boban
/
CluPilotCloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(admin): remove is_admin self-heal — RBAC is the only console boundary (no revocation bypass) 

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
feat/portal-design
nexxo 2026-07-25 18:35:14 +02:00
parent 22cbe9ac39
commit 406f753311
2 changed files with 11 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
app/Http/Middleware/EnsureAdmin.php
View File

@ -2,7 +2,6 @@
namespace App\Http\Middleware; namespace App\Http\Middleware;
use App\Models\User;
use Closure; use Closure;
use Illuminate\Http\Request; use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response; use Symfony\Component\HttpFoundation\Response;
@ -10,22 +9,14 @@ use Symfony\Component\HttpFoundation\Response;
class EnsureAdmin class EnsureAdmin
{ {
/** /**
* Only operators (a user holding an RBAC role) may reach the admin console. * Only operators with the console.view capability may reach the admin console.
* A legacy is_admin account with no role is self-healed into Owner on access * Legacy is_admin accounts are migrated to roles by the seed_roles_and_permissions
* — migrating it into RBAC rather than permanently trusting the old flag, so * migration and the seeder — the gate never trusts the bare is_admin flag, so
* such accounts are never locked out yet the role boundary still governs. * an RBAC revocation is never silently undone here.
*/ */
public function handle(Request $request, Closure $next): Response public function handle(Request $request, Closure $next): Response
{ {
$user = $request->user(); abort_unless((bool) $request->user()?->can('console.view'), 403);
// Only a genuinely un-migrated legacy admin (is_admin, but NO roles at
// all) is promoted — never override an intentional demotion/other role.
if ($user instanceof User && $user->is_admin && $user->roles->isEmpty()) {
$user->assignRole('Owner');
}
abort_unless((bool) $user?->can('console.view'), 403);
return $next($request); return $next($request);
} }

12
tests/Feature/Admin/RbacTest.php
View File

@ -20,13 +20,13 @@ it('grants console access to every operator role but not to customers', function
$this->actingAs($customer)->get(route('admin.overview'))->assertForbidden(); $this->actingAs($customer)->get(route('admin.overview'))->assertForbidden();
}); });
it('self-heals a legacy is_admin account with no role into Owner', function () { it('denies console access to a role-less account even if is_admin is set', function () {
$legacy = User::factory()->create(['is_admin' => true]); // RBAC is the boundary — the bare legacy flag must never grant access, so a
$legacy->syncRoles([]); // simulate a pre-RBAC admin with no operator role // revoked operator (roles removed) cannot reach the console.
$noRole = User::factory()->create(['is_admin' => true]);
$noRole->syncRoles([]);
$this->actingAs($legacy)->get(route('admin.overview'))->assertOk(); $this->actingAs($noRole)->get(route('admin.overview'))->assertForbidden();
expect($legacy->fresh()->hasRole('Owner'))->toBeTrue();
}); });
it('denies datacenter management to roles without the capability', function () { it('denies datacenter management to roles without the capability', function () {