From 406f753311baa4d4ff57b9eb9a7d2da4b128e574 Mon Sep 17 00:00:00 2001
From: nexxo <nexxo@clupilot.local>
Date: Sat, 25 Jul 2026 18:35:14 +0200
Subject: [PATCH] =?UTF-8?q?fix(admin):=20remove=20is=5Fadmin=20self-heal?=
 =?UTF-8?q?=20=E2=80=94=20RBAC=20is=20the=20only=20console=20boundary=20(n?=
 =?UTF-8?q?o=20revocation=20bypass)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 app/Http/Middleware/EnsureAdmin.php | 19 +++++--------------
 tests/Feature/Admin/RbacTest.php    | 12 ++++++------
 2 files changed, 11 insertions(+), 20 deletions(-)

diff --git a/app/Http/Middleware/EnsureAdmin.php b/app/Http/Middleware/EnsureAdmin.php
index 7c6acc8..b5e61ae 100644
--- a/app/Http/Middleware/EnsureAdmin.php
+++ b/app/Http/Middleware/EnsureAdmin.php
@@ -2,7 +2,6 @@
 
 namespace App\Http\Middleware;
 
-use App\Models\User;
 use Closure;
 use Illuminate\Http\Request;
 use Symfony\Component\HttpFoundation\Response;
@@ -10,22 +9,14 @@ use Symfony\Component\HttpFoundation\Response;
 class EnsureAdmin
 {
     /**
-     * Only operators (a user holding an RBAC role) may reach the admin console.
-     * A legacy is_admin account with no role is self-healed into Owner on access
-     * — migrating it into RBAC rather than permanently trusting the old flag, so
-     * such accounts are never locked out yet the role boundary still governs.
+     * Only operators with the console.view capability may reach the admin console.
+     * Legacy is_admin accounts are migrated to roles by the seed_roles_and_permissions
+     * migration and the seeder — the gate never trusts the bare is_admin flag, so
+     * an RBAC revocation is never silently undone here.
      */
     public function handle(Request $request, Closure $next): Response
     {
-        $user = $request->user();
-
-        // Only a genuinely un-migrated legacy admin (is_admin, but NO roles at
-        // all) is promoted — never override an intentional demotion/other role.
-        if ($user instanceof User && $user->is_admin && $user->roles->isEmpty()) {
-            $user->assignRole('Owner');
-        }
-
-        abort_unless((bool) $user?->can('console.view'), 403);
+        abort_unless((bool) $request->user()?->can('console.view'), 403);
 
         return $next($request);
     }
diff --git a/tests/Feature/Admin/RbacTest.php b/tests/Feature/Admin/RbacTest.php
index 0988229..7643fb6 100644
--- a/tests/Feature/Admin/RbacTest.php
+++ b/tests/Feature/Admin/RbacTest.php
@@ -20,13 +20,13 @@ it('grants console access to every operator role but not to customers', function
     $this->actingAs($customer)->get(route('admin.overview'))->assertForbidden();
 });
 
-it('self-heals a legacy is_admin account with no role into Owner', function () {
-    $legacy = User::factory()->create(['is_admin' => true]);
-    $legacy->syncRoles([]); // simulate a pre-RBAC admin with no operator role
+it('denies console access to a role-less account even if is_admin is set', function () {
+    // RBAC is the boundary — the bare legacy flag must never grant access, so a
+    // revoked operator (roles removed) cannot reach the console.
+    $noRole = User::factory()->create(['is_admin' => true]);
+    $noRole->syncRoles([]);
 
-    $this->actingAs($legacy)->get(route('admin.overview'))->assertOk();
-
-    expect($legacy->fresh()->hasRole('Owner'))->toBeTrue();
+    $this->actingAs($noRole)->get(route('admin.overview'))->assertForbidden();
 });
 
 it('denies datacenter management to roles without the capability', function () {