From db7b8a6ee34d53a660ec7d34d652573c59e4520c Mon Sep 17 00:00:00 2001 From: nexxo Date: Sat, 25 Jul 2026 22:37:35 +0200 Subject: [PATCH] fix(vpn): keep the navigation entry after the capability split MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The sidebar still gated the VPN entry on vpn.manage, which the split deleted — so the page would have vanished from the console for every role, Owner included. Every operator can hold their own access, so the entry is shown to all of them and the page itself shows only what the policy allows. Guarded by a test across all five roles, which is the assertion my rewrite had dropped. Co-Authored-By: Claude Opus 4.8 --- resources/views/layouts/admin.blade.php | 2 +- tests/Feature/Admin/VpnTest.php | 12 ++++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/resources/views/layouts/admin.blade.php b/resources/views/layouts/admin.blade.php index 80021ff..2e89a64 100644 --- a/resources/views/layouts/admin.blade.php +++ b/resources/views/layouts/admin.blade.php @@ -36,7 +36,7 @@ ['admin.datacenters', 'database', 'datacenters', null], ['admin.provisioning', 'activity', 'provisioning', null], ['admin.maintenance', 'alert-triangle', 'maintenance', null], - ['admin.vpn', 'shield', 'vpn', 'vpn.manage'], + ['admin.vpn', 'shield', 'vpn', null], ['admin.revenue', 'trending-up', 'revenue', null], ] as [$route, $icon, $key, $capability]) @continue($capability !== null && ! auth()->user()?->can($capability)) diff --git a/tests/Feature/Admin/VpnTest.php b/tests/Feature/Admin/VpnTest.php index 2374fe3..3b1a8ae 100644 --- a/tests/Feature/Admin/VpnTest.php +++ b/tests/Feature/Admin/VpnTest.php @@ -24,6 +24,18 @@ function vpnHub(): FakeWireguardHub return $hub; } +it('keeps the VPN entry in the navigation for every operator', function () { + vpnHub(); + + // Regression guard: the entry used to hang on a capability that the + // capability split deleted, which would have hidden the page from everyone. + foreach (['Owner', 'Admin', 'Support', 'Developer', 'Read-only'] as $role) { + $this->actingAs(operator($role))->get(route('admin.overview')) + ->assertOk() + ->assertSee(route('admin.vpn')); + } +}); + it('shows each operator only their own access unless they may see all', function () { vpnHub(); $support = operator('Support');