56 lines
2.0 KiB
PHP
56 lines
2.0 KiB
PHP
<?php
|
|
|
|
use Illuminate\Database\Migrations\Migration;
|
|
use Spatie\Permission\Models\Permission;
|
|
use Spatie\Permission\Models\Role;
|
|
use Spatie\Permission\PermissionRegistrar;
|
|
|
|
/**
|
|
* Splits the coarse `vpn.manage` into what it actually conflated:
|
|
*
|
|
* vpn.view.all — see every access, including other people's and host peers
|
|
* vpn.manage.all — create, assign, block and revoke any access
|
|
*
|
|
* Seeing is not managing, and neither implies holding someone else's private
|
|
* key: downloading a stored config is owner-only and lives in VpnPeerPolicy,
|
|
* not in a permission — ownership is record-level, permissions are elevated
|
|
* capabilities.
|
|
*
|
|
* "Developer" is a view-only role. Writing code does not imply authority over
|
|
* other people's access to the management network, so it deliberately gets no
|
|
* manage capability.
|
|
*/
|
|
return new class extends Migration
|
|
{
|
|
public function up(): void
|
|
{
|
|
app(PermissionRegistrar::class)->forgetCachedPermissions();
|
|
|
|
Permission::findOrCreate('vpn.view.all', 'web');
|
|
Permission::findOrCreate('vpn.manage.all', 'web');
|
|
|
|
foreach (['Owner', 'Admin'] as $role) {
|
|
Role::findOrCreate($role, 'web')->givePermissionTo(['vpn.view.all', 'vpn.manage.all']);
|
|
}
|
|
Role::findOrCreate('Developer', 'web')->syncPermissions(['console.view', 'vpn.view.all']);
|
|
|
|
Permission::query()->where('name', 'vpn.manage')->delete();
|
|
|
|
app(PermissionRegistrar::class)->forgetCachedPermissions();
|
|
}
|
|
|
|
public function down(): void
|
|
{
|
|
app(PermissionRegistrar::class)->forgetCachedPermissions();
|
|
|
|
Permission::findOrCreate('vpn.manage', 'web');
|
|
foreach (['Owner', 'Admin'] as $role) {
|
|
Role::findOrCreate($role, 'web')->givePermissionTo('vpn.manage');
|
|
}
|
|
Role::query()->where('name', 'Developer')->delete();
|
|
Permission::query()->whereIn('name', ['vpn.view.all', 'vpn.manage.all'])->delete();
|
|
|
|
app(PermissionRegistrar::class)->forgetCachedPermissions();
|
|
}
|
|
};
|