Merge branch 'features/authorizations' into 'features/notifications'

Features/authorizations

See merge request sae-but2/2025-26/gestion-benevoles-association/backend!14

app/Http/Controllers/Controller.php

@@ -2,7 +2,9 @@
 
 namespace App\Http\Controllers;
 
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+
 abstract class Controller
 {
-    //
+    use AuthorizesRequests;
 }

app/Http/Controllers/EventsController.php

@@ -6,6 +6,7 @@ use App\Models\Events;
 use http\Env\Response;
 use Illuminate\Http\Request;
 use Illuminate\Http\JsonResponse;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\Facades\Log;
 use PHPUnit\Event\Event;
 
@@ -13,7 +14,7 @@ class EventsController extends Controller
 {
     public function create(Request $request): JsonResponse
     {
-        if ($request->user()->role != 1) {
+        if (Gate::denies('create', Events::class)) {
             return response()->json(['message' => 'Forbidden'], 403);
         }
 
@@ -37,7 +38,7 @@ class EventsController extends Controller
 
     public function update(Request $request, int $id): JsonResponse {
 
-        if ($request->user()->role != 1) {
+        if (Gate::denies('update', Events::class)) {
             return response()->json(['message' => 'Forbidden'], 403);
         }
 
@@ -76,7 +77,7 @@ class EventsController extends Controller
 
     public function delete(Request $request, int $id): JsonResponse {
 
-        if ($request->user()->role != 1) {
+        if (Gate::denies('delete', Events::class)) {
             return response()->json(['message' => 'Forbidden'], 403);
         }
 

app/Http/Controllers/NotificationsController.php

@@ -10,24 +10,10 @@ use Illuminate\Support\Facades\Log;
 
 class NotificationsController extends Controller
 {
-    public function createNotification(Request $request, int $id): JsonResponse {
-        $notification = Notification::create([
-            "content" => $request["content"]
-        ]);
-
-        $notification->users()->attach($id);
-
-        return response()->json(['message' => 'Notification created successfully']);
-    }
-
-
-
-    public function getNotifications(Request $request, int $id): JsonResponse {
+    public function getNotifications(Request $request): JsonResponse {
         try {
-            $user = User::findOrFail($id);
-
             return response()->json([
-                'data' => $user->notifications
+                'data' => $request->user()->notifications
             ]);
         } catch(\Exception $e) {
             Log::info($e->getMessage());
@@ -37,10 +23,9 @@ class NotificationsController extends Controller
 
 
 
-    public function deleteNotification(int $userId, int $notificationId): JsonResponse {
+    public function deleteNotification(Request $request, int $notificationId): JsonResponse {
         try {
-            $user = User::findOrFail($userId);
-            $user->notifications()->detach($notificationId);
+            $request->user()->notifications()->detach($notificationId);
 
             $notification = Notification::find($notificationId);
             if ($notification && $notification->users()->count() === 0) {
@@ -53,5 +38,4 @@ class NotificationsController extends Controller
             return response()->json(['message' => 'Erreur lors de la suppression'], 500);
         }
     }
-
 }

app/Http/Controllers/SearchController.php

@@ -68,6 +68,12 @@ class SearchController extends Controller
     public function searchEvents(Request $request)
     {
         try {
+            try {
+                $this->client->collections['events']->delete();
+            } catch (\Exception $e) {
+                // ignore si la collection n'existe pas
+            }
+
             $this->createEventsCollection();
             $this->indexEvents();
             $query = $request->input('query', '');
@@ -147,7 +153,6 @@ class SearchController extends Controller
                 // ignore si la collection n'existe pas
             }
 
-            $this->createUsersCollection();
             $this->indexUsers();
             $query = $request->input('query', '');
 

app/Http/Controllers/TasksController.php

@@ -7,20 +7,14 @@ use App\Models\Task;
 use App\Models\User;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\Facades\Log;
 
 class TasksController extends Controller
 {
-
-    public function isAdmin(int $role) {
-        if($role != 1) return false;
-        return true;
-    }
-
-
     public function create(Request $request): JsonResponse {
 
-        if(!$this->isAdmin($request->user()->role)){
+        if(Gate::denies('create', Task::class)) {
             return response()->json(["message" => "Can't create task"], 403);
         }
 
@@ -67,7 +61,7 @@ class TasksController extends Controller
 
     public function assignUser(request $request, int $id): JsonResponse {
 
-        if(!$this->isAdmin($request->user()->role)){
+        if(Gate::denies('assignOther', Task::class)) {
             return response()->json(["message" => "Can't create task"], 403);
         }
 
@@ -108,7 +102,7 @@ class TasksController extends Controller
 
     public function deleteTask(Request $request, int $id): JsonResponse {
 
-        if(!$this->isAdmin($request->user()->role)){
+        if(Gate::denies('delete', Task::class)) {
             return response()->json(["message" => "Can't delete task"], 403);
         }
 
@@ -126,7 +120,7 @@ class TasksController extends Controller
 
     public function update(Request $request, int $id): JsonResponse {
 
-        if(!$this->isAdmin($request->user()->role)){
+        if(Gate::denies('update', Task::class)) {
             return response()->json(["message" => "Forbidden"], 403);
         }
 

app/Http/Controllers/UserController.php

@@ -6,6 +6,7 @@ use App\Models\Notification;
 use App\Models\User;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Log;
 use App\Services\GetRole;
@@ -14,11 +15,6 @@ use Propaganistas\LaravelPhone\PhoneNumber;
 
 class UserController extends Controller
 {
-    public function isAdmin(int $role) {
-        if($role != 1) return false;
-        return true;
-    }
-
     public function me(Request $request): JsonResponse {
         try {
             return response()->json(UserService::getData($request->user()->id));
@@ -72,15 +68,13 @@ class UserController extends Controller
 
     public function deleteById(Request $request, int $id): JsonResponse {
 
-        if(!$this->isAdmin($request->user()->role)){
+        if(Gate::denies('deleteOther', $request->user())){
             return response()->json(["message" => "Can't delete this user"], 403);
         }
 
         try {
             $user = User::find($id);
 
-            if($user->role === 1) return response()->json(["message" => "Can't delete this user"], 403);
-
             $user->delete();
             return response()->json(['message' => 'User deleted successfully']);
         } catch(\Exception $e) {
@@ -120,7 +114,7 @@ class UserController extends Controller
 
     public function validate(Request $request, int $id): JsonResponse {
 
-        if($request->user()->role != 1 && $request->user()->role != 2 || $request->user()->role == null){
+        if(Gate::denies('validate', $request->user())){
             return response()->json(["message" => "Can't validate this user"], 403);
         }
 
@@ -149,7 +143,7 @@ class UserController extends Controller
 
     public function addRole(Request $request, int $id): JsonResponse {
 
-        if(!$this->isAdmin($request->user()->role)){
+        if(Gate::denies('addRole', $request->user())){
             return response()->json(["message" => "Can't add role to this user"], 403);
         }
 
@@ -158,6 +152,12 @@ class UserController extends Controller
             $user->role = $request['role'];
             $user->save();
 
+            $role = GetRole::getRole($request['role']);
+            $notification = Notification::create([
+                'content' => "Votre rôle à changé pour {$role} !",
+            ]);
+            $notification->users()->attach($user->id);
+
             return response()->json(['message' => 'User role added successfully']);
         } catch(\Exception $e) {
             Log::info($e->getMessage());

app/Policies/EventsPolicy.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\Events;
+use App\Models\User;
+use Illuminate\Auth\Access\Response;
+
+class EventsPolicy
+{
+    public function create(User $user, Events $model): bool
+    {
+        return $user->role === 1 || $user->role === 2;
+    }
+
+    public function update(User $user, Events $model): bool
+    {
+        return $user->role === 1 || $user->role === 2;
+    }
+
+    public function delete(User $user, Events $model): bool
+    {
+        return $user->role === 1 || $user->role === 2;
+    }
+}

app/Policies/TasksPolicy.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\Task;
+use App\Models\User;
+use Illuminate\Auth\Access\Response;
+
+class TasksPolicy
+{
+    public function create(User $user, Task $model): bool
+    {
+        return $user->role === 1 || $user->role === 2;
+    }
+
+    public function assignOther(User $user, Task $model): bool
+    {
+        return $user->role === 1 || $user->role === 2;
+    }
+
+    public function delete(User $user, Task $model): bool
+    {
+        return $user->role === 1 || $user->role === 2;
+    }
+
+    public function update(User $user, Task $model): bool
+    {
+        return $user->role === 1 || $user->role === 2;
+    }
+}

app/Policies/UserPolicy.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\User;
+use Illuminate\Auth\Access\Response;
+
+class UserPolicy
+{
+    public function deleteOther(User $user, User $model): bool
+    {
+        return $user->role === 1;
+    }
+
+    public function validate(User $user, User $model): bool
+    {
+        return $user->role === 1 || $user->role === 2;
+    }
+
+    public function addRole(User $user, User $model): bool
+    {
+        return $user->role === 1;
+    }
+}

app/Providers/GateServiceProvider.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Providers;
+
+use App\Models\Events;
+use App\Models\Task;
+use App\Models\User;
+use App\Policies\EventsPolicy;
+use App\Policies\TasksPolicy;
+use App\Policies\UserPolicy;
+use Illuminate\Support\Facades\Gate;
+use Illuminate\Support\ServiceProvider;
+
+class GateServiceProvider extends ServiceProvider
+{
+    /**
+     * Register services.
+     */
+    public function register(): void
+    {
+        //
+    }
+
+    /**
+     * Bootstrap services.
+     */
+    public function boot(): void
+    {
+        Gate::policy(User::class, UserPolicy::class);
+        Gate::policy(Events::class, EventsPolicy::class);
+        Gate::policy(Task::class, TasksPolicy::class);
+    }
+}

bootstrap/providers.php

@@ -2,4 +2,5 @@
 
 return [
     App\Providers\AppServiceProvider::class,
+    App\Providers\GateServiceProvider::class,
 ];

routes/notifications.php

@@ -3,12 +3,7 @@
 use App\Http\Controllers\NotificationsController;
 use Illuminate\Support\Facades\Route;
 
-Route::middleware(['web', 'auth:sanctum'])->get('/users/{id}/notifications', [NotificationsController::class, "getNotifications"])
-    ->whereNumber('id');
+Route::middleware(['web', 'auth:sanctum'])->get('/users/notifications', [NotificationsController::class, "getNotifications"]);
 
-Route::middleware(['web', 'auth:sanctum'])->post("/users/{id}/create/notification", [NotificationsController::class, "createNotification"])
-    ->whereNumber('id');
-
-Route::middleware(['web', 'auth:sanctum'])->delete('/users/{userId}/delete/notification/{notificationId}', [NotificationsController::class, 'deleteNotification'])
-    ->whereNumber('userId')
+Route::middleware(['web', 'auth:sanctum'])->delete('/users/delete/notification/{notificationId}', [NotificationsController::class, 'deleteNotification'])
     ->whereNumber('notificationId');

tests/Notifications/Create notification.bru

@@ -1,27 +0,0 @@
-meta {
-  name: Create notification
-  type: http
-  seq: 12
-}
-
-post {
-  url: {{url}}/api/users/{{id}}/create/notification
-  body: json
-  auth: inherit
-}
-
-body:json {
-  {
-    "content": "{{content}}"
-  }
-}
-
-vars:pre-request {
-  id: 12
-  content: test
-}
-
-settings {
-  encodeUrl: true
-  timeout: 0
-}

tests/Notifications/Delete user notification.bru

@@ -5,14 +5,13 @@ meta {
 }
 
 delete {
-  url: {{url}}/api/users/{{userId}}/delete/notification/{{notificationId}}
+  url: {{url}}/api/users/delete/notification/{{notificationId}}
   body: none
   auth: inherit
 }
 
 vars:pre-request {
-  userId: 
-  notificationId: 
+  notificationId: 3
 }
 
 settings {

tests/Notifications/Get user notifications.bru

@@ -1,19 +1,15 @@
 meta {
   name: Get user notifications
   type: http
-  seq: 12
+  seq: 2
 }
 
 get {
-  url: {{url}}/api/users/{{id}}/notifications
+  url: {{url}}/api/users/notifications
   body: none
   auth: inherit
 }
 
-vars:pre-request {
-  id: 12
-}
-
 settings {
   encodeUrl: true
   timeout: 0

tests/Users/Modify user role.bru

@@ -17,8 +17,8 @@ body:json {
 }
 
 vars:pre-request {
-  role: 
-  id: 
+  role: 2
+  id: 12
 }
 
 assert {