Merge branch 'features/permissions' into 'dev'

permissions review

See merge request sae-but2/2025-26/gestion-benevoles-association/backend!20

app/Http/Controllers/SearchController.php

@@ -153,6 +153,9 @@ class SearchController extends Controller
                 // ignore si la collection n'existe pas
             }
 
+
+            $this->createUsersCollection();
+
             $this->indexUsers();
             $query = $request->input('query', '');
 

app/Http/Controllers/UserController.php

@@ -58,7 +58,6 @@ class UserController extends Controller
     }
 
     public function delete(Request $request): JsonResponse {
-
         try {
             $user = User::find($request->user()->id);
             $user->delete();
@@ -69,6 +68,19 @@ class UserController extends Controller
         }
     }
 
+    public function getUser(Request $request, int $id): JsonResponse {
+
+        try {
+            return response()->json(UserService::getData($id));
+        } catch (ModelNotFoundException $e) {
+            return response()->json(['message' => 'Utilisateur non trouvé'], 404);
+        } catch (\Exception $e) {
+            Log::info($e->getMessage());
+            return response()->json(['message' => "Server error"], 500);
+        }
+
+    }
+
     public function deleteById(Request $request, int $id): JsonResponse {
 
         if(Gate::denies('deleteOther', $request->user())){
@@ -86,10 +98,17 @@ class UserController extends Controller
         }
     }
 
-    public function getUser(Request $request, int $id): JsonResponse {
+    public function deactivate(Request $request, int $id): JsonResponse {
+        $userToDeactivate = User::findOrFail($id);
+
+        if(Gate::denies('deactivate', $request->user(), $userToDeactivate)){
+            return response()->json(["message" => "Can't delete this user"], 403);
+        }
 
         try {
-            return response()->json(UserService::getData($id));
+            $userToDeactivate->update(['active' => false]);
+
+            return response()->json(['message' => 'User deactivated successfully']);
         } catch (ModelNotFoundException $e) {
             return response()->json(['message' => 'Utilisateur non trouvé'], 404);
         } catch (\Exception $e) {

app/Policies/UsersPolicy.php

@@ -9,7 +9,14 @@ class UsersPolicy
 {
     public function deleteOther(User $user): bool
     {
-        return $user->role === 1;
+        return $user->role === 1 || $user->role === 2;
+    }
+
+    public function deactivate(User $user, User $userToDeactivate): bool
+    {
+        return in_array($user->role, [1, 2])
+            && $user->role < $userToDeactivate->role
+            && $user->id !== $userToDeactivate->id;
     }
 
     public function validate(User $user): bool

app/Services/UserService.php

@@ -15,7 +15,7 @@ class UserService
             "lastname" => $user->lastname,
             "email" => $user->email,
             "role" => GetRole::getRole($user->role),
-            "isAdmin" => $user->role === 1,
+            "isAdmin" => ($user->role === 1 || $user->role === 2),
             "phone" => $user->phone,
             "created_at" => $user->created_at,
             "updated_at" => $user->updated_at,