From 53cca29b6780be0eb694cf6ee6f000b25127c9ce Mon Sep 17 00:00:00 2001
From: Giovanni-Josserand <josserand.giovanni@gmail.com>
Date: Wed, 14 Jan 2026 22:41:03 +0100
Subject: [PATCH] permissions review

---
 .env.example                              |  2 +-
 app/Http/Controllers/SearchController.php |  3 +++
 app/Http/Controllers/UserController.php   | 25 ++++++++++++++++++++---
 app/Policies/UsersPolicy.php              |  9 +++++++-
 app/Services/UserService.php              |  2 +-
 docker/docker-compose.yml                 |  4 ++--
 routes/users.php                          |  3 +++
 7 files changed, 40 insertions(+), 8 deletions(-)

diff --git a/.env.example b/.env.example
index e63b17d..c1ff976 100644
--- a/.env.example
+++ b/.env.example
@@ -79,4 +79,4 @@ VITE_APP_NAME="${APP_NAME}"
 SANCTUM_STATEFUL_DOMAINS=localhost,127.0.0.1,localhost:8000
 
 TYPESENSE_CONNECTION=typesense
-TYPESENSE_API_KEY=y^sB$f%qlhfHSy%&jknAXabWNkZcvguCyARRqW5rE%%QG6H8ehA2ehVlhPWS555D
+TYPESENSE_API_KEY=xyz
diff --git a/app/Http/Controllers/SearchController.php b/app/Http/Controllers/SearchController.php
index 8af18d4..245015e 100644
--- a/app/Http/Controllers/SearchController.php
+++ b/app/Http/Controllers/SearchController.php
@@ -153,6 +153,9 @@ class SearchController extends Controller
                 // ignore si la collection n'existe pas
             }
 
+
+            $this->createUsersCollection();
+
             $this->indexUsers();
             $query = $request->input('query', '');
 
diff --git a/app/Http/Controllers/UserController.php b/app/Http/Controllers/UserController.php
index dc18c32..6a79636 100644
--- a/app/Http/Controllers/UserController.php
+++ b/app/Http/Controllers/UserController.php
@@ -58,7 +58,6 @@ class UserController extends Controller
     }
 
     public function delete(Request $request): JsonResponse {
-
         try {
             $user = User::find($request->user()->id);
             $user->delete();
@@ -69,6 +68,19 @@ class UserController extends Controller
         }
     }
 
+    public function getUser(Request $request, int $id): JsonResponse {
+
+        try {
+            return response()->json(UserService::getData($id));
+        } catch (ModelNotFoundException $e) {
+            return response()->json(['message' => 'Utilisateur non trouvé'], 404);
+        } catch (\Exception $e) {
+            Log::info($e->getMessage());
+            return response()->json(['message' => "Server error"], 500);
+        }
+
+    }
+
     public function deleteById(Request $request, int $id): JsonResponse {
 
         if(Gate::denies('deleteOther', $request->user())){
@@ -86,10 +98,17 @@ class UserController extends Controller
         }
     }
 
-    public function getUser(Request $request, int $id): JsonResponse {
+    public function deactivate(Request $request, int $id): JsonResponse {
+        $userToDeactivate = User::findOrFail($id);
+
+        if(Gate::denies('deactivate', $request->user(), $userToDeactivate)){
+            return response()->json(["message" => "Can't delete this user"], 403);
+        }
 
         try {
-            return response()->json(UserService::getData($id));
+            $userToDeactivate->update(['active' => false]);
+
+            return response()->json(['message' => 'User deactivated successfully']);
         } catch (ModelNotFoundException $e) {
             return response()->json(['message' => 'Utilisateur non trouvé'], 404);
         } catch (\Exception $e) {
diff --git a/app/Policies/UsersPolicy.php b/app/Policies/UsersPolicy.php
index feeb5d2..5380f51 100644
--- a/app/Policies/UsersPolicy.php
+++ b/app/Policies/UsersPolicy.php
@@ -9,7 +9,14 @@ class UsersPolicy
 {
     public function deleteOther(User $user): bool
     {
-        return $user->role === 1;
+        return $user->role === 1 || $user->role === 2;
+    }
+
+    public function deactivate(User $user, User $userToDeactivate): bool
+    {
+        return in_array($user->role, [1, 2])
+            && $user->role < $userToDeactivate->role
+            && $user->id !== $userToDeactivate->id;
     }
 
     public function validate(User $user): bool
diff --git a/app/Services/UserService.php b/app/Services/UserService.php
index fdeca85..7226c78 100644
--- a/app/Services/UserService.php
+++ b/app/Services/UserService.php
@@ -15,7 +15,7 @@ class UserService
             "lastname" => $user->lastname,
             "email" => $user->email,
             "role" => GetRole::getRole($user->role),
-            "isAdmin" => $user->role === 1,
+            "isAdmin" => ($user->role === 1 || $user->role === 2),
             "phone" => $user->phone,
             "created_at" => $user->created_at,
             "updated_at" => $user->updated_at,
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index d23aab7..b00ced6 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -46,8 +46,8 @@ services:
       - "8108:8108"
     volumes:
       - typesense-data:/data
-    command: '--data-dir /data --api-key= --enable-cors'
-  
+    command: '--data-dir /data --api-key=xyz --enable-cors'
+
   backup:
     build:
       context: .
diff --git a/routes/users.php b/routes/users.php
index f6ffecf..e5a4f84 100644
--- a/routes/users.php
+++ b/routes/users.php
@@ -13,6 +13,9 @@ Route::middleware(['web', 'auth:sanctum'])->delete('/users', [UserController::cl
 Route::middleware(['web', 'auth:sanctum'])->delete('/users/{id}', [UserController::class, "deleteById"])
     ->whereNumber('id');
 
+Route::middleware(['web', 'auth:sanctum'])->post('/users/{id}/deactivate', [UserController::class, "deactivate"])
+    ->whereNumber('id');
+
 Route::middleware(['web', 'auth:sanctum'])->get('/users/{id}', [UserController::class, "getUser"])
     ->whereNumber('id');