60 lines
2.3 KiB
PHP
60 lines
2.3 KiB
PHP
<?php
|
|
|
|
use Illuminate\Database\Migrations\Migration;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Spatie\Permission\PermissionRegistrar;
|
|
|
|
/**
|
|
* Reading and changing stored credentials is its own capability.
|
|
*
|
|
* Not folded into console.view: every operator has that, and "can open the
|
|
* console" must not mean "can read the payment key".
|
|
*/
|
|
return new class extends Migration
|
|
{
|
|
public function up(): void
|
|
{
|
|
// Spatie caches the catalogue. Inserting rows without dropping it means
|
|
// the Owner keeps getting 403 on the new page until the cache expires —
|
|
// long after the deploy that was supposed to grant it.
|
|
app(PermissionRegistrar::class)->forgetCachedPermissions();
|
|
|
|
// Whether it was ours to create decides whether it is ours to remove:
|
|
// rolling back must not delete a permission — and every role assignment
|
|
// hanging off it — that existed before this migration ran.
|
|
$exists = DB::table('permissions')->where('name', 'secrets.manage')->exists();
|
|
|
|
if (! $exists) {
|
|
DB::table('permissions')->insert([
|
|
'name' => 'secrets.manage', 'guard_name' => 'web',
|
|
'created_at' => now(), 'updated_at' => now(),
|
|
]);
|
|
}
|
|
|
|
// Owner only. Deliberately not granted to Admin: this is the one page
|
|
// where the blast radius is someone else's money.
|
|
$permission = DB::table('permissions')->where('name', 'secrets.manage')->value('id');
|
|
$owner = DB::table('roles')->where('name', 'Owner')->value('id');
|
|
|
|
if ($permission && $owner) {
|
|
DB::table('role_has_permissions')->updateOrInsert(
|
|
['permission_id' => $permission, 'role_id' => $owner],
|
|
);
|
|
}
|
|
|
|
app(PermissionRegistrar::class)->forgetCachedPermissions();
|
|
}
|
|
|
|
public function down(): void
|
|
{
|
|
// Deliberately removes nothing.
|
|
//
|
|
// up() reuses the permission and the grant when they already exist, so
|
|
// by the time down() runs there is no way to tell what this migration
|
|
// created from what it merely found. Taking a capability away that
|
|
// somebody else granted is worse than leaving one in place, and this is
|
|
// a grant to the Owner role — the account that would have to fix it.
|
|
app(PermissionRegistrar::class)->forgetCachedPermissions();
|
|
}
|
|
};
|