Roles via Nextcloud groups: sms-admin/manager/viewer + fix OAuth instance_uri

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/Filament/User/Resources/PackingResource.php

@@ -2,6 +2,7 @@
 
 namespace App\Filament\User\Resources;
 
+use App\Traits\EnforcesRoles;
 use App\Filament\User\Resources\PackingResource\Pages;
 use App\Filament\User\Resources\PackingResource\RelationManagers;
 use App\Models\Packing;
@@ -15,6 +16,7 @@ use Illuminate\Database\Eloquent\SoftDeletingScope;
 
 class PackingResource extends Resource
 {
+    use EnforcesRoles;
     protected static ?string $model = Packing::class;
     protected static ?string $navgationLabel = 'Verpackung & Größe';
     protected static ?string $modelLabel = 'Verpackung & Größe';

app/Filament/User/Resources/ProductInventoryResource.php

@@ -2,6 +2,7 @@
 
 namespace App\Filament\User\Resources;
 
+use App\Traits\EnforcesRoles;
 use App\Filament\User\Resources\ProductInventoryResource\Pages;
 use Filament\Forms;
 use Filament\Forms\Form;
@@ -17,6 +18,7 @@ use Illuminate\Support\Facades\DB;
 
 class ProductInventoryResource extends Resource
 {
+    use EnforcesRoles;
     protected static ?string $model = ProductInventory::class;
 
     protected static ?string $navigationIcon = 'heroicon-o-inbox';

app/Filament/User/Resources/ProductResource.php

@@ -2,6 +2,7 @@
 
 namespace App\Filament\User\Resources;
 
+use App\Traits\EnforcesRoles;
 use App\Filament\User\Resources\ProductResource\Pages;
 use App\Filament\User\Resources\ProductResource\RelationManagers;
 use App\Models\Packing;

app/Filament/User/Resources/ProductSaleResource.php

@@ -2,6 +2,7 @@
 
 namespace App\Filament\User\Resources;
 
+use App\Traits\EnforcesRoles;
 use App\Filament\User\Resources\ProductSaleResource\Pages;
 use App\Models\ProductSale;
 use App\Models\Product;

app/Filament/User/Resources/SpiceResource.php

@@ -2,6 +2,7 @@
 
 namespace App\Filament\User\Resources;
 
+use App\Traits\EnforcesRoles;
 use App\Filament\User\Resources\SpiceResource\Pages;
 use App\Filament\User\Resources\SpiceResource\RelationManagers;
 use App\Models\Spice;
@@ -16,6 +17,7 @@ use Illuminate\Database\Eloquent\SoftDeletingScope;
 
 class SpiceResource extends Resource
 {
+    use EnforcesRoles;
     protected static ?string $model = Spice::class;
     protected static ?string $navgationLabel = 'Rohstoffe';
     protected static ?string $modelLabel = 'Rohstoff';

app/Filament/User/Resources/SpiceSupplierResource.php

@@ -2,6 +2,7 @@
 
 namespace App\Filament\User\Resources;
 
+use App\Traits\EnforcesRoles;
 use App\Filament\User\Resources\SpiceSupplierResource\Pages;
 use App\Filament\User\Resources\SpiceSupplierResource\RelationManagers;
 use App\Models\SpiceSupplier;
@@ -23,6 +24,7 @@ use Filament\Tables\Columns\TextColumn;
 
 class SpiceSupplierResource extends Resource
 {
+    use EnforcesRoles;
     protected static ?string $model = SpiceSupplier::class;
 
     protected static ?string $navigationIcon = 'heroicon-o-arrow-down-on-square';

app/Filament/User/Resources/SupplierResource.php

@@ -2,6 +2,7 @@
 
 namespace App\Filament\User\Resources;
 
+use App\Traits\EnforcesRoles;
 use App\Filament\User\Resources\SupplierResource\Pages;
 use App\Filament\User\Resources\SupplierResource\RelationManagers;
 use App\Models\Supplier;
@@ -15,6 +16,7 @@ use Illuminate\Database\Eloquent\SoftDeletingScope;
 
 class SupplierResource extends Resource
 {
+    use EnforcesRoles;
     protected static ?string $model = Supplier::class;
 
     protected static ?string $navigationIcon = 'heroicon-o-user';

app/Http/Controllers/OAuthController.php

@@ -19,6 +19,13 @@ class OAuthController extends Controller
     {
         $socialUser = Socialite::driver('nextcloud')->user();
 
+        $ncGroups = $socialUser->getRaw()['ocs']['data']['groups'] ?? [];
+        $smsRoles = array_intersect($ncGroups, ['sms-admin', 'sms-manager', 'sms-viewer']);
+
+        if (empty($smsRoles)) {
+            abort(403, 'Kein Zugriff — bitte einer SMS-Gruppe in Nextcloud beitreten.');
+        }
+
         $user = User::firstOrCreate(
             ['email' => $socialUser->getEmail()],
             [
@@ -27,6 +34,8 @@ class OAuthController extends Controller
             ]
         );
 
+        $user->syncRoles(array_values($smsRoles));
+
         Auth::login($user, remember: true);
 
         return redirect('/dashboard');

app/Models/User.php

@@ -7,10 +7,11 @@ use Filament\Panel;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
+use Spatie\Permission\Traits\HasRoles;
 
 class User extends Authenticatable implements FilamentUser
 {
-    use HasFactory, Notifiable;
+    use HasFactory, Notifiable, HasRoles;
 
     /**
      * The attributes that are mass assignable.
@@ -48,6 +49,6 @@ class User extends Authenticatable implements FilamentUser
 
     public function canAccessPanel(Panel $panel): bool
     {
-        return true; // allow all authenticated users access to the dashboard
+        return $this->hasAnyRole(['sms-admin', 'sms-manager', 'sms-viewer']);
     }
 }

app/Traits/EnforcesRoles.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Traits;
+
+use Illuminate\Database\Eloquent\Model;
+
+trait EnforcesRoles
+{
+    private static function canWrite(): bool
+    {
+        return auth()->user()?->hasAnyRole(['sms-admin', 'sms-manager']) ?? false;
+    }
+
+    public static function canCreate(): bool
+    {
+        return static::canWrite();
+    }
+
+    public static function canEdit(Model $record): bool
+    {
+        return static::canWrite();
+    }
+
+    public static function canDelete(Model $record): bool
+    {
+        return static::canWrite();
+    }
+
+    public static function canDeleteAny(): bool
+    {
+        return static::canWrite();
+    }
+}