Implement project memberships teams and permission model

2026-03-25 01:10:08 +01:00
parent 7d4b0733b3
commit 840d01f6fc
27 changed files with 1722 additions and 7 deletions
@@ -2,19 +2,42 @@

 namespace App\Http\Controllers;

+use App\Actions\ProjectPermissions\ProjectPermissionService;
 use App\Http\Requests\StoreProjectRequest;
+use App\Http\Requests\SyncProjectPermissionsRequest;
 use App\Models\Project;
+use App\Models\Team;
+use App\Models\User;
 use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
 use Inertia\Inertia;
 use Inertia\Response;

 class ProjectController extends Controller
 {
-    public function index(): Response
+    public function __construct(
+        private readonly ProjectPermissionService $projectPermissionService,
+    ) {}
+
+    public function index(Request $request): Response
    {
+        $projectQuery = Project::query()
+            ->orderByDesc('id');
+
+        if (! $request->user()->is_admin) {
+            $viewableProjectIds = $this->projectPermissionService->viewableProjectIds($request->user());
+
+            if ($viewableProjectIds === []) {
+                return Inertia::render('projects/Index', [
+                    'projects' => [],
+                ]);
+            }
+
+            $projectQuery->whereIn('id', $viewableProjectIds);
+        }
+
        return Inertia::render('projects/Index', [
-            'projects' => Project::query()
-                ->orderByDesc('id')
+            'projects' => $projectQuery
                ->get(),
        ]);
    }
@@ -27,14 +50,84 @@ class ProjectController extends Controller
    public function store(StoreProjectRequest $request): RedirectResponse
    {
        $project = Project::query()->create($request->validated());
+        $this->projectPermissionService->grantAllProjectPermissions($project, $request->user());

        return to_route('projects.show', $project);
    }

-    public function show(Project $project): Response
+    public function show(Request $request, Project $project): Response
    {
+        abort_unless(
+            $this->projectPermissionService->userCanViewProject($request->user(), $project),
+            403,
+        );
+
        return Inertia::render('projects/Show', [
+            'canManageAccess' => $this->projectPermissionService->userCanManageProjectAccess($request->user(), $project),
            'project' => $project,
        ]);
    }
+
+    public function access(Request $request, Project $project): Response
+    {
+        abort_unless(
+            $this->projectPermissionService->userCanManageProjectAccess($request->user(), $project),
+            403,
+        );
+
+        return Inertia::render('projects/Access', [
+            'directPermissions' => $this->projectPermissionService->userPermissionMap($project),
+            'permissionOptions' => $this->projectPermissionService->permissionOptions(),
+            'project' => $project,
+            'status' => session('status'),
+            'teamPermissions' => $this->projectPermissionService->teamPermissionMap($project),
+            'teams' => Team::query()
+                ->with('users')
+                ->orderBy('name')
+                ->get()
+                ->map(fn (Team $team): array => [
+                    'id' => $team->id,
+                    'name' => $team->name,
+                    'created_at' => $team->created_at?->toISOString(),
+                    'updated_at' => $team->updated_at?->toISOString(),
+                    'user_ids' => $team->users->modelKeys(),
+                    'users' => $team->users->values(),
+                ]),
+            'users' => User::query()
+                ->orderBy('name')
+                ->get(),
+        ]);
+    }
+
+    public function updateUserPermissions(
+        SyncProjectPermissionsRequest $request,
+        Project $project,
+        User $user,
+    ): RedirectResponse {
+        abort_unless(
+            $this->projectPermissionService->userCanManageProjectAccess($request->user(), $project),
+            403,
+        );
+
+        $this->projectPermissionService->syncUserPermissions($project, $user, $request->permissions());
+
+        return to_route('projects.access', $project)
+            ->with('status', "{$user->name} permissions were updated.");
+    }
+
+    public function updateTeamPermissions(
+        SyncProjectPermissionsRequest $request,
+        Project $project,
+        Team $team,
+    ): RedirectResponse {
+        abort_unless(
+            $this->projectPermissionService->userCanManageProjectAccess($request->user(), $project),
+            403,
+        );
+
+        $this->projectPermissionService->syncTeamPermissions($project, $team, $request->permissions());
+
+        return to_route('projects.access', $project)
+            ->with('status', "{$team->name} permissions were updated.");
+    }
 }
@@ -0,0 +1,57 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Actions\ProjectPermissions\ProjectPermissionService;
+use App\Http\Requests\StoreTeamRequest;
+use App\Http\Requests\UpdateTeamMembersRequest;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Http\RedirectResponse;
+use Inertia\Inertia;
+use Inertia\Response;
+
+class TeamController extends Controller
+{
+    public function __construct(
+        private readonly ProjectPermissionService $projectPermissionService,
+    ) {}
+
+    public function index(): Response
+    {
+        return Inertia::render('teams/Index', [
+            'status' => session('status'),
+            'teams' => Team::query()
+                ->with('users')
+                ->orderBy('name')
+                ->get()
+                ->map(fn (Team $team): array => [
+                    'id' => $team->id,
+                    'name' => $team->name,
+                    'created_at' => $team->created_at?->toISOString(),
+                    'updated_at' => $team->updated_at?->toISOString(),
+                    'user_ids' => $team->users->modelKeys(),
+                    'users' => $team->users->values(),
+                ]),
+            'users' => User::query()
+                ->orderBy('name')
+                ->get(),
+        ]);
+    }
+
+    public function store(StoreTeamRequest $request): RedirectResponse
+    {
+        $team = Team::query()->create($request->validated());
+
+        return to_route('admin.teams.index')
+            ->with('status', "{$team->name} was created.");
+    }
+
+    public function updateMembers(UpdateTeamMembersRequest $request, Team $team): RedirectResponse
+    {
+        $this->projectPermissionService->syncTeamMembers($team, $request->userIds());
+
+        return to_route('admin.teams.index')
+            ->with('status', "{$team->name} members were updated.");
+    }
+}
@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class StoreTeamRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return $this->user()?->can('access-admin') ?? false;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => [
+                'required',
+                'string',
+                'max:255',
+                Rule::unique('teams', 'name'),
+            ],
+        ];
+    }
+}
@@ -0,0 +1,47 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Actions\ProjectPermissions\ProjectPermissionService;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class SyncProjectPermissionsRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return $this->user() !== null;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'permissions' => ['nullable', 'array'],
+            'permissions.*' => [
+                'string',
+                Rule::in(ProjectPermissionService::permissions()),
+            ],
+        ];
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public function permissions(): array
+    {
+        return collect($this->validated('permissions', []))
+            ->map(fn (mixed $permission): string => (string) $permission)
+            ->unique()
+            ->values()
+            ->all();
+    }
+}
@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class UpdateTeamMembersRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return $this->user()?->can('access-admin') ?? false;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'user_ids' => ['nullable', 'array'],
+            'user_ids.*' => ['integer', Rule::exists('users', 'id')],
+        ];
+    }
+
+    /**
+     * @return array<int, int>
+     */
+    public function userIds(): array
+    {
+        return collect($this->validated('user_ids', []))
+            ->map(fn (mixed $userId): int => (int) $userId)
+            ->unique()
+            ->values()
+            ->all();
+    }
+}