From 8304f2e7dcc2ae9a2fb55b8415367e6e7a7f00d9 Mon Sep 17 00:00:00 2001
From: nexxo <nexxo@clupilot.local>
Date: Sat, 25 Jul 2026 18:19:24 +0200
Subject: [PATCH] fix(admin): self-heal legacy is_admin into Owner (no RBAC
 bypass); validate datacenter country server-side

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 app/Http/Middleware/EnsureAdmin.php | 15 ++++++++++++---
 app/Livewire/Admin/Datacenters.php  |  8 +++++++-
 app/Models/User.php                 |  8 ++------
 routes/channels.php                 |  2 +-
 tests/Feature/Admin/RbacTest.php    |  9 +++++++++
 5 files changed, 31 insertions(+), 11 deletions(-)

diff --git a/app/Http/Middleware/EnsureAdmin.php b/app/Http/Middleware/EnsureAdmin.php
index 1b06cb0..68d29cc 100644
--- a/app/Http/Middleware/EnsureAdmin.php
+++ b/app/Http/Middleware/EnsureAdmin.php
@@ -2,6 +2,7 @@
 
 namespace App\Http\Middleware;
 
+use App\Models\User;
 use Closure;
 use Illuminate\Http\Request;
 use Symfony\Component\HttpFoundation\Response;
@@ -9,12 +10,20 @@ use Symfony\Component\HttpFoundation\Response;
 class EnsureAdmin
 {
     /**
-     * Only operators (is_admin) may reach the admin console.
+     * Only operators (a user holding an RBAC role) may reach the admin console.
+     * A legacy is_admin account with no role is self-healed into Owner on access
+     * — migrating it into RBAC rather than permanently trusting the old flag, so
+     * such accounts are never locked out yet the role boundary still governs.
      */
     public function handle(Request $request, Closure $next): Response
     {
-        // console.view via RBAC, or the legacy is_admin flag as a safety net.
-        abort_unless((bool) $request->user()?->isOperator(), 403);
+        $user = $request->user();
+
+        if ($user instanceof User && $user->is_admin && ! $user->isOperator()) {
+            $user->assignRole('Owner');
+        }
+
+        abort_unless((bool) $user?->can('console.view'), 403);
 
         return $next($request);
     }
diff --git a/app/Livewire/Admin/Datacenters.php b/app/Livewire/Admin/Datacenters.php
index dd55569..0df7d61 100644
--- a/app/Livewire/Admin/Datacenters.php
+++ b/app/Livewire/Admin/Datacenters.php
@@ -27,7 +27,13 @@ class Datacenters extends Component
         // stored — otherwise `FSN` passes the rule but the lowercased insert collides.
         $this->code = strtolower(trim($this->code));
 
-        $data = $this->validate();
+        // Country must be one of the curated list — a forged request can bypass
+        // the <select>, so enforce membership server-side (mirrors EditDatacenter).
+        $data = $this->validate([
+            'code' => 'required|string|max:8|alpha_dash|unique:datacenters,code',
+            'name' => 'required|string|max:255',
+            'location' => 'nullable|in:'.implode(',', array_keys((array) config('countries'))),
+        ]);
 
         Datacenter::create([
             'code' => $data['code'],
diff --git a/app/Models/User.php b/app/Models/User.php
index 85829fb..a502843 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -22,14 +22,10 @@ class User extends Authenticatable
     /** The five operator roles that grant access to the admin console. */
     public const OPERATOR_ROLES = ['Owner', 'Admin', 'Support', 'Billing', 'Read-only'];
 
-    /**
-     * True when this user is a CluPilot operator. Prefers RBAC roles, but keeps
-     * the legacy is_admin flag as a fallback so an operator can never be locked
-     * out of the console by a stale permission cache or a missing role.
-     */
+    /** True when this user holds an operator role (the RBAC console boundary). */
     public function isOperator(): bool
     {
-        return $this->is_admin || $this->hasAnyRole(self::OPERATOR_ROLES);
+        return $this->hasAnyRole(self::OPERATOR_ROLES);
     }
 
     /**
diff --git a/routes/channels.php b/routes/channels.php
index b7bb496..9a9668a 100644
--- a/routes/channels.php
+++ b/routes/channels.php
@@ -7,7 +7,7 @@ Broadcast::channel('App.Models.User.{id}', function ($user, $id) {
 });
 
 // Operator console live provisioning feed — operators only.
-Broadcast::channel('admin.runs', fn ($user) => $user->isOperator());
+Broadcast::channel('admin.runs', fn ($user) => (bool) $user->can('console.view'));
 
 // A customer's own provisioning feed — bridged from the auth user by email.
 Broadcast::channel('customer.{customerId}.run', function ($user, $customerId) {
diff --git a/tests/Feature/Admin/RbacTest.php b/tests/Feature/Admin/RbacTest.php
index 34b672f..0988229 100644
--- a/tests/Feature/Admin/RbacTest.php
+++ b/tests/Feature/Admin/RbacTest.php
@@ -20,6 +20,15 @@ it('grants console access to every operator role but not to customers', function
     $this->actingAs($customer)->get(route('admin.overview'))->assertForbidden();
 });
 
+it('self-heals a legacy is_admin account with no role into Owner', function () {
+    $legacy = User::factory()->create(['is_admin' => true]);
+    $legacy->syncRoles([]); // simulate a pre-RBAC admin with no operator role
+
+    $this->actingAs($legacy)->get(route('admin.overview'))->assertOk();
+
+    expect($legacy->fresh()->hasRole('Owner'))->toBeTrue();
+});
+
 it('denies datacenter management to roles without the capability', function () {
     foreach (['Support', 'Billing', 'Read-only'] as $role) {
         Livewire::actingAs(operator($role))->test(Datacenters::class)