Add project general settings danger zone #25

Merged
Twyco merged 4 commits from codex/project-general-settings-danger-zone into main 2026-04-13 16:07:19 +00:00
17 changed files with 558 additions and 82 deletions
@@ -0,0 +1,28 @@
---
name: project-request-validation-style
description: "Always apply in this project when changing Laravel controllers or FormRequest classes. Enforces dedicated FormRequest usage for controller validation, validated-array access via Arr::get(), and forbids custom single-field getter methods or request helper extraction like boolean()/integer()/string() for app input handling."
---
# Project Request Validation Style
## When to Apply
Activate this skill whenever work in this project changes:
- Laravel controllers
- Laravel FormRequest classes
- Validation flow between controllers and requests
## Rules
- Do not add inline controller validation with `$request->validate(...)` when the endpoint has request-specific validation needs.
- Prefer dedicated `FormRequest` classes and use `$validated = $request->validated();` in controllers.
- When reading validated arrays, use `Arr::get($validated, 'key')` instead of direct array access.
- Do not use request helper extraction like `$request->boolean()`, `$request->integer()`, `$request->string()`, or similar helpers for application input handling.
- Do not add custom FormRequest getter helpers such as `points()`, `branchName()`, `ticketAttributes()`, or similar single-purpose accessors.
- Build controller payloads from the validated array directly with `Arr::get(...)`.
## Notes
- `Arr::get(...)` already returns `null` by default, so do not wrap it in redundant existence checks when `null` is acceptable.
- Keep validation logic in the FormRequest and payload shaping in the controller or dedicated action.
@@ -4,6 +4,7 @@ namespace App\Http\Controllers;
use App\Actions\ProjectPermissions\ProjectPermissionService;
use App\Actions\ProjectTicketMetadata\InitializeProjectTicketMetadata;
use App\Http\Requests\DeleteProjectRequest;
use App\Http\Requests\StoreProjectRequest;
use App\Http\Requests\SyncProjectPermissionsRequest;
use App\Models\Project;
@@ -44,6 +45,7 @@ class ProjectController extends Controller
return Inertia::render('projects/Index', [
'projects' => $projectQuery
->get(),
'status' => session('status'),
]);
}
@@ -76,6 +78,14 @@ class ProjectController extends Controller
]);
}
public function general(Request $request, Project $project): Response
{
return Inertia::render('projects/settings/General', [
'project' => $project,
'status' => session('status'),
]);
}
public function access(Request $request, Project $project): Response
{
$user = $request->user();
@@ -146,4 +156,16 @@ class ProjectController extends Controller
return to_route('projects.access', $project)
->with('status', "{$team->name} permissions were updated.");
}
public function destroy(DeleteProjectRequest $request, Project $project): RedirectResponse
{
$request->validated();
$projectName = $project->name;
$project->delete();
return to_route('projects.index')
->with('status', "Project {$projectName} was deleted.");
}
}
@@ -109,7 +109,16 @@ class ProjectTicketController extends Controller
$validated = $request->validated();
$fieldValues = Arr::get($validated, 'field_values');
$ticketAttributes = $request->ticketAttributes();
$ticketAttributes = [
'acceptance_criteria' => Arr::get($validated, 'acceptance_criteria'),
'blocked_comment' => Arr::get($validated, 'blocked_comment'),
'description' => Arr::get($validated, 'description'),
'is_blocked' => Arr::get($validated, 'is_blocked', false),
'parent_ticket_id' => Arr::get($validated, 'parent_ticket_id'),
'ticket_priority_id' => Arr::get($validated, 'ticket_priority_id'),
'ticket_type_id' => Arr::get($validated, 'ticket_type_id'),
'title' => Arr::get($validated, 'title'),
];
$wasUpdated = $this->updateProjectTicket->handle(
$ticket,
@@ -0,0 +1,43 @@
<?php
namespace App\Http\Requests;
use App\Models\Project;
use Illuminate\Contracts\Validation\ValidationRule;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rule;
class DeleteProjectRequest extends FormRequest
{
public function authorize(): bool
{
return $this->user() !== null;
}
/**
* @return array<string, ValidationRule|array<mixed>|string>
*/
public function rules(): array
{
/** @var Project $project */
$project = $this->route('project');
return [
'confirmation_key' => [
'required',
'string',
Rule::in([$project->key]),
],
];
}
/**
* @return array<string, string>
*/
public function messages(): array
{
return [
'confirmation_key.in' => 'Enter the exact project key to confirm deletion.',
];
}
}
+5 -2
View File
@@ -4,6 +4,7 @@ namespace App\Http\Requests;
use Illuminate\Contracts\Validation\ValidationRule;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Support\Arr;
use Illuminate\Validation\Rule;
class StoreProjectRequest extends FormRequest
@@ -18,9 +19,11 @@ class StoreProjectRequest extends FormRequest
protected function prepareForValidation(): void
{
if ($this->has('key')) {
$key = Arr::get($this->all(), 'key');
if ($key !== null) {
$this->merge([
'key' => strtoupper((string) $this->string('key')->trim()),
'key' => strtoupper(trim((string) $key)),
]);
}
}
@@ -71,14 +71,16 @@ class UpdateProjectTicketRequest extends FormRequest
{
return [
function (Validator $validator): void {
/** @var array<string, mixed> $validated */
$validated = $this->validated();
/** @var Project $project */
$project = $this->route('project');
/** @var Ticket $ticket */
$ticket = $this->route('ticket');
$parentTicketId = $this->input('parent_ticket_id');
$parentTicketId = is_numeric($parentTicketId) ? (int) $parentTicketId : null;
$parentTicketId = Arr::get($validated, 'parent_ticket_id');
if ($parentTicketId !== null) {
if ($parentTicketId === $ticket->id) {
@@ -105,12 +107,10 @@ class UpdateProjectTicketRequest extends FormRequest
}
}
$requestedTicketTypeId = $this->input('ticket_type_id');
$requestedTicketType = is_numeric($requestedTicketTypeId)
? TicketType::query()
->where('project_id', $project->id)
->find((int) $requestedTicketTypeId)
: null;
$requestedTicketTypeId = Arr::get($validated, 'ticket_type_id');
$requestedTicketType = TicketType::query()
->where('project_id', $project->id)
->find($requestedTicketTypeId);
if (
$requestedTicketType?->system_key !== 'parent'
@@ -119,61 +119,13 @@ class UpdateProjectTicketRequest extends FormRequest
$validator->errors()->add('ticket_type_id', 'Tickets with child tickets must keep a Parent type.');
}
if ($this->boolean('is_blocked') && blank($this->input('blocked_comment'))) {
if (Arr::get($validated, 'is_blocked', false) && blank(Arr::get($validated, 'blocked_comment'))) {
$validator->errors()->add('blocked_comment', 'Blocked tickets require a blocker comment.');
}
},
];
}
/**
* @return array{
* acceptance_criteria: string|null,
* blocked_comment: string|null,
* description: string|null,
* is_blocked: bool,
* parent_ticket_id: int|null,
* ticket_priority_id: int,
* ticket_type_id: int,
* title: string
* }
*/
public function ticketAttributes(): array
{
/** @var array{
* acceptance_criteria: string|null,
* blocked_comment: string|null,
* description: string|null,
* is_blocked: bool,
* parent_ticket_id: int|null,
* ticket_priority_id: int,
* ticket_type_id: int,
* title: string
* } $attributes
*/
$attributes = array_merge(
[
'acceptance_criteria' => null,
'blocked_comment' => null,
'description' => null,
'is_blocked' => false,
'parent_ticket_id' => null,
],
Arr::only($this->validated(), [
'acceptance_criteria',
'blocked_comment',
'description',
'is_blocked',
'parent_ticket_id',
'ticket_priority_id',
'ticket_type_id',
'title',
]),
);
return $attributes;
}
private function createsCycle(Ticket $ticket, Ticket $candidateParent): bool
{
$currentParent = $candidateParent;
+1 -19
View File
@@ -3,29 +3,11 @@
### Ticket
- general:
- new skill, user resources
- ueberall $array['''] ersetzen durch Arr::get()
- (mehr über middlewares steuern)
- why uses everywhere forceFill?
- $request->validated('xxx') ersetzten durch:
- ``` $validated = $request->validate(); $xxx = Arr:get($validated, 'xxx'); ```
- oder: ```$request->position()```, methoden entfernen, wie:
```
public function position(): ?int {
position = this->validated('position');
if ($position === null) {
return null;
}
return (int) $position;
}
```
- app/Http/Requests/UpdateProjectTicketRequest.php and other ProjectTicket only to Ticket...
- mehrere actions/quereys in services auslagern
- 02:
- Delete Projekt as Admin
- 03
- permission models? eg.g syncUserPermissions uses only db table
- mit morph auf perm user (z.b. team oder user)
@@ -70,4 +52,4 @@
- Git listBranches replace baseUrl, owner, rperoName with GItReprository
- Git prs replace baseUrl, owner, rperoName with GItReprository
- git php docu replace @ reutrn with data models
- replace Kanbangit with env App Name
- replace Kanbangit with env App Name
+16 -3
View File
@@ -13,6 +13,7 @@ import {
} from '@/components/ui/card';
import AppLayout from '@/layouts/AppLayout.vue';
import { access, index, show } from '@/routes/projects/index';
import { general as generalSettings } from '@/routes/projects/settings';
import type { BreadcrumbItem, ProjectAccessPageProps } from '@/types';
const props = defineProps<ProjectAccessPageProps>();
@@ -57,9 +58,21 @@ const hasPermission = (
/>
</div>
<Button as-child variant="outline">
<Link :href="show(project.id)">Back to project</Link>
</Button>
<div class="flex flex-wrap gap-3">
<Button
v-if="$page.props.auth.user.is_admin"
as-child
variant="outline"
>
<Link :href="generalSettings(project.id)">
General settings
</Link>
</Button>
<Button as-child variant="outline">
<Link :href="show(project.id)">Back to project</Link>
</Button>
</div>
</div>
<div
+7
View File
@@ -46,6 +46,13 @@ const breadcrumbs: BreadcrumbItem[] = [
</Button>
</div>
<div
v-if="status"
class="rounded-xl border border-emerald-200 bg-emerald-50 px-4 py-3 text-sm text-emerald-900 dark:border-emerald-900/70 dark:bg-emerald-950/40 dark:text-emerald-100"
>
{{ status }}
</div>
<div
v-if="projects.length === 0"
class="text-muted-foreground rounded-xl border border-dashed px-6 py-10 text-center text-sm"
+11
View File
@@ -17,6 +17,7 @@ import { index as boardIndex } from '@/routes/projects/board';
import { index as backlogIndex } from '@/routes/projects/backlog';
import {
board as boardSettings,
general as generalSettings,
metadata as metadataSettings,
repositories as repositorySettings,
} from '@/routes/projects/settings';
@@ -105,6 +106,16 @@ const projectAreas = [
</Link>
</Button>
<Button
v-if="$page.props.auth.user.is_admin"
as-child
variant="outline"
>
<Link :href="generalSettings(project.id)">
General settings
</Link>
</Button>
<Button as-child variant="outline">
<Link :href="metadataSettings(project.id)">
Ticket settings
@@ -18,6 +18,7 @@ import AppLayout from '@/layouts/AppLayout.vue';
import { index, show } from '@/routes/projects/index';
import {
board as boardSettings,
general as generalSettings,
repositories as repositorySettings,
} from '@/routes/projects/settings';
import type { BreadcrumbItem, ProjectBoardSettingsPageProps } from '@/types';
@@ -59,6 +60,16 @@ const breadcrumbs: BreadcrumbItem[] = [
</div>
<div class="flex flex-wrap gap-3">
<Button
v-if="$page.props.auth.user.is_admin"
as-child
variant="outline"
>
<Link :href="generalSettings(project.id)">
General settings
</Link>
</Button>
<Button as-child variant="outline">
<Link :href="repositorySettings(project.id)">
Repository settings
@@ -0,0 +1,216 @@
<script setup lang="ts">
import { Head, Link, useForm } from '@inertiajs/vue3';
import ProjectController from '@/actions/App/Http/Controllers/ProjectController';
import Heading from '@/components/Heading.vue';
import InputError from '@/components/InputError.vue';
import { Badge } from '@/components/ui/badge';
import { Button } from '@/components/ui/button';
import {
Card,
CardContent,
CardDescription,
CardHeader,
CardTitle,
} from '@/components/ui/card';
import { Input } from '@/components/ui/input';
import { Label } from '@/components/ui/label';
import AppLayout from '@/layouts/AppLayout.vue';
import { index, show } from '@/routes/projects/index';
import {
board as boardSettings,
general as generalSettings,
metadata as metadataSettings,
repositories as repositorySettings,
} from '@/routes/projects/settings';
import type {
BreadcrumbItem,
ProjectGeneralSettingsPageProps,
} from '@/types';
import { computed } from 'vue';
const props = defineProps<ProjectGeneralSettingsPageProps>();
const breadcrumbs: BreadcrumbItem[] = [
{
title: 'Projects',
href: index(),
},
{
title: props.project.name,
href: show(props.project.id),
},
{
title: 'General settings',
href: generalSettings(props.project.id),
},
];
const deleteForm = useForm({
confirmation_key: '',
});
const isDeleteConfirmationValid = computed(
() => deleteForm.confirmation_key === props.project.key,
);
const submitDelete = (): void => {
if (!isDeleteConfirmationValid.value) {
return;
}
deleteForm.submit(ProjectController.destroy(props.project.id), {
preserveScroll: true,
});
};
</script>
<template>
<AppLayout :breadcrumbs="breadcrumbs">
<Head :title="`${project.name} general settings`" />
<div class="flex flex-1 flex-col gap-6 p-4">
<div
class="flex flex-col gap-4 sm:flex-row sm:items-start sm:justify-between"
>
<div class="space-y-3">
<Badge variant="outline" class="px-3 py-1">
{{ project.key }}
</Badge>
<Heading
:title="`${project.name} general settings`"
description="Review the core project identity and manage irreversible administrative actions."
/>
</div>
<div class="flex flex-wrap gap-3">
<Button as-child variant="outline">
<Link :href="boardSettings(project.id)">
Board settings
</Link>
</Button>
<Button as-child variant="outline">
<Link :href="metadataSettings(project.id)">
Ticket settings
</Link>
</Button>
<Button as-child variant="outline">
<Link :href="repositorySettings(project.id)">
Repository settings
</Link>
</Button>
<Button as-child variant="outline">
<Link :href="show(project.id)">Back to project</Link>
</Button>
</div>
</div>
<div
v-if="status"
class="rounded-xl border border-emerald-200 bg-emerald-50 px-4 py-3 text-sm text-emerald-900 dark:border-emerald-900/70 dark:bg-emerald-950/40 dark:text-emerald-100"
>
{{ status }}
</div>
<Card>
<CardHeader>
<CardTitle>Project identity</CardTitle>
<CardDescription>
These values define the project across tickets, boards,
and repository matching.
</CardDescription>
</CardHeader>
<CardContent class="grid gap-4 md:grid-cols-2">
<div class="rounded-xl border border-border/70 p-4">
<p
class="text-xs font-semibold uppercase tracking-[0.18em] text-muted-foreground"
>
Project name
</p>
<p class="mt-2 text-sm font-semibold text-foreground">
{{ project.name }}
</p>
</div>
<div class="rounded-xl border border-border/70 p-4">
<p
class="text-xs font-semibold uppercase tracking-[0.18em] text-muted-foreground"
>
Project key
</p>
<p class="mt-2 text-sm font-semibold text-foreground">
{{ project.key }}
</p>
</div>
</CardContent>
</Card>
<Card
class="border-red-200/80 bg-red-50/60 dark:border-red-900/60 dark:bg-red-950/20"
>
<CardHeader>
<CardTitle class="text-red-900 dark:text-red-100">
Danger zone
</CardTitle>
<CardDescription
class="text-red-800/80 dark:text-red-200/80"
>
Deleting this project is permanent. All tickets, board
columns, ticket metadata, repository connections, and
project permissions will be removed.
</CardDescription>
</CardHeader>
<CardContent class="space-y-5">
<div
class="rounded-xl border border-red-200/80 bg-background/80 p-4 dark:border-red-900/60"
>
<p class="text-sm font-medium text-foreground">
Confirm by typing the exact project key:
<span class="font-semibold">{{ project.key }}</span>
</p>
</div>
<form class="space-y-4" @submit.prevent="submitDelete">
<div class="grid gap-2">
<Label for="confirmation_key">
Confirmation key
</Label>
<Input
id="confirmation_key"
v-model="deleteForm.confirmation_key"
:disabled="deleteForm.processing"
placeholder="Type the project key exactly"
/>
<InputError
:message="deleteForm.errors.confirmation_key"
/>
</div>
<div
class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between"
>
<p class="text-sm text-muted-foreground">
This action cannot be undone.
</p>
<Button
type="submit"
variant="destructive"
:disabled="
deleteForm.processing ||
!isDeleteConfirmationValid
"
>
Delete project
</Button>
</div>
</form>
</CardContent>
</Card>
</div>
</AppLayout>
</template>
@@ -18,6 +18,7 @@ import AppLayout from '@/layouts/AppLayout.vue';
import { index, show } from '@/routes/projects/index';
import {
board as boardSettings,
general as generalSettings,
metadata as metadataSettings,
repositories as repositorySettings,
} from '@/routes/projects/settings';
@@ -63,6 +64,16 @@ const breadcrumbs: BreadcrumbItem[] = [
</div>
<div class="flex flex-wrap gap-3">
<Button
v-if="$page.props.auth.user.is_admin"
as-child
variant="outline"
>
<Link :href="generalSettings(project.id)">
General settings
</Link>
</Button>
<Button as-child variant="outline">
<Link :href="boardSettings(project.id)">
Board settings
@@ -19,6 +19,7 @@ import { edit as editGitConnections } from '@/routes/git-connections/index';
import { index, show } from '@/routes/projects/index';
import {
board as boardSettings,
general as generalSettings,
metadata as metadataSettings,
repositories as repositorySettings,
} from '@/routes/projects/settings';
@@ -232,6 +233,16 @@ const submitUpdate = (): void => {
</div>
<div class="flex flex-wrap gap-3">
<Button
v-if="$page.props.auth.user.is_admin"
as-child
variant="outline"
>
<Link :href="generalSettings(project.id)">
General settings
</Link>
</Button>
<Button as-child variant="outline">
<Link :href="boardSettings(project.id)">
Board settings
+6
View File
@@ -23,6 +23,7 @@ export type AdminUsersPageProps = {
export type ProjectsIndexPageProps = {
projects: ProjectModel[];
status?: string | null;
};
export type ProjectShowPageProps = {
@@ -57,6 +58,11 @@ export type ProjectBoardSettingsPageProps = {
status?: string | null;
};
export type ProjectGeneralSettingsPageProps = {
project: ProjectModel;
status?: string | null;
};
export type ProjectBoardPageProps = {
boardColumns: BoardColumnModel[];
canEditTickets: boolean;
+7
View File
@@ -24,6 +24,10 @@ Route::middleware(['auth', 'verified'])->group(function () {
Route::resource('projects', ProjectController::class)
->only(['index', 'create', 'store', 'show']);
Route::delete('projects/{project}', [ProjectController::class, 'destroy'])
->middleware('can:access-admin')
->name('projects.destroy');
Route::get('projects/{project}/access', [ProjectController::class, 'access'])
->name('projects.access');
Route::patch('projects/{project}/permissions/users/{user}', [ProjectController::class, 'updateUserPermissions'])
@@ -53,6 +57,9 @@ Route::middleware(['auth', 'verified'])->group(function () {
->name('projects.tickets.links.destroy');
Route::patch('projects/{project}/tickets/{ticket}/status', [ProjectBoardController::class, 'move'])
->name('projects.tickets.status.update');
Route::get('projects/{project}/settings/general', [ProjectController::class, 'general'])
->middleware('can:access-admin')
->name('projects.settings.general');
Route::get('projects/{project}/settings/board', [ProjectBoardSettingsController::class, 'show'])
->name('projects.settings.board');
Route::post('projects/{project}/settings/board/columns', [ProjectBoardSettingsController::class, 'store'])
@@ -3,8 +3,12 @@
namespace Tests\Feature\Projects;
use App\Actions\ProjectPermissions\ProjectPermissionService;
use App\Actions\ProjectTicketMetadata\InitializeProjectTicketMetadata;
use App\Models\BoardColumn;
use App\Models\Project;
use App\Models\Team;
use App\Models\Ticket;
use App\Models\TicketPriority;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Inertia\Testing\AssertableInertia as Assert;
@@ -275,6 +279,146 @@ class ProjectControllerTest extends TestCase
);
}
/**
* Ensure admins can open the general project settings page.
*/
public function test_admins_can_view_general_project_settings(): void
{
$admin = User::factory()->admin()->create();
$project = Project::factory()->create([
'key' => 'CORE',
]);
$this->actingAs($admin)
->get(route('projects.settings.general', $project))
->assertOk()
->assertInertia(fn (Assert $page) => $page
->component('projects/settings/General')
->where('project.id', $project->id)
->where('project.key', 'CORE'),
);
}
/**
* Ensure non-admin users cannot open general project settings even with project permissions.
*/
public function test_non_admin_users_cannot_view_general_project_settings(): void
{
$user = User::factory()->create();
$project = Project::factory()->create([
'key' => 'CORE',
]);
app(ProjectPermissionService::class)->syncUserPermissions($project, $user, ['view', 'edit', 'delete']);
$this->actingAs($user)
->get(route('projects.settings.general', $project))
->assertForbidden();
}
/**
* Ensure admins can delete projects and their dependent project-scoped data.
*/
public function test_admins_can_delete_projects_from_general_settings(): void
{
$admin = User::factory()->admin()->create();
$member = User::factory()->create();
$project = Project::factory()->create([
'key' => 'CORE',
'name' => 'Core Platform',
]);
app(InitializeProjectTicketMetadata::class)->handle($project);
$priority = TicketPriority::factory()->for($project)->create([
'name' => 'Medium',
'position' => 1,
]);
$boardColumn = BoardColumn::factory()->for($project)->create([
'name' => 'In Progress',
'position' => 1,
]);
$ticket = Ticket::factory()->create([
'board_column_id' => $boardColumn->id,
'project_id' => $project->id,
'sequence_number' => 1,
'ticket_key' => 'CORE-1',
'ticket_priority_id' => $priority->id,
'ticket_type_id' => $project->ticketTypes()->where('system_key', 'task')->firstOrFail()->id,
'title' => 'Delete me',
]);
app(ProjectPermissionService::class)->syncUserPermissions($project, $member, ['view']);
$this->actingAs($admin)
->delete(route('projects.destroy', $project), [
'confirmation_key' => 'CORE',
])
->assertRedirect(route('projects.index'))
->assertSessionHas('status', 'Project Core Platform was deleted.');
$this->assertDatabaseMissing('projects', [
'id' => $project->id,
]);
$this->assertDatabaseMissing('board_columns', [
'id' => $boardColumn->id,
]);
$this->assertDatabaseMissing('tickets', [
'id' => $ticket->id,
]);
$this->assertDatabaseMissing('project_user_permissions', [
'project_id' => $project->id,
'user_id' => $member->id,
'permission' => 'view',
]);
}
/**
* Ensure project deletion requires the exact project key confirmation.
*/
public function test_admins_must_confirm_the_exact_project_key_to_delete_a_project(): void
{
$admin = User::factory()->admin()->create();
$project = Project::factory()->create([
'key' => 'CORE',
]);
$this->actingAs($admin)
->from(route('projects.settings.general', $project))
->delete(route('projects.destroy', $project), [
'confirmation_key' => 'core',
])
->assertRedirect(route('projects.settings.general', $project))
->assertSessionHasErrors('confirmation_key');
$this->assertDatabaseHas('projects', [
'id' => $project->id,
]);
}
/**
* Ensure non-admin users cannot delete projects.
*/
public function test_non_admin_users_cannot_delete_projects(): void
{
$user = User::factory()->create();
$project = Project::factory()->create([
'key' => 'CORE',
]);
app(ProjectPermissionService::class)->syncUserPermissions($project, $user, ['view', 'edit', 'delete']);
$this->actingAs($user)
->delete(route('projects.destroy', $project), [
'confirmation_key' => 'CORE',
])
->assertForbidden();
$this->assertDatabaseHas('projects', [
'id' => $project->id,
]);
}
/**
* Ensure admins can update direct project permissions for a user.
*/