuminate\Http\Response
*/
public function edit($id)
{
//
}
/**
* Update the specified resource in storage.
*
* @param \Illuminate\Http\Request $request
* @param int $id
* @return \Illuminate\Http\Response
*/
public function update(Request $request, $id)
{
//
}
/**
* Remove the specified resource from storage.
* @param \Illuminate\Http\Request $request
* @param int $id
*
* @param int $id
* @return \Illuminate\Http\Response
*/
public function destroy($id)
public function update(Request $request, User $user)
{
//
$permissionIds = $request->get('permissions', []);
$permissions = Permission::whereIn('string_id', array_keys($permissionIds))
->get();
\DB::transaction(function () use ($user, $permissions) {
// remove all permissions
$user->permissions()
->detach();
foreach ($permissions as $permission) {
$user->permissions()
->attach($permission->id);
}
});
return redirect()
->back()
->with('success', trans('admin/permissions.successfullySet'));
}
}
app/Http/Controllers/Admin/Users/UserDetail.php
+7 -5
View File
@@ -5,6 +5,7 @@ namespace App\Http\Controllers\Admin\Users;
use App\CMS\Enumerations\UserRoles;
use App\CMS\Enumerations\UserStates;
use App\Cms\Repositories\ActionLog\Actions;
use App\CMS\Repositories\Permissions\Permission;
use App\Http\Controllers\Admin\Controller;
use App\Models\ActionLog\ActionLog;
use App\Models\User;
@@ -29,16 +30,17 @@ class UserDetail extends Controller
$user = Auth::user();
}
$actions = $this->log->getUserActions($user->id, 10);
$roles = UserRoles::getWithTranslations();
$states = UserStates::getWithTranslations();
$permissions = app(Permission::class)->getRootPermissions();
return view('admin.userManagement.detail', [
'user' => $user,
'statuses' => $states,
'roles' => $roles,
'actions' => $actions
'user' => $user,
'statuses' => $states,
'roles' => $roles,
'actions' => $actions,
'permissions' => $permissions
]);
}
}
app/Http/Kernel.php
-1
View File
@@ -57,7 +57,6 @@ class Kernel extends HttpKernel
protected $routeMiddleware = [
'can' => Authorize::class,
'auth' => Middleware\Admin\Authenticate::class,
'onlyAdmin' => Middleware\Admin\RequireAdminRole::class,
'adminMenu' => Middleware\Admin\AdminMenuRegistrator::class,
'guest' => Middleware\RedirectIfAuthenticated::class,
'throttle' => ThrottleRequests::class,
app/Http/Middleware/Admin/RequireAdminRole.php
-28
View File
@@ -1,28 +0,0 @@
<?php
namespace App\Http\Middleware\Admin;
use App\Models\User;
use Closure;
class RequireAdminRole
{
/**
* Handle an incoming request.
*
* @param \Illuminate\Http\Request $request
* @param \Closure $next
*
* @return mixed
*/
public function handle($request, Closure $next)
{
if (\Auth::user()->role != User::ROLE_ADMIN) {
return redirect()
->back()
->with('error', trans('auth.accessDenied'));
}
return $next($request);
}
}
app/Models/FileManager/ModelTraits/File.php
+3
View File
@@ -6,6 +6,7 @@ use App\Events\UploadFile;
use App\Models\FileManager\File as FileModel;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Event;
use Illuminate\Support\Facades\Gate;
use Symfony\Component\HttpFoundation\File\File as SymphonyFile;
use Symfony\Component\HttpFoundation\File\UploadedFile;
@@ -36,6 +37,8 @@ trait File
*/
public function upload(UploadedFile $file, $data = [])
{
abort_unless(Auth::user()->can('upload', FileModel::class), 403);
$data = (object)$data;
$destination = config('app.upload_path');
app/Models/Permission.php
-19
View File
@@ -1,19 +0,0 @@
<?php
namespace App\Models;
use Illuminate\Database\Eloquent\Model;
class Permission extends Model
{
protected $fillable = [
'string_id',
'parent_id',
'group',
'name',
];
public function parent() {
return $this->hasOne(Permission::class, 'parent_id');
}
}
app/Models/Permissions/Permission.php
+40
View File
@@ -0,0 +1,40 @@
<?php
namespace App\Models\Permissions;
use Illuminate\Database\Eloquent\Model;
class Permission extends Model
{
public $timestamps = false;
protected $fillable = [
'string_id',
'parent_id',
'group',
'name',
'default'
];
protected $casts = [
'default' => 'boolean'
];
/**
* Assign observer for this model for logging
*/
protected static function boot()
{
parent::boot();
self::observe(PermissionObserver::class);
}
public function parent()
{
return $this->hasOne(Permission::class, 'parent_id');
}
public function subpermissions()
{
return $this->hasMany(Permission::class, 'parent_id');
}
}
app/Models/Permissions/PermissionObserver.php
+26
View File
@@ -0,0 +1,26 @@
<?php
namespace App\Models\Permissions;
use App\Models\User;
class PermissionObserver
{
/**
* Sets default permissions when creating new
*
* @param Permission $permission
*/
public function created(Permission $permission)
{
if ($permission->default) {
$users = User::where('role', '!=', User::ROLE_VISITOR)
->get();
foreach ($users as $user) {
$user->permissions()
->attach($permission->id);
}
}
}
}
app/Models/User.php
+1
View File
@@ -2,6 +2,7 @@
namespace App\Models;
use App\Models\Permissions\Permission;
use App\Notifications\ResetPasswordNotification;
use Illuminate\Auth\Authenticatable;
use Illuminate\Contracts\Auth\Authenticatable as AuthenticableInterface;
app/Policies/BasicPolicy.php
+29 -3
View File
@@ -4,17 +4,43 @@ namespace App\Policies;
use App\Models\User;
use Illuminate\Auth\Access\HandlesAuthorization;
use Illuminate\Database\Eloquent\Model;
abstract class BasicPolicy
{
use HandlesAuthorization;
protected $entity;
public function before(User $user, $ability)
{
if ($user->role == User::ROLE_ADMIN) {
return true;
// check if user can operate on given entity
if (!$this->manage($user)) {
return false;
}
}
return null;
/**
* Can user manage given entity?
*
* @param User $user
*
* @return bool
*/
public function manage(User $user) {
return $user->hasAbility($this->entity.'-management');
}
/**
* Determine whether the user can delete the content.
*
* @param \App\Models\User $user
* @param Model $model
*
* @return mixed
*/
public function delete(User $user, Model $model)
{
return $user->hasAbility('delete-'.$this->entity);
}
}
app/Policies/ContentPolicy.php
+22 -36
View File
@@ -2,48 +2,28 @@
namespace App\Policies;
use App\Models\User;
use App\Models\Content\Content;
use App\Models\User;
use Illuminate\Auth\Access\HandlesAuthorization;
class ContentPolicy extends BasicPolicy
{
use HandlesAuthorization;
/**
* Determine whether the user can view the content.
*
* @param \App\Models\User $user
* @param \App\Models\Content\Content $content
* @return mixed
*/
public function view(User $user, Content $content)
{
//
}
/**
* Determine whether the user can create contents.
*
* @param \App\Models\User $user
* @return mixed
*/
public function create(User $user)
{
return true;
}
protected $entity = 'contents';
/**
* Determine whether the user can update the content.
*
* @param \App\Models\User $user
* @param \App\Models\Content\Content $content
* @param \App\Models\User $user
* @param \App\Models\Content\Content $content
*
* @return mixed
*/
public function update(User $user, Content $content)
{
if (!$user->hasAbility('update-contents-'.$content->module->alias))
if (!$user->hasAbility('update-contents-' . $content->module->alias)) {
return false;
}
if ($user->id != $content->user_id) {
return $user->hasAbility('update-contents') && $user->hasAbility('update-all-contents');
@@ -52,15 +32,21 @@ class ContentPolicy extends BasicPolicy
return $user->hasAbility('update-contents');
}
/**
* Determine whether the user can delete the content.
*
* @param \App\Models\User $user
* @param \App\Models\Content\Content $content
* @return mixed
*/
public function delete(User $user, Content $content)
public function create(User $user, Content $content) {
return $user->hasAbility('create-contents');
}
public function publish(User $user, Content $content)
{
return $user->hasAbility('delete-contents');
return $user->hasAbility('publish-contents');
}
public function setHomepage(User $user, Content $content)
{
return $user->hasAbility('set-homepage-contents');
}
public function viewHistory(User $user, Content $content) {
return $user->hasAbility('view-history-contents');
}
}
app/Policies/FilesPolicy.php
+39
View File
@@ -0,0 +1,39 @@
<?php
namespace App\Policies;
use App\Models\FileManager\File;
use App\Models\User;
use Illuminate\Auth\Access\HandlesAuthorization;
class FilesPolicy extends BasicPolicy
{
use HandlesAuthorization;
protected $entity = 'files';
/**
* Determine whether the user can create appModelsFileManagerFiles.
*
* @param User $user
* @param File $file
*
* @return mixed
*/
public function create(User $user, File $file)
{
return $user->hasAbility('upload-files');
}
/**
* Determine whether the user can update the appModelsFileManagerFile.
*
* @param User $user
* @param File $file
*
* @return mixed
*/
public function update(User $user, File $file)
{
return $user->hasAbility('update-files');
}
}
app/Policies/ModulePolicy.php
+5 -39
View File
@@ -2,25 +2,15 @@
namespace App\Policies;
use App\Models\User;
use App\Models\Module;
use App\Models\User;
use Illuminate\Auth\Access\HandlesAuthorization;
use Illuminate\Database\Eloquent\Model;
class ModulePolicy extends BasicPolicy
{
use HandlesAuthorization;
/**
* Determine whether the user can view the module.
*
* @param \App\Models\User $user
* @param \App\Module $module
* @return mixed
*/
public function view(User $user, Module $module)
{
//
}
protected $entity = 'modules';
/**
* Determine whether the user can create modules.
@@ -30,32 +20,8 @@ class ModulePolicy extends BasicPolicy
*
* @return mixed
*/
public function create(User $user, Module $module)
public function create(User $user, Model $module)
{
return $user->hasAbility('create-contents-'.$module->alias);
}
/**
* Determine whether the user can update the module.
*
* @param \App\Models\User $user
* @param \App\Module $module
* @return mixed
*/
public function update(User $user, Module $module)
{
//
}
/**
* Determine whether the user can delete the module.
*
* @param \App\Models\User $user
* @param \App\Module $module
* @return mixed
*/
public function delete(User $user, Module $module)
{
//
return $user->hasAbility('create-contents-' . $module->alias);
}
}
app/Policies/UserPolicy.php
+53 -24
View File
@@ -8,51 +8,80 @@ use Illuminate\Auth\Access\HandlesAuthorization;
class UserPolicy extends BasicPolicy
{
use HandlesAuthorization;
protected $entity = 'users';
/**
* Determine whether the user can view the user.
* Can current user updates other users (or himself?)
*
* @param \App\Models\User $user
* @param \App\Models\User $user
* @return mixed
* @param User $currentUser
* @param User $user
*
* @return bool
*/
public function view(User $user, User $user)
public function update(User $currentUser, User $user)
{
return $currentUser->id == $user->id || $currentUser->hasAbility('update-users');
}
/**
* Determine whether the user can create users.
* Can user create other users?
*
* @param \App\Models\User $user
* @return mixed
* @param User $user
*
* @return bool
*/
public function create(User $user)
{
//
public function create(User $user) {
return $user->hasAbility('create-users');
}
/**
* Determine whether the user can update the user.
* Does current user has permissions for setting permissions to other users?
*
* @param \App\Models\User $user
* @param \App\Models\User $user
* @return mixed
* @param User $currentUser
* @param User $user
*
* @return bool
*/
public function update(User $user, User $user)
public function setPermissions(User $currentUser, User $user)
{
//
if ($currentUser->id == $user->id || $user->role == User::ROLE_VISITOR) {
return false;
}
return $currentUser->hasAbility('set-permissions-users');
}
/**
* Determine whether the user can delete the user.
* Can logged user change status of other users?
*
* @param \App\Models\User $user
* @param \App\Models\User $user
* @return mixed
* @param User $currentUser
* @param User $user
*
* @return bool
*/
public function delete(User $user, User $user)
public function changeStatus(User $currentUser, User $user)
{
//
if ($currentUser->id == $user->id) {
return false;
}
return $currentUser->hasAbility('change-status-users');
}
/**
* Can current user change role of other users?
*
* @param User $currentUser
* @param User $user
*
* @return bool
*/
public function changeRole(User $currentUser, User $user)
{
if ($currentUser->id == $user->id) {
return false;
}
return $currentUser->hasAbility('change-role-users');
}
}
app/Providers/AuthServiceProvider.php
+3
View File
@@ -3,9 +3,11 @@
namespace App\Providers;
use App\Models\Content\Content;
use App\Models\FileManager\File;
use App\Models\Module;
use App\Models\User;
use App\Policies\ContentPolicy;
use App\Policies\FilesPolicy;
use App\Policies\ModulePolicy;
use App\Policies\UserPolicy;
use Illuminate\Foundation\Support\Providers\AuthServiceProvider as IlluminateAuthServiceProvider;
@@ -20,6 +22,7 @@ class AuthServiceProvider extends IlluminateAuthServiceProvider
Content::class => ContentPolicy::class,
User::class => UserPolicy::class,
Module::class => ModulePolicy::class,
File::class => FilesPolicy::class,
];
/**