diff --git a/app/Filament/User/Resources/PackingResource.php b/app/Filament/User/Resources/PackingResource.php index f1135fd..3982757 100644 --- a/app/Filament/User/Resources/PackingResource.php +++ b/app/Filament/User/Resources/PackingResource.php @@ -2,6 +2,7 @@ namespace App\Filament\User\Resources; +use App\Traits\EnforcesRoles; use App\Filament\User\Resources\PackingResource\Pages; use App\Filament\User\Resources\PackingResource\RelationManagers; use App\Models\Packing; @@ -15,6 +16,7 @@ use Illuminate\Database\Eloquent\SoftDeletingScope; class PackingResource extends Resource { + use EnforcesRoles; protected static ?string $model = Packing::class; protected static ?string $navgationLabel = 'Verpackung & Größe'; protected static ?string $modelLabel = 'Verpackung & Größe'; diff --git a/app/Filament/User/Resources/ProductInventoryResource.php b/app/Filament/User/Resources/ProductInventoryResource.php index d2c5e67..e3522f1 100644 --- a/app/Filament/User/Resources/ProductInventoryResource.php +++ b/app/Filament/User/Resources/ProductInventoryResource.php @@ -2,6 +2,7 @@ namespace App\Filament\User\Resources; +use App\Traits\EnforcesRoles; use App\Filament\User\Resources\ProductInventoryResource\Pages; use Filament\Forms; use Filament\Forms\Form; @@ -17,6 +18,7 @@ use Illuminate\Support\Facades\DB; class ProductInventoryResource extends Resource { + use EnforcesRoles; protected static ?string $model = ProductInventory::class; protected static ?string $navigationIcon = 'heroicon-o-inbox'; diff --git a/app/Filament/User/Resources/ProductResource.php b/app/Filament/User/Resources/ProductResource.php index 83a72e2..9c1b872 100644 --- a/app/Filament/User/Resources/ProductResource.php +++ b/app/Filament/User/Resources/ProductResource.php @@ -2,6 +2,7 @@ namespace App\Filament\User\Resources; +use App\Traits\EnforcesRoles; use App\Filament\User\Resources\ProductResource\Pages; use App\Filament\User\Resources\ProductResource\RelationManagers; use App\Models\Packing; diff --git a/app/Filament/User/Resources/ProductSaleResource.php b/app/Filament/User/Resources/ProductSaleResource.php index 074e18c..780a833 100644 --- a/app/Filament/User/Resources/ProductSaleResource.php +++ b/app/Filament/User/Resources/ProductSaleResource.php @@ -2,6 +2,7 @@ namespace App\Filament\User\Resources; +use App\Traits\EnforcesRoles; use App\Filament\User\Resources\ProductSaleResource\Pages; use App\Models\ProductSale; use App\Models\Product; diff --git a/app/Filament/User/Resources/SpiceResource.php b/app/Filament/User/Resources/SpiceResource.php index 2e6e52c..f2cd20e 100644 --- a/app/Filament/User/Resources/SpiceResource.php +++ b/app/Filament/User/Resources/SpiceResource.php @@ -2,6 +2,7 @@ namespace App\Filament\User\Resources; +use App\Traits\EnforcesRoles; use App\Filament\User\Resources\SpiceResource\Pages; use App\Filament\User\Resources\SpiceResource\RelationManagers; use App\Models\Spice; @@ -16,6 +17,7 @@ use Illuminate\Database\Eloquent\SoftDeletingScope; class SpiceResource extends Resource { + use EnforcesRoles; protected static ?string $model = Spice::class; protected static ?string $navgationLabel = 'Rohstoffe'; protected static ?string $modelLabel = 'Rohstoff'; diff --git a/app/Filament/User/Resources/SpiceSupplierResource.php b/app/Filament/User/Resources/SpiceSupplierResource.php index d692f70..00f25fa 100644 --- a/app/Filament/User/Resources/SpiceSupplierResource.php +++ b/app/Filament/User/Resources/SpiceSupplierResource.php @@ -2,6 +2,7 @@ namespace App\Filament\User\Resources; +use App\Traits\EnforcesRoles; use App\Filament\User\Resources\SpiceSupplierResource\Pages; use App\Filament\User\Resources\SpiceSupplierResource\RelationManagers; use App\Models\SpiceSupplier; @@ -23,6 +24,7 @@ use Filament\Tables\Columns\TextColumn; class SpiceSupplierResource extends Resource { + use EnforcesRoles; protected static ?string $model = SpiceSupplier::class; protected static ?string $navigationIcon = 'heroicon-o-arrow-down-on-square'; diff --git a/app/Filament/User/Resources/SupplierResource.php b/app/Filament/User/Resources/SupplierResource.php index a79ebfc..5afc539 100644 --- a/app/Filament/User/Resources/SupplierResource.php +++ b/app/Filament/User/Resources/SupplierResource.php @@ -2,6 +2,7 @@ namespace App\Filament\User\Resources; +use App\Traits\EnforcesRoles; use App\Filament\User\Resources\SupplierResource\Pages; use App\Filament\User\Resources\SupplierResource\RelationManagers; use App\Models\Supplier; @@ -15,6 +16,7 @@ use Illuminate\Database\Eloquent\SoftDeletingScope; class SupplierResource extends Resource { + use EnforcesRoles; protected static ?string $model = Supplier::class; protected static ?string $navigationIcon = 'heroicon-o-user'; diff --git a/app/Http/Controllers/OAuthController.php b/app/Http/Controllers/OAuthController.php index 8aad1a3..a7c99f9 100644 --- a/app/Http/Controllers/OAuthController.php +++ b/app/Http/Controllers/OAuthController.php @@ -19,6 +19,13 @@ class OAuthController extends Controller { $socialUser = Socialite::driver('nextcloud')->user(); + $ncGroups = $socialUser->getRaw()['ocs']['data']['groups'] ?? []; + $smsRoles = array_intersect($ncGroups, ['sms-admin', 'sms-manager', 'sms-viewer']); + + if (empty($smsRoles)) { + abort(403, 'Kein Zugriff — bitte einer SMS-Gruppe in Nextcloud beitreten.'); + } + $user = User::firstOrCreate( ['email' => $socialUser->getEmail()], [ @@ -27,6 +34,8 @@ class OAuthController extends Controller ] ); + $user->syncRoles(array_values($smsRoles)); + Auth::login($user, remember: true); return redirect('/dashboard'); diff --git a/app/Models/User.php b/app/Models/User.php index 35da6be..2d3c9ec 100644 --- a/app/Models/User.php +++ b/app/Models/User.php @@ -7,10 +7,11 @@ use Filament\Panel; use Illuminate\Database\Eloquent\Factories\HasFactory; use Illuminate\Foundation\Auth\User as Authenticatable; use Illuminate\Notifications\Notifiable; +use Spatie\Permission\Traits\HasRoles; class User extends Authenticatable implements FilamentUser { - use HasFactory, Notifiable; + use HasFactory, Notifiable, HasRoles; /** * The attributes that are mass assignable. @@ -48,6 +49,6 @@ class User extends Authenticatable implements FilamentUser public function canAccessPanel(Panel $panel): bool { - return true; // allow all authenticated users access to the dashboard + return $this->hasAnyRole(['sms-admin', 'sms-manager', 'sms-viewer']); } } diff --git a/app/Traits/EnforcesRoles.php b/app/Traits/EnforcesRoles.php new file mode 100644 index 0000000..db7bc23 --- /dev/null +++ b/app/Traits/EnforcesRoles.php @@ -0,0 +1,33 @@ +user()?->hasAnyRole(['sms-admin', 'sms-manager']) ?? false; + } + + public static function canCreate(): bool + { + return static::canWrite(); + } + + public static function canEdit(Model $record): bool + { + return static::canWrite(); + } + + public static function canDelete(Model $record): bool + { + return static::canWrite(); + } + + public static function canDeleteAny(): bool + { + return static::canWrite(); + } +} diff --git a/composer.json b/composer.json index cf93fdf..5c6eaee 100644 --- a/composer.json +++ b/composer.json @@ -15,6 +15,7 @@ "picqer/php-barcode-generator": "^3.3", "socialiteproviders/nextcloud": "^4.0", "spatie/laravel-activitylog": "^4.9", + "spatie/laravel-permission": "^6.25", "z3d0x/filament-logger": "^0.7.2" }, "require-dev": { diff --git a/composer.lock b/composer.lock index 26b2a4f..4d474a2 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "e8477e7313b54ea6c6a999f2afe73f6d", + "content-hash": "cb046d713c2a9006fb88cddbaf151b95", "packages": [ { "name": "anourvalar/eloquent-serialize", @@ -5739,6 +5739,90 @@ ], "time": "2026-08-26T09:13:25+00:00" }, + { + "name": "spatie/laravel-permission", + "version": "6.25.0", + "source": { + "type": "git", + "url": "https://github.com/spatie/laravel-permission.git", + "reference": "d7d4cb0d58616722f1afc90e0484e4825155b9b3" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/spatie/laravel-permission/zipball/d7d4cb0d58616722f1afc90e0484e4825155b9b3", + "reference": "d7d4cb0d58616722f1afc90e0484e4825155b9b3", + "shasum": "" + }, + "require": { + "illuminate/auth": "^8.12|^9.0|^10.0|^11.0|^12.0|^13.0", + "illuminate/container": "^8.12|^9.0|^10.0|^11.0|^12.0|^13.0", + "illuminate/contracts": "^8.12|^9.0|^10.0|^11.0|^12.0|^13.0", + "illuminate/database": "^8.12|^9.0|^10.0|^11.0|^12.0|^13.0", + "php": "^8.0" + }, + "require-dev": { + "laravel/passport": "^11.0|^12.0|^13.0", + "laravel/pint": "^1.0", + "orchestra/testbench": "^6.23|^7.0|^8.0|^9.0|^10.0|^11.0", + "pestphp/pest": "^2.0|^3.0|^4.0", + "pestphp/pest-plugin-laravel": "^2.0|^3.0|^4.0" + }, + "type": "library", + "extra": { + "laravel": { + "providers": [ + "Spatie\\Permission\\PermissionServiceProvider" + ] + }, + "branch-alias": { + "dev-main": "6.x-dev", + "dev-master": "6.x-dev" + } + }, + "autoload": { + "files": [ + "src/helpers.php" + ], + "psr-4": { + "Spatie\\Permission\\": "src" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Freek Van der Herten", + "email": "freek@spatie.be", + "homepage": "https://spatie.be", + "role": "Developer" + } + ], + "description": "Permission handling for Laravel 8.0 and up", + "homepage": "https://github.com/spatie/laravel-permission", + "keywords": [ + "acl", + "laravel", + "permission", + "permissions", + "rbac", + "roles", + "security", + "spatie" + ], + "support": { + "issues": "https://github.com/spatie/laravel-permission/issues", + "source": "https://github.com/spatie/laravel-permission/tree/6.25.0" + }, + "funding": [ + { + "url": "https://github.com/spatie", + "type": "github" + } + ], + "time": "2026-03-17T22:46:46+00:00" + }, { "name": "symfony/clock", "version": "v8.1.0", diff --git a/config/permission.php b/config/permission.php new file mode 100644 index 0000000..85b8832 --- /dev/null +++ b/config/permission.php @@ -0,0 +1,206 @@ + [ + + /* + * When using the "HasPermissions" trait from this package, we need to know which + * Eloquent model should be used to retrieve your permissions. Of course, it + * is often just the "Permission" model but you may use whatever you like. + * + * The model you want to use as a Permission model needs to implement the + * `Spatie\Permission\Contracts\Permission` contract. + */ + + 'permission' => Permission::class, + + /* + * When using the "HasRoles" trait from this package, we need to know which + * Eloquent model should be used to retrieve your roles. Of course, it + * is often just the "Role" model but you may use whatever you like. + * + * The model you want to use as a Role model needs to implement the + * `Spatie\Permission\Contracts\Role` contract. + */ + + 'role' => Role::class, + + ], + + 'table_names' => [ + + /* + * When using the "HasRoles" trait from this package, we need to know which + * table should be used to retrieve your roles. We have chosen a basic + * default value but you may easily change it to any table you like. + */ + + 'roles' => 'roles', + + /* + * When using the "HasPermissions" trait from this package, we need to know which + * table should be used to retrieve your permissions. We have chosen a basic + * default value but you may easily change it to any table you like. + */ + + 'permissions' => 'permissions', + + /* + * When using the "HasPermissions" trait from this package, we need to know which + * table should be used to retrieve your models permissions. We have chosen a + * basic default value but you may easily change it to any table you like. + */ + + 'model_has_permissions' => 'model_has_permissions', + + /* + * When using the "HasRoles" trait from this package, we need to know which + * table should be used to retrieve your models roles. We have chosen a + * basic default value but you may easily change it to any table you like. + */ + + 'model_has_roles' => 'model_has_roles', + + /* + * When using the "HasRoles" trait from this package, we need to know which + * table should be used to retrieve your roles permissions. We have chosen a + * basic default value but you may easily change it to any table you like. + */ + + 'role_has_permissions' => 'role_has_permissions', + ], + + 'column_names' => [ + /* + * Change this if you want to name the related pivots other than defaults + */ + 'role_pivot_key' => null, // default 'role_id', + 'permission_pivot_key' => null, // default 'permission_id', + + /* + * Change this if you want to name the related model primary key other than + * `model_id`. + * + * For example, this would be nice if your primary keys are all UUIDs. In + * that case, name this `model_uuid`. + */ + + 'model_morph_key' => 'model_id', + + /* + * Change this if you want to use the teams feature and your related model's + * foreign key is other than `team_id`. + */ + + 'team_foreign_key' => 'team_id', + ], + + /* + * When set to true, the method for checking permissions will be registered on the gate. + * Set this to false if you want to implement custom logic for checking permissions. + */ + + 'register_permission_check_method' => true, + + /* + * When set to true, Laravel\Octane\Events\OperationTerminated event listener will be registered + * this will refresh permissions on every TickTerminated, TaskTerminated and RequestTerminated + * NOTE: This should not be needed in most cases, but an Octane/Vapor combination benefited from it. + */ + 'register_octane_reset_listener' => false, + + /* + * Events will fire when a role or permission is assigned/unassigned: + * \Spatie\Permission\Events\RoleAttached + * \Spatie\Permission\Events\RoleDetached + * \Spatie\Permission\Events\PermissionAttached + * \Spatie\Permission\Events\PermissionDetached + * + * To enable, set to true, and then create listeners to watch these events. + */ + 'events_enabled' => false, + + /* + * Teams Feature. + * When set to true the package implements teams using the 'team_foreign_key'. + * If you want the migrations to register the 'team_foreign_key', you must + * set this to true before doing the migration. + * If you already did the migration then you must make a new migration to also + * add 'team_foreign_key' to 'roles', 'model_has_roles', and 'model_has_permissions' + * (view the latest version of this package's migration file) + */ + + 'teams' => false, + + /* + * The class to use to resolve the permissions team id + */ + 'team_resolver' => DefaultTeamResolver::class, + + /* + * Passport Client Credentials Grant + * When set to true the package will use Passports Client to check permissions + */ + + 'use_passport_client_credentials' => false, + + /* + * When set to true, the required permission names are added to exception messages. + * This could be considered an information leak in some contexts, so the default + * setting is false here for optimum safety. + */ + + 'display_permission_in_exception' => false, + + /* + * When set to true, the required role names are added to exception messages. + * This could be considered an information leak in some contexts, so the default + * setting is false here for optimum safety. + */ + + 'display_role_in_exception' => false, + + /* + * By default wildcard permission lookups are disabled. + * See documentation to understand supported syntax. + */ + + 'enable_wildcard_permission' => false, + + /* + * The class to use for interpreting wildcard permissions. + * If you need to modify delimiters, override the class and specify its name here. + */ + // 'wildcard_permission' => Spatie\Permission\WildcardPermission::class, + + /* Cache-specific settings */ + + 'cache' => [ + + /* + * By default all permissions are cached for 24 hours to speed up performance. + * When permissions or roles are updated the cache is flushed automatically. + */ + + 'expiration_time' => DateInterval::createFromDateString('24 hours'), + + /* + * The cache key used to store all permissions. + */ + + 'key' => 'spatie.permission.cache', + + /* + * You may optionally indicate a specific cache driver to use for permission and + * role caching using any of the `store` drivers listed in the cache.php config + * file. Using 'default' here means to use the `default` set in cache.php. + */ + + 'store' => 'default', + ], +]; diff --git a/config/services.php b/config/services.php index d2fdd85..40d8d06 100644 --- a/config/services.php +++ b/config/services.php @@ -36,10 +36,10 @@ return [ ], 'nextcloud' => [ - 'client_id' => env('OAUTH_CLOUDSPICESBLUE_ID'), + 'client_id' => env('OAUTH_CLOUDSPICESBLUE_ID'), 'client_secret' => env('OAUTH_CLOUDSPICESBLUE_SECRETKEY'), 'redirect' => env('OAUTH_CLOUDSPICESBLUE_REDIRECTURI'), - 'base_url' => 'https://cloud.spices.blue', + 'instance_uri' => 'https://cloud.spices.blue', ], 'shopify' => [ diff --git a/database/migrations/2026_09_12_234528_create_permission_tables.php b/database/migrations/2026_09_12_234528_create_permission_tables.php new file mode 100644 index 0000000..66ce1f9 --- /dev/null +++ b/database/migrations/2026_09_12_234528_create_permission_tables.php @@ -0,0 +1,134 @@ +engine('InnoDB'); + $table->bigIncrements('id'); // permission id + $table->string('name'); // For MyISAM use string('name', 225); // (or 166 for InnoDB with Redundant/Compact row format) + $table->string('guard_name'); // For MyISAM use string('guard_name', 25); + $table->timestamps(); + + $table->unique(['name', 'guard_name']); + }); + + Schema::create($tableNames['roles'], static function (Blueprint $table) use ($teams, $columnNames) { + // $table->engine('InnoDB'); + $table->bigIncrements('id'); // role id + if ($teams || config('permission.testing')) { // permission.testing is a fix for sqlite testing + $table->unsignedBigInteger($columnNames['team_foreign_key'])->nullable(); + $table->index($columnNames['team_foreign_key'], 'roles_team_foreign_key_index'); + } + $table->string('name'); // For MyISAM use string('name', 225); // (or 166 for InnoDB with Redundant/Compact row format) + $table->string('guard_name'); // For MyISAM use string('guard_name', 25); + $table->timestamps(); + if ($teams || config('permission.testing')) { + $table->unique([$columnNames['team_foreign_key'], 'name', 'guard_name']); + } else { + $table->unique(['name', 'guard_name']); + } + }); + + Schema::create($tableNames['model_has_permissions'], static function (Blueprint $table) use ($tableNames, $columnNames, $pivotPermission, $teams) { + $table->unsignedBigInteger($pivotPermission); + + $table->string('model_type'); + $table->unsignedBigInteger($columnNames['model_morph_key']); + $table->index([$columnNames['model_morph_key'], 'model_type'], 'model_has_permissions_model_id_model_type_index'); + + $table->foreign($pivotPermission) + ->references('id') // permission id + ->on($tableNames['permissions']) + ->onDelete('cascade'); + if ($teams) { + $table->unsignedBigInteger($columnNames['team_foreign_key']); + $table->index($columnNames['team_foreign_key'], 'model_has_permissions_team_foreign_key_index'); + + $table->primary([$columnNames['team_foreign_key'], $pivotPermission, $columnNames['model_morph_key'], 'model_type'], + 'model_has_permissions_permission_model_type_primary'); + } else { + $table->primary([$pivotPermission, $columnNames['model_morph_key'], 'model_type'], + 'model_has_permissions_permission_model_type_primary'); + } + + }); + + Schema::create($tableNames['model_has_roles'], static function (Blueprint $table) use ($tableNames, $columnNames, $pivotRole, $teams) { + $table->unsignedBigInteger($pivotRole); + + $table->string('model_type'); + $table->unsignedBigInteger($columnNames['model_morph_key']); + $table->index([$columnNames['model_morph_key'], 'model_type'], 'model_has_roles_model_id_model_type_index'); + + $table->foreign($pivotRole) + ->references('id') // role id + ->on($tableNames['roles']) + ->onDelete('cascade'); + if ($teams) { + $table->unsignedBigInteger($columnNames['team_foreign_key']); + $table->index($columnNames['team_foreign_key'], 'model_has_roles_team_foreign_key_index'); + + $table->primary([$columnNames['team_foreign_key'], $pivotRole, $columnNames['model_morph_key'], 'model_type'], + 'model_has_roles_role_model_type_primary'); + } else { + $table->primary([$pivotRole, $columnNames['model_morph_key'], 'model_type'], + 'model_has_roles_role_model_type_primary'); + } + }); + + Schema::create($tableNames['role_has_permissions'], static function (Blueprint $table) use ($tableNames, $pivotRole, $pivotPermission) { + $table->unsignedBigInteger($pivotPermission); + $table->unsignedBigInteger($pivotRole); + + $table->foreign($pivotPermission) + ->references('id') // permission id + ->on($tableNames['permissions']) + ->onDelete('cascade'); + + $table->foreign($pivotRole) + ->references('id') // role id + ->on($tableNames['roles']) + ->onDelete('cascade'); + + $table->primary([$pivotPermission, $pivotRole], 'role_has_permissions_permission_id_role_id_primary'); + }); + + app('cache') + ->store(config('permission.cache.store') != 'default' ? config('permission.cache.store') : null) + ->forget(config('permission.cache.key')); + } + + /** + * Reverse the migrations. + */ + public function down(): void + { + $tableNames = config('permission.table_names'); + + throw_if(empty($tableNames), Exception::class, 'Error: config/permission.php not found and defaults could not be merged. Please publish the package configuration before proceeding, or drop the tables manually.'); + + Schema::drop($tableNames['role_has_permissions']); + Schema::drop($tableNames['model_has_roles']); + Schema::drop($tableNames['model_has_permissions']); + Schema::drop($tableNames['roles']); + Schema::drop($tableNames['permissions']); + } +}; diff --git a/database/migrations/2026_09_13_000001_seed_sms_roles.php b/database/migrations/2026_09_13_000001_seed_sms_roles.php new file mode 100644 index 0000000..6d74a25 --- /dev/null +++ b/database/migrations/2026_09_13_000001_seed_sms_roles.php @@ -0,0 +1,21 @@ +forgetCachedPermissions(); + + foreach (['sms-admin', 'sms-manager', 'sms-viewer'] as $role) { + Role::firstOrCreate(['name' => $role, 'guard_name' => 'web']); + } + } + + public function down(): void + { + Role::whereIn('name', ['sms-admin', 'sms-manager', 'sms-viewer'])->delete(); + } +};