From ae81344fe2e397508ef403469fadf3ff152d2a52 Mon Sep 17 00:00:00 2001 From: Giovanni-Josserand Date: Wed, 17 Dec 2025 14:46:33 +0100 Subject: [PATCH 1/5] add notification when user role is changed --- app/Http/Controllers/UserController.php | 8 +++++++- tests/Users/Modify user role.bru | 4 ++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/app/Http/Controllers/UserController.php b/app/Http/Controllers/UserController.php index 1f45734..ce2830f 100644 --- a/app/Http/Controllers/UserController.php +++ b/app/Http/Controllers/UserController.php @@ -15,7 +15,7 @@ use Propaganistas\LaravelPhone\PhoneNumber; class UserController extends Controller { public function isAdmin(int $role) { - if($role != 1) return false; + if($role != 1 && $role != 2) return false; return true; } @@ -158,6 +158,12 @@ class UserController extends Controller $user->role = $request['role']; $user->save(); + $role = GetRole::getRole($request['role']); + $notification = Notification::create([ + 'content' => "Votre rôle à changé pour {$role} !", + ]); + $notification->users()->attach($user->id); + return response()->json(['message' => 'User role added successfully']); } catch(\Exception $e) { Log::info($e->getMessage()); diff --git a/tests/Users/Modify user role.bru b/tests/Users/Modify user role.bru index 2842c82..20374bd 100644 --- a/tests/Users/Modify user role.bru +++ b/tests/Users/Modify user role.bru @@ -17,8 +17,8 @@ body:json { } vars:pre-request { - role: - id: + role: 2 + id: 12 } assert { From 4c3647fe30d40cbdc9e987177b518acad8b21da4 Mon Sep 17 00:00:00 2001 From: Giovanni-Josserand Date: Wed, 17 Dec 2025 16:14:19 +0100 Subject: [PATCH 2/5] add gates for users routes --- app/Http/Controllers/Controller.php | 4 ++- app/Http/Controllers/SearchController.php | 8 ++++- app/Http/Controllers/UserController.php | 7 ++--- app/Providers/GateServiceProvider.php | 36 +++++++++++++++++++++++ bootstrap/providers.php | 1 + 5 files changed, 49 insertions(+), 7 deletions(-) create mode 100644 app/Providers/GateServiceProvider.php diff --git a/app/Http/Controllers/Controller.php b/app/Http/Controllers/Controller.php index 8677cd5..e7f7c94 100644 --- a/app/Http/Controllers/Controller.php +++ b/app/Http/Controllers/Controller.php @@ -2,7 +2,9 @@ namespace App\Http\Controllers; +use Illuminate\Foundation\Auth\Access\AuthorizesRequests; + abstract class Controller { - // + use AuthorizesRequests; } diff --git a/app/Http/Controllers/SearchController.php b/app/Http/Controllers/SearchController.php index 085379f..4dd1878 100644 --- a/app/Http/Controllers/SearchController.php +++ b/app/Http/Controllers/SearchController.php @@ -68,6 +68,12 @@ class SearchController extends Controller public function searchEvents(Request $request) { try { + try { + $this->client->collections['events']->delete(); + } catch (\Exception $e) { + // ignore si la collection n'existe pas + } + $this->createEventsCollection(); $this->indexEvents(); $query = $request->input('query', ''); @@ -141,13 +147,13 @@ class SearchController extends Controller public function searchUsers(Request $request) { try { + $this->authorize('searchUsers'); try { $this->client->collections['users']->delete(); } catch (\Exception $e) { // ignore si la collection n'existe pas } - $this->createUsersCollection(); $this->indexUsers(); $query = $request->input('query', ''); diff --git a/app/Http/Controllers/UserController.php b/app/Http/Controllers/UserController.php index ce2830f..623fcb6 100644 --- a/app/Http/Controllers/UserController.php +++ b/app/Http/Controllers/UserController.php @@ -14,13 +14,9 @@ use Propaganistas\LaravelPhone\PhoneNumber; class UserController extends Controller { - public function isAdmin(int $role) { - if($role != 1 && $role != 2) return false; - return true; - } - public function me(Request $request): JsonResponse { try { + $this->authorize('me'); return response()->json(UserService::getData($request->user()->id)); } catch(\Exception $e) { Log::info($e->getMessage()); @@ -191,6 +187,7 @@ class UserController extends Controller public function getUserTasks(Request $request): JsonResponse { try { + $this->authorize('getUserTasks'); return response()->json(['data' => $request->user()->tasks]); } catch (\Exception $e) { Log::info($e->getMessage()); diff --git a/app/Providers/GateServiceProvider.php b/app/Providers/GateServiceProvider.php new file mode 100644 index 0000000..ff38a90 --- /dev/null +++ b/app/Providers/GateServiceProvider.php @@ -0,0 +1,36 @@ + Date: Wed, 17 Dec 2025 16:52:43 +0100 Subject: [PATCH 3/5] remove unecessary gates for users routes and add UserPolicy --- app/Http/Controllers/SearchController.php | 1 - app/Http/Controllers/UserController.php | 11 ++++------- app/Policies/UserPolicy.php | 24 +++++++++++++++++++++++ app/Providers/GateServiceProvider.php | 13 ++---------- artisan | 0 bootstrap/cache/.gitignore | 0 storage/app/.gitignore | 0 storage/app/private/.gitignore | 0 storage/app/public/.gitignore | 0 storage/framework/.gitignore | 0 storage/framework/cache/.gitignore | 0 storage/framework/cache/data/.gitignore | 0 storage/framework/sessions/.gitignore | 0 storage/framework/testing/.gitignore | 0 storage/framework/views/.gitignore | 0 storage/logs/.gitignore | 0 16 files changed, 30 insertions(+), 19 deletions(-) create mode 100644 app/Policies/UserPolicy.php mode change 100755 => 100644 artisan mode change 100755 => 100644 bootstrap/cache/.gitignore mode change 100755 => 100644 storage/app/.gitignore mode change 100755 => 100644 storage/app/private/.gitignore mode change 100755 => 100644 storage/app/public/.gitignore mode change 100755 => 100644 storage/framework/.gitignore mode change 100755 => 100644 storage/framework/cache/.gitignore mode change 100755 => 100644 storage/framework/cache/data/.gitignore mode change 100755 => 100644 storage/framework/sessions/.gitignore mode change 100755 => 100644 storage/framework/testing/.gitignore mode change 100755 => 100644 storage/framework/views/.gitignore mode change 100755 => 100644 storage/logs/.gitignore diff --git a/app/Http/Controllers/SearchController.php b/app/Http/Controllers/SearchController.php index 4dd1878..8af18d4 100644 --- a/app/Http/Controllers/SearchController.php +++ b/app/Http/Controllers/SearchController.php @@ -147,7 +147,6 @@ class SearchController extends Controller public function searchUsers(Request $request) { try { - $this->authorize('searchUsers'); try { $this->client->collections['users']->delete(); } catch (\Exception $e) { diff --git a/app/Http/Controllers/UserController.php b/app/Http/Controllers/UserController.php index 623fcb6..3449b22 100644 --- a/app/Http/Controllers/UserController.php +++ b/app/Http/Controllers/UserController.php @@ -6,6 +6,7 @@ use App\Models\Notification; use App\Models\User; use Illuminate\Http\JsonResponse; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Gate; use Illuminate\Support\Facades\Hash; use Illuminate\Support\Facades\Log; use App\Services\GetRole; @@ -16,7 +17,6 @@ class UserController extends Controller { public function me(Request $request): JsonResponse { try { - $this->authorize('me'); return response()->json(UserService::getData($request->user()->id)); } catch(\Exception $e) { Log::info($e->getMessage()); @@ -68,15 +68,13 @@ class UserController extends Controller public function deleteById(Request $request, int $id): JsonResponse { - if(!$this->isAdmin($request->user()->role)){ + if(Gate::denies('deleteOther', $request->user())){ return response()->json(["message" => "Can't delete this user"], 403); } try { $user = User::find($id); - if($user->role === 1) return response()->json(["message" => "Can't delete this user"], 403); - $user->delete(); return response()->json(['message' => 'User deleted successfully']); } catch(\Exception $e) { @@ -116,7 +114,7 @@ class UserController extends Controller public function validate(Request $request, int $id): JsonResponse { - if($request->user()->role != 1 && $request->user()->role != 2 || $request->user()->role == null){ + if(Gate::denies('validate', $request->user())){ return response()->json(["message" => "Can't validate this user"], 403); } @@ -145,7 +143,7 @@ class UserController extends Controller public function addRole(Request $request, int $id): JsonResponse { - if(!$this->isAdmin($request->user()->role)){ + if(Gate::denies('addRole', $request->user())){ return response()->json(["message" => "Can't add role to this user"], 403); } @@ -187,7 +185,6 @@ class UserController extends Controller public function getUserTasks(Request $request): JsonResponse { try { - $this->authorize('getUserTasks'); return response()->json(['data' => $request->user()->tasks]); } catch (\Exception $e) { Log::info($e->getMessage()); diff --git a/app/Policies/UserPolicy.php b/app/Policies/UserPolicy.php new file mode 100644 index 0000000..c6a6dc5 --- /dev/null +++ b/app/Policies/UserPolicy.php @@ -0,0 +1,24 @@ +role === 1; + } + + public function validate(User $user, User $model): bool + { + return $user->role === 1 || $user->role === 2; + } + + public function addRole(User $user, User $model): bool + { + return $user->role === 1; + } +} diff --git a/app/Providers/GateServiceProvider.php b/app/Providers/GateServiceProvider.php index ff38a90..9b05b24 100644 --- a/app/Providers/GateServiceProvider.php +++ b/app/Providers/GateServiceProvider.php @@ -3,6 +3,7 @@ namespace App\Providers; use App\Models\User; +use App\Policies\UserPolicy; use Illuminate\Support\Facades\Gate; use Illuminate\Support\ServiceProvider; @@ -21,16 +22,6 @@ class GateServiceProvider extends ServiceProvider */ public function boot(): void { - Gate::define('me', function (User $user) { - return true; - }); - - Gate::define('getUserTasks', function (User $user) { - return true; - }); - - Gate::define('searchUsers', function (User $user) { - return true; - }); + Gate::policy(User::class, UserPolicy::class); } } diff --git a/artisan b/artisan old mode 100755 new mode 100644 diff --git a/bootstrap/cache/.gitignore b/bootstrap/cache/.gitignore old mode 100755 new mode 100644 diff --git a/storage/app/.gitignore b/storage/app/.gitignore old mode 100755 new mode 100644 diff --git a/storage/app/private/.gitignore b/storage/app/private/.gitignore old mode 100755 new mode 100644 diff --git a/storage/app/public/.gitignore b/storage/app/public/.gitignore old mode 100755 new mode 100644 diff --git a/storage/framework/.gitignore b/storage/framework/.gitignore old mode 100755 new mode 100644 diff --git a/storage/framework/cache/.gitignore b/storage/framework/cache/.gitignore old mode 100755 new mode 100644 diff --git a/storage/framework/cache/data/.gitignore b/storage/framework/cache/data/.gitignore old mode 100755 new mode 100644 diff --git a/storage/framework/sessions/.gitignore b/storage/framework/sessions/.gitignore old mode 100755 new mode 100644 diff --git a/storage/framework/testing/.gitignore b/storage/framework/testing/.gitignore old mode 100755 new mode 100644 diff --git a/storage/framework/views/.gitignore b/storage/framework/views/.gitignore old mode 100755 new mode 100644 diff --git a/storage/logs/.gitignore b/storage/logs/.gitignore old mode 100755 new mode 100644 From 08c51473a798281636bba93589a62a24b6e42f2f Mon Sep 17 00:00:00 2001 From: Giovanni-Josserand Date: Wed, 17 Dec 2025 17:11:12 +0100 Subject: [PATCH 4/5] add TasksPolicy and EventsPolicy --- app/Http/Controllers/EventsController.php | 7 +++--- app/Http/Controllers/TasksController.php | 16 ++++-------- app/Policies/EventsPolicy.php | 25 +++++++++++++++++++ app/Policies/TasksPolicy.php | 30 +++++++++++++++++++++++ app/Providers/GateServiceProvider.php | 6 +++++ 5 files changed, 70 insertions(+), 14 deletions(-) create mode 100644 app/Policies/EventsPolicy.php create mode 100644 app/Policies/TasksPolicy.php diff --git a/app/Http/Controllers/EventsController.php b/app/Http/Controllers/EventsController.php index 27176e1..d745121 100644 --- a/app/Http/Controllers/EventsController.php +++ b/app/Http/Controllers/EventsController.php @@ -6,6 +6,7 @@ use App\Models\Events; use http\Env\Response; use Illuminate\Http\Request; use Illuminate\Http\JsonResponse; +use Illuminate\Support\Facades\Gate; use Illuminate\Support\Facades\Log; use PHPUnit\Event\Event; @@ -13,7 +14,7 @@ class EventsController extends Controller { public function create(Request $request): JsonResponse { - if ($request->user()->role != 1) { + if (Gate::denies('create', Events::class)) { return response()->json(['message' => 'Forbidden'], 403); } @@ -37,7 +38,7 @@ class EventsController extends Controller public function update(Request $request, int $id): JsonResponse { - if ($request->user()->role != 1) { + if (Gate::denies('update', Events::class)) { return response()->json(['message' => 'Forbidden'], 403); } @@ -76,7 +77,7 @@ class EventsController extends Controller public function delete(Request $request, int $id): JsonResponse { - if ($request->user()->role != 1) { + if (Gate::denies('delete', Events::class)) { return response()->json(['message' => 'Forbidden'], 403); } diff --git a/app/Http/Controllers/TasksController.php b/app/Http/Controllers/TasksController.php index 1de2456..bf059a4 100644 --- a/app/Http/Controllers/TasksController.php +++ b/app/Http/Controllers/TasksController.php @@ -7,20 +7,14 @@ use App\Models\Task; use App\Models\User; use Illuminate\Http\JsonResponse; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Gate; use Illuminate\Support\Facades\Log; class TasksController extends Controller { - - public function isAdmin(int $role) { - if($role != 1) return false; - return true; - } - - public function create(Request $request): JsonResponse { - if(!$this->isAdmin($request->user()->role)){ + if(Gate::denies('create', Task::class)) { return response()->json(["message" => "Can't create task"], 403); } @@ -67,7 +61,7 @@ class TasksController extends Controller public function assignUser(request $request, int $id): JsonResponse { - if(!$this->isAdmin($request->user()->role)){ + if(Gate::denies('assignOther', Task::class)) { return response()->json(["message" => "Can't create task"], 403); } @@ -108,7 +102,7 @@ class TasksController extends Controller public function deleteTask(Request $request, int $id): JsonResponse { - if(!$this->isAdmin($request->user()->role)){ + if(Gate::denies('delete', Task::class)) { return response()->json(["message" => "Can't delete task"], 403); } @@ -126,7 +120,7 @@ class TasksController extends Controller public function update(Request $request, int $id): JsonResponse { - if(!$this->isAdmin($request->user()->role)){ + if(Gate::denies('update', Task::class)) { return response()->json(["message" => "Forbidden"], 403); } diff --git a/app/Policies/EventsPolicy.php b/app/Policies/EventsPolicy.php new file mode 100644 index 0000000..0273ad5 --- /dev/null +++ b/app/Policies/EventsPolicy.php @@ -0,0 +1,25 @@ +role === 1 || $user->role === 2; + } + + public function update(User $user, Events $model): bool + { + return $user->role === 1 || $user->role === 2; + } + + public function delete(User $user, Events $model): bool + { + return $user->role === 1 || $user->role === 2; + } +} diff --git a/app/Policies/TasksPolicy.php b/app/Policies/TasksPolicy.php new file mode 100644 index 0000000..bc609cc --- /dev/null +++ b/app/Policies/TasksPolicy.php @@ -0,0 +1,30 @@ +role === 1 || $user->role === 2; + } + + public function assignOther(User $user, Task $model): bool + { + return $user->role === 1 || $user->role === 2; + } + + public function delete(User $user, Task $model): bool + { + return $user->role === 1 || $user->role === 2; + } + + public function update(User $user, Task $model): bool + { + return $user->role === 1 || $user->role === 2; + } +} diff --git a/app/Providers/GateServiceProvider.php b/app/Providers/GateServiceProvider.php index 9b05b24..8eeacab 100644 --- a/app/Providers/GateServiceProvider.php +++ b/app/Providers/GateServiceProvider.php @@ -2,7 +2,11 @@ namespace App\Providers; +use App\Models\Events; +use App\Models\Task; use App\Models\User; +use App\Policies\EventsPolicy; +use App\Policies\TasksPolicy; use App\Policies\UserPolicy; use Illuminate\Support\Facades\Gate; use Illuminate\Support\ServiceProvider; @@ -23,5 +27,7 @@ class GateServiceProvider extends ServiceProvider public function boot(): void { Gate::policy(User::class, UserPolicy::class); + Gate::policy(Events::class, EventsPolicy::class); + Gate::policy(Task::class, TasksPolicy::class); } } From 08459ac627491324b6fb8d38b26befecc00d67c5 Mon Sep 17 00:00:00 2001 From: Giovanni-Josserand Date: Wed, 17 Dec 2025 17:18:37 +0100 Subject: [PATCH 5/5] change notifications functions --- .../Controllers/NotificationsController.php | 24 +++-------------- routes/notifications.php | 9 ++----- tests/Notifications/Create notification.bru | 27 ------------------- .../Delete user notification.bru | 5 ++-- .../Notifications/Get user notifications.bru | 8 ++---- 5 files changed, 10 insertions(+), 63 deletions(-) delete mode 100644 tests/Notifications/Create notification.bru diff --git a/app/Http/Controllers/NotificationsController.php b/app/Http/Controllers/NotificationsController.php index 5d70b58..b370b1a 100644 --- a/app/Http/Controllers/NotificationsController.php +++ b/app/Http/Controllers/NotificationsController.php @@ -10,24 +10,10 @@ use Illuminate\Support\Facades\Log; class NotificationsController extends Controller { - public function createNotification(Request $request, int $id): JsonResponse { - $notification = Notification::create([ - "content" => $request["content"] - ]); - - $notification->users()->attach($id); - - return response()->json(['message' => 'Notification created successfully']); - } - - - - public function getNotifications(Request $request, int $id): JsonResponse { + public function getNotifications(Request $request): JsonResponse { try { - $user = User::findOrFail($id); - return response()->json([ - 'data' => $user->notifications + 'data' => $request->user()->notifications ]); } catch(\Exception $e) { Log::info($e->getMessage()); @@ -37,10 +23,9 @@ class NotificationsController extends Controller - public function deleteNotification(int $userId, int $notificationId): JsonResponse { + public function deleteNotification(Request $request, int $notificationId): JsonResponse { try { - $user = User::findOrFail($userId); - $user->notifications()->detach($notificationId); + $request->user()->notifications()->detach($notificationId); $notification = Notification::find($notificationId); if ($notification && $notification->users()->count() === 0) { @@ -53,5 +38,4 @@ class NotificationsController extends Controller return response()->json(['message' => 'Erreur lors de la suppression'], 500); } } - } diff --git a/routes/notifications.php b/routes/notifications.php index 95c5026..8f34f18 100644 --- a/routes/notifications.php +++ b/routes/notifications.php @@ -3,12 +3,7 @@ use App\Http\Controllers\NotificationsController; use Illuminate\Support\Facades\Route; -Route::middleware(['web', 'auth:sanctum'])->get('/users/{id}/notifications', [NotificationsController::class, "getNotifications"]) - ->whereNumber('id'); +Route::middleware(['web', 'auth:sanctum'])->get('/users/notifications', [NotificationsController::class, "getNotifications"]); -Route::middleware(['web', 'auth:sanctum'])->post("/users/{id}/create/notification", [NotificationsController::class, "createNotification"]) - ->whereNumber('id'); - -Route::middleware(['web', 'auth:sanctum'])->delete('/users/{userId}/delete/notification/{notificationId}', [NotificationsController::class, 'deleteNotification']) - ->whereNumber('userId') +Route::middleware(['web', 'auth:sanctum'])->delete('/users/delete/notification/{notificationId}', [NotificationsController::class, 'deleteNotification']) ->whereNumber('notificationId'); diff --git a/tests/Notifications/Create notification.bru b/tests/Notifications/Create notification.bru deleted file mode 100644 index 996753a..0000000 --- a/tests/Notifications/Create notification.bru +++ /dev/null @@ -1,27 +0,0 @@ -meta { - name: Create notification - type: http - seq: 12 -} - -post { - url: {{url}}/api/users/{{id}}/create/notification - body: json - auth: inherit -} - -body:json { - { - "content": "{{content}}" - } -} - -vars:pre-request { - id: 12 - content: test -} - -settings { - encodeUrl: true - timeout: 0 -} diff --git a/tests/Notifications/Delete user notification.bru b/tests/Notifications/Delete user notification.bru index 0362d0a..e82eea3 100644 --- a/tests/Notifications/Delete user notification.bru +++ b/tests/Notifications/Delete user notification.bru @@ -5,14 +5,13 @@ meta { } delete { - url: {{url}}/api/users/{{userId}}/delete/notification/{{notificationId}} + url: {{url}}/api/users/delete/notification/{{notificationId}} body: none auth: inherit } vars:pre-request { - userId: - notificationId: + notificationId: 3 } settings { diff --git a/tests/Notifications/Get user notifications.bru b/tests/Notifications/Get user notifications.bru index 7c058fe..1df1955 100644 --- a/tests/Notifications/Get user notifications.bru +++ b/tests/Notifications/Get user notifications.bru @@ -1,19 +1,15 @@ meta { name: Get user notifications type: http - seq: 12 + seq: 2 } get { - url: {{url}}/api/users/{{id}}/notifications + url: {{url}}/api/users/notifications body: none auth: inherit } -vars:pre-request { - id: 12 -} - settings { encodeUrl: true timeout: 0