Add project general settings danger zone

2026-04-11 17:42:43 +02:00
parent 50d4d864b5
commit 97b188e942
11 changed files with 470 additions and 3 deletions
@@ -12,6 +12,7 @@ use App\Models\User;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Arr;
+use Illuminate\Validation\Rule;
 use Inertia\Inertia;
 use Inertia\Response;

@@ -44,6 +45,7 @@ class ProjectController extends Controller
        return Inertia::render('projects/Index', [
            'projects' => $projectQuery
                ->get(),
+            'status' => session('status'),
        ]);
    }

@@ -76,6 +78,14 @@ class ProjectController extends Controller
        ]);
    }

+    public function general(Request $request, Project $project): Response
+    {
+        return Inertia::render('projects/settings/General', [
+            'project' => $project,
+            'status' => session('status'),
+        ]);
+    }
+
    public function access(Request $request, Project $project): Response
    {
        $user = $request->user();
@@ -146,4 +156,24 @@ class ProjectController extends Controller
        return to_route('projects.access', $project)
            ->with('status', "{$team->name} permissions were updated.");
    }
+
+    public function destroy(Request $request, Project $project): RedirectResponse
+    {
+        $request->validate([
+            'confirmation_key' => [
+                'required',
+                'string',
+                Rule::in([$project->key]),
+            ],
+        ], [
+            'confirmation_key.in' => 'Enter the exact project key to confirm deletion.',
+        ]);
+
+        $projectName = $project->name;
+
+        $project->delete();
+
+        return to_route('projects.index')
+            ->with('status', "Project {$projectName} was deleted.");
+    }
 }
@@ -13,6 +13,7 @@ import {
 } from '@/components/ui/card';
 import AppLayout from '@/layouts/AppLayout.vue';
 import { access, index, show } from '@/routes/projects/index';
+import { general as generalSettings } from '@/routes/projects/settings';
 import type { BreadcrumbItem, ProjectAccessPageProps } from '@/types';

 const props = defineProps<ProjectAccessPageProps>();
@@ -57,10 +58,22 @@ const hasPermission = (
                    />
                </div>

+                <div class="flex flex-wrap gap-3">
+                    <Button
+                        v-if="$page.props.auth.user.is_admin"
+                        as-child
+                        variant="outline"
+                    >
+                        <Link :href="generalSettings(project.id)">
+                            General settings
+                        </Link>
+                    </Button>
+
                    <Button as-child variant="outline">
                        <Link :href="show(project.id)">Back to project</Link>
                    </Button>
                </div>
+            </div>

            <div
                v-if="status"
@@ -46,6 +46,13 @@ const breadcrumbs: BreadcrumbItem[] = [
                </Button>
            </div>

+            <div
+                v-if="status"
+                class="rounded-xl border border-emerald-200 bg-emerald-50 px-4 py-3 text-sm text-emerald-900 dark:border-emerald-900/70 dark:bg-emerald-950/40 dark:text-emerald-100"
+            >
+                {{ status }}
+            </div>
+
            <div
                v-if="projects.length === 0"
                class="text-muted-foreground rounded-xl border border-dashed px-6 py-10 text-center text-sm"
@@ -17,6 +17,7 @@ import { index as boardIndex } from '@/routes/projects/board';
 import { index as backlogIndex } from '@/routes/projects/backlog';
 import {
    board as boardSettings,
+    general as generalSettings,
    metadata as metadataSettings,
    repositories as repositorySettings,
 } from '@/routes/projects/settings';
@@ -105,6 +106,16 @@ const projectAreas = [
                    </Link>
                </Button>

+                <Button
+                    v-if="$page.props.auth.user.is_admin"
+                    as-child
+                    variant="outline"
+                >
+                    <Link :href="generalSettings(project.id)">
+                        General settings
+                    </Link>
+                </Button>
+
                <Button as-child variant="outline">
                    <Link :href="metadataSettings(project.id)">
                        Ticket settings
@@ -18,6 +18,7 @@ import AppLayout from '@/layouts/AppLayout.vue';
 import { index, show } from '@/routes/projects/index';
 import {
    board as boardSettings,
+    general as generalSettings,
    repositories as repositorySettings,
 } from '@/routes/projects/settings';
 import type { BreadcrumbItem, ProjectBoardSettingsPageProps } from '@/types';
@@ -59,6 +60,16 @@ const breadcrumbs: BreadcrumbItem[] = [
                </div>

                <div class="flex flex-wrap gap-3">
+                    <Button
+                        v-if="$page.props.auth.user.is_admin"
+                        as-child
+                        variant="outline"
+                    >
+                        <Link :href="generalSettings(project.id)">
+                            General settings
+                        </Link>
+                    </Button>
+
                    <Button as-child variant="outline">
                        <Link :href="repositorySettings(project.id)">
                            Repository settings
@@ -0,0 +1,216 @@
+<script setup lang="ts">
+import { Head, Link, useForm } from '@inertiajs/vue3';
+import ProjectController from '@/actions/App/Http/Controllers/ProjectController';
+import Heading from '@/components/Heading.vue';
+import InputError from '@/components/InputError.vue';
+import { Badge } from '@/components/ui/badge';
+import { Button } from '@/components/ui/button';
+import {
+    Card,
+    CardContent,
+    CardDescription,
+    CardHeader,
+    CardTitle,
+} from '@/components/ui/card';
+import { Input } from '@/components/ui/input';
+import { Label } from '@/components/ui/label';
+import AppLayout from '@/layouts/AppLayout.vue';
+import { index, show } from '@/routes/projects/index';
+import {
+    board as boardSettings,
+    general as generalSettings,
+    metadata as metadataSettings,
+    repositories as repositorySettings,
+} from '@/routes/projects/settings';
+import type {
+    BreadcrumbItem,
+    ProjectGeneralSettingsPageProps,
+} from '@/types';
+import { computed } from 'vue';
+
+const props = defineProps<ProjectGeneralSettingsPageProps>();
+
+const breadcrumbs: BreadcrumbItem[] = [
+    {
+        title: 'Projects',
+        href: index(),
+    },
+    {
+        title: props.project.name,
+        href: show(props.project.id),
+    },
+    {
+        title: 'General settings',
+        href: generalSettings(props.project.id),
+    },
+];
+
+const deleteForm = useForm({
+    confirmation_key: '',
+});
+
+const isDeleteConfirmationValid = computed(
+    () => deleteForm.confirmation_key === props.project.key,
+);
+
+const submitDelete = (): void => {
+    if (!isDeleteConfirmationValid.value) {
+        return;
+    }
+
+    deleteForm.submit(ProjectController.destroy(props.project.id), {
+        preserveScroll: true,
+    });
+};
+</script>
+
+<template>
+    <AppLayout :breadcrumbs="breadcrumbs">
+        <Head :title="`${project.name} general settings`" />
+
+        <div class="flex flex-1 flex-col gap-6 p-4">
+            <div
+                class="flex flex-col gap-4 sm:flex-row sm:items-start sm:justify-between"
+            >
+                <div class="space-y-3">
+                    <Badge variant="outline" class="px-3 py-1">
+                        {{ project.key }}
+                    </Badge>
+                    <Heading
+                        :title="`${project.name} general settings`"
+                        description="Review the core project identity and manage irreversible administrative actions."
+                    />
+                </div>
+
+                <div class="flex flex-wrap gap-3">
+                    <Button as-child variant="outline">
+                        <Link :href="boardSettings(project.id)">
+                            Board settings
+                        </Link>
+                    </Button>
+
+                    <Button as-child variant="outline">
+                        <Link :href="metadataSettings(project.id)">
+                            Ticket settings
+                        </Link>
+                    </Button>
+
+                    <Button as-child variant="outline">
+                        <Link :href="repositorySettings(project.id)">
+                            Repository settings
+                        </Link>
+                    </Button>
+
+                    <Button as-child variant="outline">
+                        <Link :href="show(project.id)">Back to project</Link>
+                    </Button>
+                </div>
+            </div>
+
+            <div
+                v-if="status"
+                class="rounded-xl border border-emerald-200 bg-emerald-50 px-4 py-3 text-sm text-emerald-900 dark:border-emerald-900/70 dark:bg-emerald-950/40 dark:text-emerald-100"
+            >
+                {{ status }}
+            </div>
+
+            <Card>
+                <CardHeader>
+                    <CardTitle>Project identity</CardTitle>
+                    <CardDescription>
+                        These values define the project across tickets, boards,
+                        and repository matching.
+                    </CardDescription>
+                </CardHeader>
+
+                <CardContent class="grid gap-4 md:grid-cols-2">
+                    <div class="rounded-xl border border-border/70 p-4">
+                        <p
+                            class="text-xs font-semibold uppercase tracking-[0.18em] text-muted-foreground"
+                        >
+                            Project name
+                        </p>
+                        <p class="mt-2 text-sm font-semibold text-foreground">
+                            {{ project.name }}
+                        </p>
+                    </div>
+
+                    <div class="rounded-xl border border-border/70 p-4">
+                        <p
+                            class="text-xs font-semibold uppercase tracking-[0.18em] text-muted-foreground"
+                        >
+                            Project key
+                        </p>
+                        <p class="mt-2 text-sm font-semibold text-foreground">
+                            {{ project.key }}
+                        </p>
+                    </div>
+                </CardContent>
+            </Card>
+
+            <Card
+                class="border-red-200/80 bg-red-50/60 dark:border-red-900/60 dark:bg-red-950/20"
+            >
+                <CardHeader>
+                    <CardTitle class="text-red-900 dark:text-red-100">
+                        Danger zone
+                    </CardTitle>
+                    <CardDescription
+                        class="text-red-800/80 dark:text-red-200/80"
+                    >
+                        Deleting this project is permanent. All tickets, board
+                        columns, ticket metadata, repository connections, and
+                        project permissions will be removed.
+                    </CardDescription>
+                </CardHeader>
+
+                <CardContent class="space-y-5">
+                    <div
+                        class="rounded-xl border border-red-200/80 bg-background/80 p-4 dark:border-red-900/60"
+                    >
+                        <p class="text-sm font-medium text-foreground">
+                            Confirm by typing the exact project key:
+                            <span class="font-semibold">{{ project.key }}</span>
+                        </p>
+                    </div>
+
+                    <form class="space-y-4" @submit.prevent="submitDelete">
+                        <div class="grid gap-2">
+                            <Label for="confirmation_key">
+                                Confirmation key
+                            </Label>
+                            <Input
+                                id="confirmation_key"
+                                v-model="deleteForm.confirmation_key"
+                                :disabled="deleteForm.processing"
+                                placeholder="Type the project key exactly"
+                            />
+                            <InputError
+                                :message="deleteForm.errors.confirmation_key"
+                            />
+                        </div>
+
+                        <div
+                            class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between"
+                        >
+                            <p class="text-sm text-muted-foreground">
+                                This action cannot be undone.
+                            </p>
+
+                            <Button
+                                type="submit"
+                                variant="destructive"
+                                :disabled="
+                                    deleteForm.processing ||
+                                    !isDeleteConfirmationValid
+                                "
+                            >
+                                Delete project
+                            </Button>
+                        </div>
+                    </form>
+                </CardContent>
+            </Card>
+        </div>
+    </AppLayout>
+</template>
@@ -18,6 +18,7 @@ import AppLayout from '@/layouts/AppLayout.vue';
 import { index, show } from '@/routes/projects/index';
 import {
    board as boardSettings,
+    general as generalSettings,
    metadata as metadataSettings,
    repositories as repositorySettings,
 } from '@/routes/projects/settings';
@@ -63,6 +64,16 @@ const breadcrumbs: BreadcrumbItem[] = [
                </div>

                <div class="flex flex-wrap gap-3">
+                    <Button
+                        v-if="$page.props.auth.user.is_admin"
+                        as-child
+                        variant="outline"
+                    >
+                        <Link :href="generalSettings(project.id)">
+                            General settings
+                        </Link>
+                    </Button>
+
                    <Button as-child variant="outline">
                        <Link :href="boardSettings(project.id)">
                            Board settings
@@ -19,6 +19,7 @@ import { edit as editGitConnections } from '@/routes/git-connections/index';
 import { index, show } from '@/routes/projects/index';
 import {
    board as boardSettings,
+    general as generalSettings,
    metadata as metadataSettings,
    repositories as repositorySettings,
 } from '@/routes/projects/settings';
@@ -232,6 +233,16 @@ const submitUpdate = (): void => {
                </div>

                <div class="flex flex-wrap gap-3">
+                    <Button
+                        v-if="$page.props.auth.user.is_admin"
+                        as-child
+                        variant="outline"
+                    >
+                        <Link :href="generalSettings(project.id)">
+                            General settings
+                        </Link>
+                    </Button>
+
                    <Button as-child variant="outline">
                        <Link :href="boardSettings(project.id)">
                            Board settings
@@ -23,6 +23,7 @@ export type AdminUsersPageProps = {

 export type ProjectsIndexPageProps = {
    projects: ProjectModel[];
+    status?: string | null;
 };

 export type ProjectShowPageProps = {
@@ -57,6 +58,11 @@ export type ProjectBoardSettingsPageProps = {
    status?: string | null;
 };

+export type ProjectGeneralSettingsPageProps = {
+    project: ProjectModel;
+    status?: string | null;
+};
+
 export type ProjectBoardPageProps = {
    boardColumns: BoardColumnModel[];
    canEditTickets: boolean;
@@ -24,6 +24,10 @@ Route::middleware(['auth', 'verified'])->group(function () {
    Route::resource('projects', ProjectController::class)
        ->only(['index', 'create', 'store', 'show']);

+    Route::delete('projects/{project}', [ProjectController::class, 'destroy'])
+        ->middleware('can:access-admin')
+        ->name('projects.destroy');
+
    Route::get('projects/{project}/access', [ProjectController::class, 'access'])
        ->name('projects.access');
    Route::patch('projects/{project}/permissions/users/{user}', [ProjectController::class, 'updateUserPermissions'])
@@ -53,6 +57,9 @@ Route::middleware(['auth', 'verified'])->group(function () {
            ->name('projects.tickets.links.destroy');
        Route::patch('projects/{project}/tickets/{ticket}/status', [ProjectBoardController::class, 'move'])
            ->name('projects.tickets.status.update');
+        Route::get('projects/{project}/settings/general', [ProjectController::class, 'general'])
+            ->middleware('can:access-admin')
+            ->name('projects.settings.general');
        Route::get('projects/{project}/settings/board', [ProjectBoardSettingsController::class, 'show'])
            ->name('projects.settings.board');
        Route::post('projects/{project}/settings/board/columns', [ProjectBoardSettingsController::class, 'store'])
@@ -3,8 +3,12 @@
 namespace Tests\Feature\Projects;

 use App\Actions\ProjectPermissions\ProjectPermissionService;
+use App\Actions\ProjectTicketMetadata\InitializeProjectTicketMetadata;
+use App\Models\BoardColumn;
 use App\Models\Project;
 use App\Models\Team;
+use App\Models\Ticket;
+use App\Models\TicketPriority;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Inertia\Testing\AssertableInertia as Assert;
@@ -275,6 +279,146 @@ class ProjectControllerTest extends TestCase
            );
    }

+    /**
+     * Ensure admins can open the general project settings page.
+     */
+    public function test_admins_can_view_general_project_settings(): void
+    {
+        $admin = User::factory()->admin()->create();
+        $project = Project::factory()->create([
+            'key' => 'CORE',
+        ]);
+
+        $this->actingAs($admin)
+            ->get(route('projects.settings.general', $project))
+            ->assertOk()
+            ->assertInertia(fn (Assert $page) => $page
+                ->component('projects/settings/General')
+                ->where('project.id', $project->id)
+                ->where('project.key', 'CORE'),
+            );
+    }
+
+    /**
+     * Ensure non-admin users cannot open general project settings even with project permissions.
+     */
+    public function test_non_admin_users_cannot_view_general_project_settings(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create([
+            'key' => 'CORE',
+        ]);
+
+        app(ProjectPermissionService::class)->syncUserPermissions($project, $user, ['view', 'edit', 'delete']);
+
+        $this->actingAs($user)
+            ->get(route('projects.settings.general', $project))
+            ->assertForbidden();
+    }
+
+    /**
+     * Ensure admins can delete projects and their dependent project-scoped data.
+     */
+    public function test_admins_can_delete_projects_from_general_settings(): void
+    {
+        $admin = User::factory()->admin()->create();
+        $member = User::factory()->create();
+        $project = Project::factory()->create([
+            'key' => 'CORE',
+            'name' => 'Core Platform',
+        ]);
+
+        app(InitializeProjectTicketMetadata::class)->handle($project);
+
+        $priority = TicketPriority::factory()->for($project)->create([
+            'name' => 'Medium',
+            'position' => 1,
+        ]);
+        $boardColumn = BoardColumn::factory()->for($project)->create([
+            'name' => 'In Progress',
+            'position' => 1,
+        ]);
+        $ticket = Ticket::factory()->create([
+            'board_column_id' => $boardColumn->id,
+            'project_id' => $project->id,
+            'sequence_number' => 1,
+            'ticket_key' => 'CORE-1',
+            'ticket_priority_id' => $priority->id,
+            'ticket_type_id' => $project->ticketTypes()->where('system_key', 'task')->firstOrFail()->id,
+            'title' => 'Delete me',
+        ]);
+
+        app(ProjectPermissionService::class)->syncUserPermissions($project, $member, ['view']);
+
+        $this->actingAs($admin)
+            ->delete(route('projects.destroy', $project), [
+                'confirmation_key' => 'CORE',
+            ])
+            ->assertRedirect(route('projects.index'))
+            ->assertSessionHas('status', 'Project Core Platform was deleted.');
+
+        $this->assertDatabaseMissing('projects', [
+            'id' => $project->id,
+        ]);
+        $this->assertDatabaseMissing('board_columns', [
+            'id' => $boardColumn->id,
+        ]);
+        $this->assertDatabaseMissing('tickets', [
+            'id' => $ticket->id,
+        ]);
+        $this->assertDatabaseMissing('project_user_permissions', [
+            'project_id' => $project->id,
+            'user_id' => $member->id,
+            'permission' => 'view',
+        ]);
+    }
+
+    /**
+     * Ensure project deletion requires the exact project key confirmation.
+     */
+    public function test_admins_must_confirm_the_exact_project_key_to_delete_a_project(): void
+    {
+        $admin = User::factory()->admin()->create();
+        $project = Project::factory()->create([
+            'key' => 'CORE',
+        ]);
+
+        $this->actingAs($admin)
+            ->from(route('projects.settings.general', $project))
+            ->delete(route('projects.destroy', $project), [
+                'confirmation_key' => 'core',
+            ])
+            ->assertRedirect(route('projects.settings.general', $project))
+            ->assertSessionHasErrors('confirmation_key');
+
+        $this->assertDatabaseHas('projects', [
+            'id' => $project->id,
+        ]);
+    }
+
+    /**
+     * Ensure non-admin users cannot delete projects.
+     */
+    public function test_non_admin_users_cannot_delete_projects(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create([
+            'key' => 'CORE',
+        ]);
+
+        app(ProjectPermissionService::class)->syncUserPermissions($project, $user, ['view', 'edit', 'delete']);
+
+        $this->actingAs($user)
+            ->delete(route('projects.destroy', $project), [
+                'confirmation_key' => 'CORE',
+            ])
+            ->assertForbidden();
+
+        $this->assertDatabaseHas('projects', [
+            'id' => $project->id,
+        ]);
+    }
+
    /**
     * Ensure admins can update direct project permissions for a user.
     */