Implement admin and user management foundation

app/Http/Controllers/Admin/UserManagementController.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Admin\UpdateUserAdminStatusRequest;
+use App\Models\User;
+use Illuminate\Http\RedirectResponse;
+use Inertia\Inertia;
+use Inertia\Response;
+
+class UserManagementController extends Controller
+{
+    public function index(): Response
+    {
+        return Inertia::render('admin/users/Index', [
+            'status' => session('status'),
+            'users' => User::query()
+                ->orderByDesc('is_admin')
+                ->orderBy('name')
+                ->get(),
+        ]);
+    }
+
+    public function update(UpdateUserAdminStatusRequest $request, User $user): RedirectResponse
+    {
+        $user->forceFill([
+            'is_admin' => $request->boolean('is_admin'),
+        ])->save();
+
+        $status = $user->is_admin
+            ? "{$user->name} now has admin access."
+            : "{$user->name} no longer has admin access.";
+
+        return to_route('admin.users.index')->with('status', $status);
+    }
+}

app/Http/Requests/Admin/UpdateUserAdminStatusRequest.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Http\Requests\Admin;
+
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+class UpdateUserAdminStatusRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return $this->user()?->is_admin === true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'is_admin' => ['required', 'boolean'],
+        ];
+    }
+}

app/Models/User.php

@@ -27,6 +27,7 @@ class User extends Authenticatable
     {
         return [
             'email_verified_at' => 'datetime',
+            'is_admin' => 'boolean',
             'password' => 'hashed',
             'two_factor_confirmed_at' => 'datetime',
         ];

app/Providers/AppServiceProvider.php

@@ -2,9 +2,11 @@
 
 namespace App\Providers;
 
+use App\Models\User;
 use Carbon\CarbonImmutable;
 use Illuminate\Support\Facades\Date;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\ServiceProvider;
 use Illuminate\Validation\Rules\Password;
 
@@ -23,9 +25,18 @@ class AppServiceProvider extends ServiceProvider
      */
     public function boot(): void
     {
+        $this->configureAuthorization();
         $this->configureDefaults();
     }
 
+    /**
+     * Configure authorization behaviors.
+     */
+    protected function configureAuthorization(): void
+    {
+        Gate::define('access-admin', fn (User $user): bool => $user->is_admin);
+    }
+
     /**
      * Configure default behaviors for production-ready applications.
      */

database/factories/UserFactory.php

@@ -28,6 +28,7 @@ class UserFactory extends Factory
             'name' => fake()->name(),
             'email' => fake()->unique()->safeEmail(),
             'email_verified_at' => now(),
+            'is_admin' => false,
             'password' => static::$password ??= Hash::make('password'),
             'remember_token' => Str::random(10),
             'two_factor_secret' => null,
@@ -57,4 +58,14 @@ class UserFactory extends Factory
             'two_factor_confirmed_at' => now(),
         ]);
     }
+
+    /**
+     * Indicate that the user has application admin access.
+     */
+    public function admin(): static
+    {
+        return $this->state(fn (array $attributes) => [
+            'is_admin' => true,
+        ]);
+    }
 }

database/migrations/2026_03_24_233202_add_is_admin_to_users_table.php

@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->boolean('is_admin')->default(false)->after('email_verified_at');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->dropColumn('is_admin');
+        });
+    }
+};

database/seeders/DatabaseSeeder.php

@@ -2,7 +2,6 @@
 
 namespace Database\Seeders;
 
-use App\Models\User;
 // use Illuminate\Database\Console\Seeds\WithoutModelEvents;
 use Illuminate\Database\Seeder;
 
@@ -13,11 +12,8 @@ class DatabaseSeeder extends Seeder
      */
     public function run(): void
     {
-        // User::factory(10)->create();
+        $this->call([
-
+            UserSeeder::class,
-        User::factory()->create([
-            'name' => 'Test User',
-            'email' => 'test@example.com',
         ]);
     }
 }

database/seeders/UserSeeder.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace Database\Seeders;
+
+use App\Models\User;
+use Illuminate\Database\Seeder;
+
+class UserSeeder extends Seeder
+{
+    /**
+     * Run the database seeds.
+     */
+    public function run(): void
+    {
+        User::factory()->admin()->create([
+            'name' => 'Admin User',
+            'email' => 'admin@kanbangit.test',
+        ]);
+
+        User::factory()->create([
+            'name' => 'Test User',
+            'email' => 'test@example.com',
+        ]);
+
+        User::factory(8)->create();
+    }
+}

resources/js/components/AppSidebar.vue

@@ -1,6 +1,7 @@
 <script setup lang="ts">
-import { Link } from '@inertiajs/vue3';
+import { Link, usePage } from '@inertiajs/vue3';
-import { BookOpen, FolderGit2, LayoutGrid } from 'lucide-vue-next';
+import { BookOpen, FolderGit2, LayoutGrid, Shield } from 'lucide-vue-next';
+import { computed } from 'vue';
 import AppLogo from '@/components/AppLogo.vue';
 import NavFooter from '@/components/NavFooter.vue';
 import NavMain from '@/components/NavMain.vue';
@@ -14,16 +15,31 @@ import {
     SidebarMenuButton,
     SidebarMenuItem,
 } from '@/components/ui/sidebar';
+import { index as adminUsers } from '@/routes/admin/users';
 import { dashboard } from '@/routes';
 import type { NavItem } from '@/types';
 
-const mainNavItems: NavItem[] = [
+const page = usePage();
+
+const mainNavItems = computed<NavItem[]>(() => {
+    const items: NavItem[] = [
         {
             title: 'Dashboard',
             href: dashboard(),
             icon: LayoutGrid,
         },
-];
+    ];
+
+    if (page.props.auth.user.is_admin) {
+        items.push({
+            title: 'Users',
+            href: adminUsers(),
+            icon: Shield,
+        });
+    }
+
+    return items;
+});
 
 const footerNavItems: NavItem[] = [
     {

resources/js/pages/admin/users/Index.vue

@@ -0,0 +1,166 @@
+<script setup lang="ts">
+import { Form, Head } from '@inertiajs/vue3';
+import { Shield, Users } from 'lucide-vue-next';
+import UserManagementController from '@/actions/App/Http/Controllers/Admin/UserManagementController';
+import Heading from '@/components/Heading.vue';
+import { Badge } from '@/components/ui/badge';
+import { Button } from '@/components/ui/button';
+import {
+    Card,
+    CardContent,
+    CardDescription,
+    CardHeader,
+    CardTitle,
+} from '@/components/ui/card';
+import AppLayout from '@/layouts/AppLayout.vue';
+import { index as adminUsers } from '@/routes/admin/users';
+import type { AdminUsersPageProps, BreadcrumbItem } from '@/types';
+
+defineProps<AdminUsersPageProps>();
+
+const breadcrumbs: BreadcrumbItem[] = [
+    {
+        title: 'User management',
+        href: adminUsers(),
+    },
+];
+</script>
+
+<template>
+    <AppLayout :breadcrumbs="breadcrumbs">
+        <Head title="User management" />
+
+        <div class="flex flex-1 flex-col gap-6 p-4">
+            <div class="flex items-start justify-between gap-4">
+                <Heading
+                    title="User management"
+                    description="Manage application-wide admin access for existing users."
+                />
+
+                <Badge variant="outline" class="gap-1.5 px-3 py-1">
+                    <Users class="size-3.5" />
+                    Admin-only area
+                </Badge>
+            </div>
+
+            <div
+                v-if="status"
+                class="rounded-xl border border-emerald-200 bg-emerald-50 px-4 py-3 text-sm text-emerald-900 dark:border-emerald-900/70 dark:bg-emerald-950/40 dark:text-emerald-100"
+            >
+                {{ status }}
+            </div>
+
+            <Card class="gap-0 overflow-hidden">
+                <CardHeader class="border-b">
+                    <CardTitle>Users</CardTitle>
+                    <CardDescription>
+                        Promote trusted users to platform admins or remove admin
+                        access when it is no longer needed.
+                    </CardDescription>
+                </CardHeader>
+
+                <CardContent class="p-0">
+                    <div
+                        v-if="users.length === 0"
+                        class="p-6 text-sm text-muted-foreground"
+                    >
+                        No users exist yet.
+                    </div>
+
+                    <div v-else class="overflow-x-auto">
+                        <table
+                            class="min-w-full divide-y divide-border text-sm"
+                        >
+                            <thead
+                                class="bg-muted/40 text-left text-muted-foreground"
+                            >
+                                <tr>
+                                    <th class="px-4 py-3 font-medium">User</th>
+                                    <th class="px-4 py-3 font-medium">Email</th>
+                                    <th class="px-4 py-3 font-medium">Role</th>
+                                    <th
+                                        class="px-4 py-3 text-right font-medium"
+                                    >
+                                        Action
+                                    </th>
+                                </tr>
+                            </thead>
+                            <tbody class="divide-y divide-border">
+                                <tr
+                                    v-for="user in users"
+                                    :key="user.id"
+                                    class="bg-background"
+                                >
+                                    <td class="px-4 py-4">
+                                        <div
+                                            class="font-medium text-foreground"
+                                        >
+                                            {{ user.name }}
+                                        </div>
+                                    </td>
+                                    <td class="px-4 py-4 text-muted-foreground">
+                                        {{ user.email }}
+                                    </td>
+                                    <td class="px-4 py-4">
+                                        <Badge
+                                            :variant="
+                                                user.is_admin
+                                                    ? 'default'
+                                                    : 'secondary'
+                                            "
+                                            class="gap-1.5"
+                                        >
+                                            <Shield class="size-3.5" />
+                                            {{
+                                                user.is_admin ? 'Admin' : 'User'
+                                            }}
+                                        </Badge>
+                                    </td>
+                                    <td class="px-4 py-4">
+                                        <div class="flex justify-end">
+                                            <Form
+                                                v-bind="
+                                                    UserManagementController.update.form(
+                                                        user.id,
+                                                    )
+                                                "
+                                                v-slot="{ processing }"
+                                            >
+                                                <input
+                                                    type="hidden"
+                                                    name="is_admin"
+                                                    :value="
+                                                        user.is_admin
+                                                            ? '0'
+                                                            : '1'
+                                                    "
+                                                />
+
+                                                <Button
+                                                    type="submit"
+                                                    size="sm"
+                                                    :variant="
+                                                        user.is_admin
+                                                            ? 'outline'
+                                                            : 'default'
+                                                    "
+                                                    :disabled="processing"
+                                                >
+                                                    {{
+                                                        user.is_admin
+                                                            ? 'Remove admin'
+                                                            : 'Make admin'
+                                                    }}
+                                                </Button>
+                                            </Form>
+                                        </div>
+                                    </td>
+                                </tr>
+                            </tbody>
+                        </table>
+                    </div>
+                </CardContent>
+            </Card>
+        </div>
+    </AppLayout>
+</template>

resources/js/types/auth.ts

@@ -1,13 +1,6 @@
-export type User = {
+import type { UserModel } from '@/types/models/user-model';
-    id: number;
+
-    name: string;
+export type User = UserModel;
-    email: string;
-    avatar?: string;
-    email_verified_at: string | null;
-    created_at: string;
-    updated_at: string;
-    [key: string]: unknown;
-};
 
 export type Auth = {
     user: User;

resources/js/types/index.ts

@@ -1,3 +1,4 @@
 export * from './auth';
 export * from './navigation';
+export * from './page-props';
 export * from './ui';

resources/js/types/models/user-model.ts

@@ -0,0 +1,11 @@
+export type UserModel = {
+    id: number;
+    name: string;
+    email: string;
+    avatar?: string;
+    email_verified_at: string | null;
+    is_admin: boolean;
+    created_at: string;
+    updated_at: string;
+    [key: string]: unknown;
+};

resources/js/types/page-props.ts

@@ -0,0 +1,6 @@
+import type { UserModel } from '@/types/models/user-model';
+
+export type AdminUsersPageProps = {
+    users: UserModel[];
+    status?: string | null;
+};

routes/web.php

@@ -1,5 +1,6 @@
 <?php
 
+use App\Http\Controllers\Admin\UserManagementController;
 use Illuminate\Support\Facades\Route;
 use Laravel\Fortify\Features;
 
@@ -11,4 +12,12 @@ Route::middleware(['auth', 'verified'])->group(function () {
     Route::inertia('dashboard', 'Dashboard')->name('dashboard');
 });
 
+Route::middleware(['auth', 'verified', 'can:access-admin'])
+    ->prefix('admin')
+    ->name('admin.')
+    ->group(function () {
+        Route::get('users', [UserManagementController::class, 'index'])->name('users.index');
+        Route::patch('users/{user}/admin-status', [UserManagementController::class, 'update'])->name('users.update');
+    });
+
 require __DIR__.'/settings.php';

tests/Feature/Admin/UserManagementControllerTest.php

@@ -0,0 +1,87 @@
+<?php
+
+namespace Tests\Feature\Admin;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Inertia\Testing\AssertableInertia as Assert;
+use Tests\TestCase;
+
+class UserManagementControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    /**
+     * Ensure admins can view the user management page.
+     */
+    public function test_admin_can_view_the_user_management_page(): void
+    {
+        $admin = User::factory()->admin()->create();
+        $member = User::factory()->create([
+            'name' => 'Regular User',
+            'email' => 'member@example.com',
+        ]);
+
+        $this->actingAs($admin)
+            ->get(route('admin.users.index'))
+            ->assertOk()
+            ->assertInertia(fn (Assert $page) => $page
+                ->component('admin/users/Index')
+                ->where('users.0.email', $admin->email)
+                ->where('users.1.email', $member->email)
+                ->where('users.0.is_admin', true)
+                ->where('users.1.is_admin', false),
+            );
+    }
+
+    /**
+     * Ensure non-admin users cannot view the user management page.
+     */
+    public function test_non_admin_cannot_view_the_user_management_page(): void
+    {
+        $member = User::factory()->create();
+
+        $this->actingAs($member)
+            ->get(route('admin.users.index'))
+            ->assertForbidden();
+    }
+
+    /**
+     * Ensure admins can update another user's admin access.
+     */
+    public function test_admin_can_update_a_users_admin_access(): void
+    {
+        $admin = User::factory()->admin()->create();
+        $member = User::factory()->create([
+            'name' => 'Regular User',
+        ]);
+
+        $this->actingAs($admin)
+            ->patch(route('admin.users.update', $member), [
+                'is_admin' => true,
+            ])
+            ->assertRedirect(route('admin.users.index'))
+            ->assertSessionHas('status', 'Regular User now has admin access.');
+
+        $this->assertTrue($member->refresh()->is_admin);
+    }
+
+    /**
+     * Ensure non-admin users cannot update admin access.
+     */
+    public function test_non_admin_cannot_update_a_users_admin_access(): void
+    {
+        $member = User::factory()->create();
+        $otherUser = User::factory()->create([
+            'is_admin' => false,
+        ]);
+
+        $this->actingAs($member)
+            ->patch(route('admin.users.update', $otherUser), [
+                'is_admin' => true,
+            ])
+            ->assertForbidden();
+
+        $this->assertFalse($otherUser->refresh()->is_admin);
+    }
+}

tests/Feature/Models/UserTest.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace Tests\Feature\Models;
+
+use App\Models\User;
+use Database\Seeders\UserSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class UserTest extends TestCase
+{
+    use RefreshDatabase;
+
+    /**
+     * Ensure the default user factory creates non-admin users.
+     */
+    public function test_user_factory_defaults_to_non_admin(): void
+    {
+        $user = User::factory()->create();
+
+        $this->assertFalse($user->is_admin);
+    }
+
+    /**
+     * Ensure the admin factory state creates admin users.
+     */
+    public function test_admin_factory_state_creates_admin_users(): void
+    {
+        $user = User::factory()->admin()->create();
+
+        $this->assertTrue($user->is_admin);
+    }
+
+    /**
+     * Ensure the user seeder creates both admin and regular users.
+     */
+    public function test_user_seeder_creates_admin_and_regular_users(): void
+    {
+        $this->seed(UserSeeder::class);
+
+        $this->assertDatabaseHas('users', [
+            'email' => 'admin@kanbangit.test',
+            'is_admin' => true,
+        ]);
+
+        $this->assertDatabaseHas('users', [
+            'email' => 'test@example.com',
+            'is_admin' => false,
+        ]);
+    }
+}