PetschStudios/ots
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix team authorization, invite revocation, and slug handling
CI/CD / test_and_check_app (push) Failing after 58s
Details
CI/CD / Publish immutable image (push) Skipped
Details

Browse Source
This commit is contained in:
Twyco
2026-09-19 05:54:18 +02:00
parent 3db250ca51
commit e9fc8cabb5
18 changed files with 688 additions and 226 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Http/Controllers/TeamController.php
+42 -44
View File
@@ -8,63 +8,63 @@ use App\Http\Requests\UpdateTeamRequest;
use App\Http\Resources\TeamInviteResource;
use App\Http\Resources\TeamResource;
use App\Models\Team;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Arr;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Str;
use Inertia\Inertia;
use Str;
use Inertia\Response;
class TeamController extends Controller
{
/**
* Display a listing of the resource.
*/
public function index(Request $request)
public function index(Request $request): Response
{
return Inertia::render('team/Index', [
'teams' => TeamResource::collection(Team::visibleTo(auth()->user())->get())->resolve($request),
'teams' => TeamResource::collection(Team::visibleTo($request->user())->with('members')->get())->resolve($request),
]);
}
public function show(Request $request, Team $team)
public function show(Request $request, Team $team): Response
{
$teamManager = auth()->user()->can('manage', $team);
$teamManager = $request->user()->can('manage', $team);
$team->load('members');
return Inertia::render('team/Show', [
'team' => TeamResource::make($team)->resolve($request),
'canManageTeam' => $teamManager,
] + ($teamManager ? [
'teamInvites' => TeamInviteResource::collection($team->invites)->resolve($request),
'teamInvites' => TeamInviteResource::collection($team->invites()->with('invitedBy')->get())->resolve($request),
] : []));
}
/**
* Store a newly created resource in storage.
*/
public function store(StoreTeamRequest $request)
public function store(StoreTeamRequest $request): RedirectResponse
{
$validated = $request->validated();
try {
DB::transaction(function () use ($validated) {
$team = Team::create($validated);
$team->members()->attach(
request()->user()->id,
['role' => TeamMemberRole::Admin]
);
DB::transaction(function () use ($request): void {
$team = Team::create($request->validated());
$team->members()->attach($request->user(), ['role' => TeamMemberRole::Admin]);
});
} catch (\Exception $exception) {
report($exception);
Inertia::flash('error', 'Team could not be created.');
return back()->withInput();
}
Inertia::flash('success', 'Team successfully created.');
return to_route('teams.index');
} catch (\Exception $exception) {
Inertia::flash('error', 'Team could not be created.');
DB::rollBack();
return back();
}
}
public function create()
public function create(): Response
{
return Inertia::render('team/Create');
}
@@ -72,7 +72,7 @@ class TeamController extends Controller
/**
* Show the form for editing the specified resource.
*/
public function edit(Request $request, Team $team)
public function edit(Request $request, Team $team): Response
{
return Inertia::render('team/Edit', [
'team' => TeamResource::make($team)->resolve($request),
@@ -82,25 +82,23 @@ class TeamController extends Controller
/**
* Update the specified resource in storage.
*/
public function update(UpdateTeamRequest $request, Team $team)
public function update(UpdateTeamRequest $request, Team $team): RedirectResponse
{
$validated = $request->validated();
try {
DB::transaction(function () use ($validated, $team) {
$team->update($validated);
});
Inertia::flash('success', 'Team successfully updated.');
$team->update($request->validated());
} catch (\Exception $exception) {
report($exception);
Inertia::flash('error', 'Team could not be updated.');
DB::rollBack();
return back()->withInput();
}
Inertia::flash('success', 'Team successfully updated.');
return to_route('teams.show', $team);
}
public function nameToSlug(Request $request)
public function nameToSlug(Request $request): JsonResponse
{
$validated = $request->validate([
'name' => 'required|string|max:255',
@@ -114,7 +112,7 @@ class TeamController extends Controller
return response()->json([
'name' => $name,
'slug' => $slug,
'taken' => $slug !== $ignoredSlug && Team::whereSlug($slug)->exists(),
'taken' => $slug === 'create' || ($slug !== $ignoredSlug && Team::whereSlug($slug)->exists()),
]);
}
@@ -134,25 +132,25 @@ class TeamController extends Controller
Inertia::flash('success', 'User invited to your team.');
}
public function revokeInvite(Request $request, Team $team)
public function revokeInvite(Request $request, Team $team): RedirectResponse
{
$validated = $request->validate([
'email' => 'required|email|max:255|exists:team_invites,invited_email',
'email' => 'required|email|max:255',
]);
abort_unless(auth()->user()->can('manage', $team), 403);
$teamInvite = $team->invites()->whereInvitedEmail(Arr::get($validated, 'email'))->firstOrFail();
$teamInvite = $team->invites()->whereInvitedEmail($validated['email'])->firstOrFail();
try {
DB::transaction(function () use ($teamInvite) {
$teamInvite->delete();
});
Inertia::flash('success', 'successfully deleted user invite.');
} catch (\Throwable $e) {
} catch (\Exception $exception) {
report($exception);
Inertia::flash('error', 'could not delete user invite.');
DB::rollBack();
return to_route('teams.show', $team);
}
Inertia::flash('success', 'successfully deleted user invite.');
return to_route('teams.show', $team);
}
}
app/Http/Requests/StoreTeamRequest.php
+5 -5
View File
@@ -5,6 +5,7 @@ namespace App\Http\Requests;
use Illuminate\Contracts\Validation\ValidationRule;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Support\Str;
use Illuminate\Validation\Rule;
class StoreTeamRequest extends FormRequest
{
@@ -17,7 +18,7 @@ class StoreTeamRequest extends FormRequest
{
return [
'name' => ['required', 'string', 'max:255'],
'slug' => ['required', 'string', 'max:255', 'unique:teams,slug'],
'slug' => ['required', 'string', 'max:255', Rule::notIn(['create']), Rule::unique('teams', 'slug')],
'require_2fa' => ['required', 'boolean'],
];
}
@@ -25,9 +26,8 @@ class StoreTeamRequest extends FormRequest
public function messages(): array
{
return [
'slug.string' => '',
'slug.required' => '',
'slug.max' => '',
'slug.required' => 'The name must contain letters or numbers.',
'slug.not_in' => 'This name is reserved.',
'slug.unique' => 'The name has already been taken.',
];
}
@@ -35,7 +35,7 @@ class StoreTeamRequest extends FormRequest
protected function prepareForValidation(): void
{
$this->merge([
'slug' => Str::slug($this->name),
'slug' => is_string($this->input('name')) ? Str::slug($this->input('name')) : null,
]);
}
}
app/Http/Requests/UpdateTeamRequest.php
+6 -6
View File
@@ -5,6 +5,7 @@ namespace App\Http\Requests;
use Illuminate\Contracts\Validation\ValidationRule;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Support\Str;
use Illuminate\Validation\Rule;
class UpdateTeamRequest extends FormRequest
{
@@ -16,8 +17,8 @@ class UpdateTeamRequest extends FormRequest
public function rules(): array
{
return [
'name' => ['nullable', 'string', 'max:255'],
'slug' => ['nullable', 'required_with:name', 'string', 'max:255', 'unique:teams,slug,'.$this->route('team')->id],
'name' => ['sometimes', 'required', 'string', 'max:255'],
'slug' => [Rule::excludeIf(! $this->has('name')), 'required', 'string', 'max:255', Rule::notIn(['create']), Rule::unique('teams', 'slug')->ignore($this->route('team'))],
'require_2fa' => ['required', 'boolean'],
];
}
@@ -25,9 +26,8 @@ class UpdateTeamRequest extends FormRequest
public function messages(): array
{
return [
'slug.string' => '',
'slug.required' => '',
'slug.max' => '',
'slug.required' => 'The name must contain letters or numbers.',
'slug.not_in' => 'This name is reserved.',
'slug.unique' => 'The name has already been taken.',
];
}
@@ -35,7 +35,7 @@ class UpdateTeamRequest extends FormRequest
protected function prepareForValidation(): void
{
$this->merge([
'slug' => Str::slug($this->name),
'slug' => is_string($this->input('name')) ? Str::slug($this->input('name')) : null,
]);
}
}
app/Http/Resources/TeamInviteResource.php
-1
View File
@@ -20,7 +20,6 @@ class TeamInviteResource extends JsonResource
{
return [
'invitedEmail' => $this->invited_email,
'team' => TeamResource::make($this->team)->resolve($request),
'invitedBy' => UserResource::make($this->invitedBy)->resolve($request),
'invitedAt' => $this->created_at->toDateTimeString(),
];
app/Http/Resources/UserResource.php
+1 -1
View File
@@ -21,7 +21,7 @@ class UserResource extends JsonResource
return [
'name' => $this->name,
'email' => $this->email,
'has_multi_factor' => $this->hasVerifiedEmail() || $this->hasEnabledTwoFactorAuthentication(),
'has_multi_factor' => $this->hasEnabledTwoFactorAuthentication(),
];
}
}
database/factories/TeamFactory.php
+22
View File
@@ -0,0 +1,22 @@
<?php
namespace Database\Factories;
use App\Models\Team;
use Illuminate\Database\Eloquent\Factories\Factory;
use Illuminate\Support\Str;
/** @extends Factory<Team> */
class TeamFactory extends Factory
{
public function definition(): array
{
$name = fake()->unique()->company();
return [
'name' => $name,
'slug' => Str::slug($name),
'require_2fa' => false,
];
}
}
database/factories/TeamInviteFactory.php
+21
View File
@@ -0,0 +1,21 @@
<?php
namespace Database\Factories;
use App\Models\TeamInvite;
use Illuminate\Database\Eloquent\Factories\Factory;
use Illuminate\Support\Str;
/** @extends Factory<TeamInvite> */
class TeamInviteFactory extends Factory
{
public function definition(): array
{
return [
'team_id' => TeamFactory::new(),
'invited_by_user_id' => UserFactory::new(),
'invited_email' => fake()->unique()->safeEmail(),
'invite_token' => hash('sha256', Str::random(128)),
];
}
}
resources/js/components/TeamSlug.vue
+55 -38
View File
@@ -1,53 +1,70 @@
<script lang="ts" setup>
import teamRoutes from '@/routes/teams';
import { useHttp } from '@inertiajs/vue3';
import { ref, watch } from 'vue';
import InputError from '@/components/InputError.vue';
import { Label } from '@/components/ui/label';
import { Input } from '@/components/ui/input';
import { nameToSlug } from '@/routes/teams';
import type {
TeamSlugProps,
TeamSlugRequest,
TeamSlugResponse,
} from '@/types/team';
import InputError from "@/components/InputError.vue";
import {Label} from "@/components/ui/label";
import {Input} from "@/components/ui/input";
import {watch} from "vue";
const props = defineProps<TeamSlugProps>();
const slug = defineModel<string>('slug', { required: true });
const slugTaken = defineModel<boolean>('slugTaken', { required: true });
const previewError = ref('');
const http = useHttp<TeamSlugRequest, TeamSlugResponse>({
name: '',
ignored_slug: null,
});
type nameToSlugResponse = {
name: string;
slug: string;
taken: boolean;
watch(
() => props.name,
(name, _previous, onCleanup) => {
let active = true;
slugTaken.value = false;
previewError.value = '';
const timer = setTimeout(async () => {
if (!name.trim()) {
slug.value = '';
return;
}
const props = defineProps<{ name: string, ignoredSlug?: string }>()
http.name = name;
http.ignored_slug = props.ignoredSlug ?? null;
const slug = defineModel<string>('slug', {
required: true,
});
const slugTaken = defineModel<boolean>('slugTaken', {
required: true,
});
const slugError = defineModel<string>('slugError', {
required: true,
});
watch(() => props.name, (newName) => fetch(teamRoutes.nameToSlug().url, {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({name: newName, ignored_slug: props.ignoredSlug})
}).then(async (response) => {
slugError.value = ''
console.info(response)
const body = (await response.json()) as unknown as nameToSlugResponse;
console.info(body)
slug.value = body.slug;
slugTaken.value = body.taken;
if (slugTaken.value) {
slugError.value = 'Der Slug ist bereits vergeben.'
try {
const response = await http.submit(nameToSlug());
if (active) {
slug.value = response.slug;
slugTaken.value = response.taken;
previewError.value = response.taken
? 'Der Slug ist bereits vergeben.'
: '';
}
}).catch(() => slugError.value = 'Failed to Fetch new slug')
)
} catch {
if (active) {
previewError.value = 'Die Slug-Vorschau konnte nicht geladen werden.';
}
}
}, 250);
onCleanup(() => {
active = false;
clearTimeout(timer);
http.cancel();
});
},
);
</script>
<template>
<div class="grid items-start gap-3">
<Label for="slug">Slug</Label>
<Input id="slug" v-model="slug" disabled name="slug"/>
<InputError :message="slugError"/>
<Input id="slug" :model-value="slug" disabled name="slug" />
<InputError :message="error || previewError" />
</div>
</template>
resources/js/pages/team/Create.vue
+17 -12
View File
@@ -7,9 +7,9 @@ import {Input} from '@/components/ui/input';
import { Label } from '@/components/ui/label';
import InputError from '@/components/InputError.vue';
import { Checkbox } from '@/components/ui/checkbox';
import {ref, watch} from "vue";
import TeamSlug from "@/components/TeamSlug.vue";
import {Card, CardContent} from "@/components/ui/card";
import { ref } from 'vue';
import TeamSlug from '@/components/TeamSlug.vue';
import { Card, CardContent } from '@/components/ui/card';
defineOptions({
layout: {
@@ -26,36 +26,37 @@ defineOptions({
},
});
const slug = ref('');
const slugTaken = ref(false);
const slugError = ref<string>('');
const form = useForm({
name: '',
slug: '',
require_2fa: false,
});
function submit(): void {
form.submit(teamRoutes.store());
}
watch(() => (form.errors as any).slug, (newError) => slugError.value = newError)
</script>
<template>
<Head title="Teams"/>
<div class="flex flex-col justify-center p-16">
<Head title="Teams" />
<Card class="w-full">
<CardContent>
<form class="grid w-full gap-5 py-4" @submit.prevent="submit">
<div class="grid grid-cols-2 gap-5 items-start">
<div class="grid grid-cols-2 items-start gap-5">
<div class="grid items-start gap-3">
<Label for="name">Name</Label>
<Input id="name" v-model="form.name" name="name" />
<InputError :message="form.errors.name" />
</div>
<TeamSlug :name="form.name" :slug="slug" :slug-error="slugError" :slug-taken="slugTaken"/>
<TeamSlug
:name="form.name"
v-model:slug="form.slug"
:error="form.errors.slug"
v-model:slug-taken="slugTaken"
/>
<div class="grid items-start gap-3">
<Label for="require_2fa">Require 2FA</Label>
<Checkbox
@@ -67,7 +68,11 @@ watch(() => (form.errors as any).slug, (newError) => slugError.value = newError)
</div>
</div>
<div class="flex w-full justify-end">
<Button :disabled="form.processing || slugTaken" class="w-fit" type="submit">
<Button
:disabled="form.processing || slugTaken"
class="w-fit"
type="submit"
>
<component :is="Save" />
Erstellen
</Button>
resources/js/pages/team/Edit.vue
+21 -18
View File
@@ -7,14 +7,12 @@ import {Input} from '@/components/ui/input';
import { Label } from '@/components/ui/label';
import InputError from '@/components/InputError.vue';
import { Checkbox } from '@/components/ui/checkbox';
import {Team} from '@/types/models';
import {ref, watch} from "vue";
import TeamSlug from "@/components/TeamSlug.vue";
import {Card, CardContent} from "@/components/ui/card";
import type { TeamEditPageProps } from '@/types/page-props';
import { ref } from 'vue';
import TeamSlug from '@/components/TeamSlug.vue';
import { Card, CardContent } from '@/components/ui/card';
const props = defineProps<{
team: Team;
}>();
const props = defineProps<TeamEditPageProps>();
setLayoutProps({
breadcrumbs: [
@@ -24,42 +22,43 @@ setLayoutProps({
},
{
title: props.team.name,
href: teamRoutes.create(),
href: teamRoutes.show({ team: props.team.slug }),
},
],
});
const slug = ref(props.team.slug);
const slugTaken = ref(false);
const slugError = ref<string>('');
const form = useForm({
name: props.team.name,
slug: props.team.slug,
require_2fa: props.team.multi_factor_required,
});
function submit(): void {
form.patch(teamRoutes.update({ team: props.team.slug }).url);
}
watch(() => (form.errors as any).slug, (newError) => slugError.value = newError)
</script>
<template>
<Head title="Teams"/>
<div class="flex flex-col justify-center p-16">
<Head title="Teams" />
<Card class="w-full">
<CardContent>
<form class="grid w-full gap-5 py-4" @submit.prevent="submit">
<div class="grid grid-cols-2 gap-5 items-start">
<div class="grid grid-cols-2 items-start gap-5">
<div class="grid items-start gap-3">
<Label for="name">Name</Label>
<Input id="name" v-model="form.name" name="name" />
<InputError :message="form.errors.name" />
</div>
<TeamSlug :ignored-slug="team.slug" :name="form.name" :slug="slug" :slug-error="slugError"
:slug-taken="slugTaken"/>
<TeamSlug
:ignored-slug="team.slug"
:name="form.name"
v-model:slug="form.slug"
:error="form.errors.slug"
v-model:slug-taken="slugTaken"
/>
<div class="grid items-start gap-3">
<Label for="require_2fa">Require 2FA</Label>
<Checkbox
@@ -71,7 +70,11 @@ watch(() => (form.errors as any).slug, (newError) => slugError.value = newError)
</div>
</div>
<div class="flex w-full justify-end">
<Button :disabled="form.processing || slugTaken" class="w-fit" type="submit">
<Button
:disabled="form.processing || slugTaken"
class="w-fit"
type="submit"
>
<component :is="Save" />
Speichern
</Button>
resources/js/pages/team/Index.vue
+27 -12
View File
@@ -2,9 +2,18 @@
import teamRoutes from '@/routes/teams';
import { Head, Link, router, usePage } from '@inertiajs/vue3';
import type { Team } from '@/types/models';
import type { TeamIndexPageProps } from '@/types/page-props';
import TextLink from '@/components/TextLink.vue';
import { Card, CardContent } from '@/components/ui/card';
import {Table, TableBody, TableCaption, TableCell, TableHead, TableHeader, TableRow,} from '@/components/ui/table';
import {
Table,
TableBody,
TableCaption,
TableCell,
TableHead,
TableHeader,
TableRow,
} from '@/components/ui/table';
import { Button } from '@/components/ui/button';
import { Eye, Pencil, Plus } from '@lucide/vue';
@@ -19,9 +28,7 @@ defineOptions({
},
});
defineProps<{
teams: Team[];
}>();
defineProps<TeamIndexPageProps>();
const user = usePage().props.auth.user;
@@ -33,9 +40,8 @@ const canManageTeam = (team: Team) =>
</script>
<template>
<Head title="Teams"/>
<div class="flex flex-col justify-center p-16">
<Head title="Teams" />
<div class="flex w-full justify-end py-4">
<Link :href="teamRoutes.create()">
<Button>
@@ -59,25 +65,34 @@ const canManageTeam = (team: Team) =>
<TableBody>
<TableRow
v-for="team in teams"
v-if="teams.length > 0"
:key="team.slug"
role="link"
tabindex="0"
@click="openTeam(team)"
@keydown.enter.self="openTeam(team)"
>
<TableCell>{{ team.name }}</TableCell>
<TableCell>{{ team.slug }}</TableCell>
<TableCell>{{ team.members.length }}</TableCell>
<TableCell>{{ team.multi_factor_required ? 'Ja' : 'Nein' }}</TableCell>
<TableCell>{{
team.multi_factor_required ? 'Ja' : 'Nein'
}}</TableCell>
<TableCell>
<Link
:href="(canManageTeam(team) ? teamRoutes.edit : teamRoutes.show)({ team: team.slug })"
:href="
(canManageTeam(team) ? teamRoutes.edit : teamRoutes.show)({
team: team.slug,
})
"
class="cursor-pointer"
@click.stop
>
<TableCell>
<component :is="canManageTeam(team) ? Pencil : Eye" size="18"/>
</TableCell>
<component
:is="canManageTeam(team) ? Pencil : Eye"
size="18"
/>
</Link>
</TableCell>
</TableRow>
</TableBody>
<TableCaption v-if="teams.length <= 0">
resources/js/pages/team/Show.vue
+50 -32
View File
@@ -1,17 +1,22 @@
<script lang="ts" setup>
import teamRoutes from '@/routes/teams';
import {Head, Link, setLayoutProps} from '@inertiajs/vue3';
import type {Team, TeamInvite} from '@/types/models';
import { Head, Link, setLayoutProps, useForm } from '@inertiajs/vue3';
import type { TeamInvite } from '@/types/models';
import type { TeamShowPageProps } from '@/types/page-props';
import InputError from '@/components/InputError.vue';
import { Card, CardContent } from '@/components/ui/card';
import {Table, TableBody, TableCell, TableHead, TableHeader, TableRow,} from '@/components/ui/table';
import {
Table,
TableBody,
TableCell,
TableHead,
TableHeader,
TableRow,
} from '@/components/ui/table';
import { Button } from '@/components/ui/button';
import { Pencil, Trash } from '@lucide/vue';
const props = defineProps<{
team: Team;
canManageTeam: boolean;
teamInvites?: TeamInvite[];
}>();
const props = defineProps<TeamShowPageProps>();
setLayoutProps({
breadcrumbs: [
@@ -26,18 +31,23 @@ setLayoutProps({
],
});
const revokeInvite = (teamInvite: TeamInvite) => fetch(teamRoutes.invite.revoke(teamInvite.team.slug).url, {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({email: teamInvite.invitedEmail})
})
const revokeForm = useForm({ email: '' });
function revokeInvite(invite: TeamInvite): void {
if (revokeForm.processing) {
return;
}
revokeForm.email = invite.invitedEmail;
revokeForm.submit(teamRoutes.invite.revoke({ team: props.team.slug }), {
preserveScroll: true,
});
}
</script>
<template>
<Head title="Teams"/>
<div class="flex flex-col justify-center p-16">
<Head title="Teams" />
<div v-if="canManageTeam" class="flex w-full justify-end py-4">
<Link :href="teamRoutes.edit({ team: team.slug })">
<Button>
@@ -47,18 +57,20 @@ const revokeInvite = (teamInvite: TeamInvite) => fetch(teamRoutes.invite.revoke(
</Link>
</div>
<Card class="w-full mb-8">
<Card class="mb-8 w-full">
<CardContent class="flex flex-col">
<h1 class="font-semibold text-2xl">{{ team.name }}</h1>
<h1 class="text-2xl font-semibold">{{ team.name }}</h1>
<Table>
<TableBody class="[&_td]:py-0 [&_tr]:border-0 text-gray-500 text-sm">
<TableBody class="text-sm text-gray-500 [&_td]:py-0 [&_tr]:border-0">
<TableRow>
<TableCell class="font-bold">Slug:</TableCell>
<TableCell>{{ team.slug }}</TableCell>
</TableRow>
<TableRow>
<TableCell class="font-bold">Erfordert 2FA:</TableCell>
<TableCell>{{ team.multi_factor_required ? 'Ja' : 'Nein' }}</TableCell>
<TableCell>{{
team.multi_factor_required ? 'Ja' : 'Nein'
}}</TableCell>
</TableRow>
<TableRow>
<TableCell class="font-bold">Erstellt am:</TableCell>
@@ -68,9 +80,9 @@ const revokeInvite = (teamInvite: TeamInvite) => fetch(teamRoutes.invite.revoke(
</Table>
</CardContent>
</Card>
<Card class="w-full mb-8">
<Card class="mb-8 w-full">
<CardContent>
<h2 class="font-semibold text-lg">Mitglieder</h2>
<h2 class="text-lg font-semibold">Mitglieder</h2>
<Table>
<TableHeader>
<TableRow>
@@ -82,10 +94,12 @@ const revokeInvite = (teamInvite: TeamInvite) => fetch(teamRoutes.invite.revoke(
</TableRow>
</TableHeader>
<TableBody>
<TableRow v-for="member in team.members">
<TableRow v-for="member in team.members" :key="member.email">
<TableCell>{{ member.name }}</TableCell>
<TableCell>{{ member.email }}</TableCell>
<TableCell>{{ member.has_multi_factor ? 'Ja' : 'Nein' }}</TableCell>
<TableCell>{{
member.has_multi_factor ? 'Ja' : 'Nein'
}}</TableCell>
<TableCell>{{ member.role }}</TableCell>
<TableCell>{{ member.joined_at }}</TableCell>
</TableRow>
@@ -93,9 +107,10 @@ const revokeInvite = (teamInvite: TeamInvite) => fetch(teamRoutes.invite.revoke(
</Table>
</CardContent>
</Card>
<Card v-if="teamInvites" class="w-full mb-8">
<Card v-if="teamInvites" class="mb-8 w-full">
<CardContent>
<h2 class="font-semibold text-lg">Ausstehende Invites</h2>
<h2 class="text-lg font-semibold">Ausstehende Invites</h2>
<InputError :message="revokeForm.errors.email" />
<Table>
<TableHeader>
<TableRow>
@@ -105,19 +120,22 @@ const revokeInvite = (teamInvite: TeamInvite) => fetch(teamRoutes.invite.revoke(
</TableRow>
</TableHeader>
<TableBody>
<TableRow v-for="invite in teamInvites">
<TableRow v-for="invite in teamInvites" :key="invite.invitedEmail">
<TableCell>{{ invite.invitedEmail }}</TableCell>
<TableCell>{{ invite.invitedBy.name }}</TableCell>
<TableCell>{{ invite.invitedAt }}</TableCell>
<Link
:href="teamRoutes.invite.revoke({team: invite.team.slug})"
class="cursor-pointer"
<TableCell>
<Button
type="button"
variant="ghost"
size="icon"
:disabled="revokeForm.processing"
:aria-label="`Einladung für ${invite.invitedEmail} widerrufen`"
@click="revokeInvite(invite)"
>
<TableCell>
<component :is="Trash" size="18"/>
<Trash :size="18" />
</Button>
</TableCell>
</Link>
</TableRow>
</TableBody>
</Table>
resources/js/types/models.ts
+1 -2
View File
@@ -3,7 +3,7 @@ export interface Team {
slug: string;
members: TeamMember[];
multi_factor_required: boolean;
created_at: string
created_at: string;
}
export type TeamMemberRole = 'admin' | 'member';
@@ -21,7 +21,6 @@ export interface TeamMember extends User {
export interface TeamInvite {
invitedEmail: string;
team: Team;
invitedBy: User;
invitedAt: string;
}
resources/js/types/page-props.ts
+15
View File
@@ -0,0 +1,15 @@
import type { Team, TeamInvite } from '@/types/models';
export type TeamEditPageProps = {
team: Team;
};
export type TeamShowPageProps = {
team: Team;
canManageTeam: boolean;
teamInvites?: TeamInvite[];
};
export type TeamIndexPageProps = {
teams: Team[];
};
resources/js/types/team.ts
+16
View File
@@ -0,0 +1,16 @@
export type TeamSlugProps = {
name: string;
ignoredSlug?: string;
error?: string;
};
export type TeamSlugRequest = {
name: string;
ignored_slug: string | null;
};
export type TeamSlugResponse = {
name: string;
slug: string;
taken: boolean;
};
routes/web.php
+7 -8
View File
@@ -2,6 +2,7 @@
use App\Http\Controllers\TeamController;
use App\Http\Controllers\TeamInviteAcceptController;
use App\Models\Team;
use Illuminate\Support\Facades\Route;
Route::inertia('/', 'Welcome')->name('home');
@@ -16,18 +17,16 @@ Route::middleware(['auth'])->group(function () {
});
Route::get('/', 'index')->name('index');
Route::get('/create', 'create')->name('create');
Route::post('/', 'store')->name('store');
Route::get('/edit/{team:slug}', 'edit')->name('edit');
Route::patch('/{team:slug}', 'update')->name('update');
Route::get('/create', 'create')->name('create')->can('create', Team::class);
Route::post('/', 'store')->name('store')->can('create', Team::class);
Route::get('/edit/{team:slug}', 'edit')->name('edit')->can('manage', 'team');
Route::patch('/{team:slug}', 'update')->name('update')->can('manage', 'team');
Route::post('/name-to-slug', 'nameToSlug')->name('nameToSlug');
Route::get('/{team:slug}', 'show')->name('show');
Route::get('/{team:slug}', 'show')->name('show')->can('view', 'team');
Route::post('{team:slug}/invite', [TeamController::class, 'invite'])->name('invite');
Route::post('{team:slug}/invite/revoke', [TeamController::class, 'revokeInvite'])->name('invite.revoke');
Route::post('{team:slug}/invite/revoke', [TeamController::class, 'revokeInvite'])->name('invite.revoke')->can('manage', 'team');
});
});
require __DIR__.'/settings.php';
tests/Feature/TeamControllerTest.php
+306
View File
@@ -0,0 +1,306 @@
<?php
use App\Enums\TeamMemberRole;
use App\Models\Team;
use App\Models\TeamInvite;
use App\Models\TeamMember;
use App\Models\User;
use Database\Factories\TeamFactory;
use Database\Factories\TeamInviteFactory;
use Illuminate\Support\Facades\Event;
use Illuminate\Support\Facades\Exceptions;
use Inertia\Testing\AssertableInertia as Assert;
test('team endpoints require authentication', function (string $method, string $routeName) {
$team = TeamFactory::new()->create();
$this->{$method}(route($routeName, $team->slug))->assertRedirect(route('login'));
})->with([
['get', 'teams.index'],
['get', 'teams.show'],
['get', 'teams.create'],
['post', 'teams.store'],
['get', 'teams.edit'],
['patch', 'teams.update'],
['post', 'teams.invite.revoke'],
['post', 'teams.nameToSlug'],
]);
test('outsiders cannot read a team', function () {
$user = User::factory()->create();
$team = TeamFactory::new()->create();
$this->actingAs($user)->get(route('teams.show', $team->slug))->assertForbidden();
});
test('members cannot access the team edit form', function () {
$user = User::factory()->create();
$team = TeamFactory::new()->create();
$team->members()->attach($user, ['role' => TeamMemberRole::Member]);
$this->actingAs($user)->get(route('teams.edit', $team->slug))->assertForbidden();
});
test('members and outsiders cannot modify a team', function (bool $isMember) {
$user = User::factory()->create();
$team = TeamFactory::new()->create();
if ($isMember) {
$team->members()->attach($user, ['role' => TeamMemberRole::Member]);
}
$this->actingAs($user)->patch(route('teams.update', $team->slug), [
'name' => 'Hijacked', 'require_2fa' => true,
])->assertForbidden();
$this->assertDatabaseHas('teams', ['id' => $team->id, 'name' => $team->name, 'require_2fa' => false]);
})->with([true, false]);
test('unverified users cannot create teams', function (string $method, string $routeName) {
$user = User::factory()->unverified()->create();
$this->actingAs($user)->{$method}(route($routeName), [
'name' => 'Test Team', 'require_2fa' => false,
])->assertForbidden();
$this->assertDatabaseCount('teams', 0);
})->with([['get', 'teams.create'], ['post', 'teams.store']]);
test('team creation derives the slug and adds its creator as admin', function () {
$user = User::factory()->create();
$this->actingAs($user)->post(route('teams.store'), [
'name' => 'Test Team', 'slug' => 'forged', 'require_2fa' => true, 'id' => 999,
])->assertSessionHasNoErrors()->assertRedirect(route('teams.index'));
$this->assertDatabaseHas('teams', ['name' => 'Test Team', 'slug' => 'test-team', 'require_2fa' => true]);
$this->assertDatabaseHas('team_members', ['user_id' => $user->id, 'role' => 'admin']);
$this->assertDatabaseMissing('teams', ['id' => 999]);
});
test('admins can rename teams and follow the updated slug', function () {
$user = User::factory()->create();
$team = TeamFactory::new()->create();
$team->members()->attach($user, ['role' => TeamMemberRole::Admin]);
$this->actingAs($user)->patch(route('teams.update', $team->slug), [
'name' => 'New Name', 'slug' => 'forged', 'require_2fa' => true,
])->assertSessionHasNoErrors()->assertRedirect(route('teams.show', 'new-name'));
$this->assertDatabaseHas('teams', ['id' => $team->id, 'name' => 'New Name', 'slug' => 'new-name', 'require_2fa' => true]);
});
test('updating settings without a name preserves the existing slug', function () {
$user = User::factory()->create();
$team = TeamFactory::new()->create();
$team->members()->attach($user, ['role' => TeamMemberRole::Admin]);
$this->actingAs($user)->patch(route('teams.update', $team->slug), [
'require_2fa' => true, 'slug' => 'forged',
])->assertSessionHasNoErrors()->assertRedirect(route('teams.show', $team->slug));
$this->assertDatabaseHas('teams', ['id' => $team->id, 'name' => $team->name, 'slug' => $team->slug, 'require_2fa' => true]);
});
test('invalid names are rejected without server errors', function (mixed $name, string $errorKey, string $method, string $routeName) {
$user = User::factory()->create();
$team = TeamFactory::new()->create();
$team->members()->attach($user, ['role' => TeamMemberRole::Admin]);
$this->actingAs($user)->{$method}(route($routeName, $team->slug), [
'name' => $name, 'require_2fa' => false,
])->assertUnprocessable()->assertJsonValidationErrors($errorKey);
$this->assertDatabaseCount('teams', 1);
$this->assertDatabaseHas('teams', ['id' => $team->id, 'name' => $team->name, 'slug' => $team->slug]);
})->with([
'array' => [['bad'], 'name'],
'empty' => ['', 'name'],
'null' => [null, 'name'],
'no slug characters' => ['!!!', 'slug'],
'reserved path' => ['Create', 'slug'],
])->with([['postJson', 'teams.store'], ['patchJson', 'teams.update']]);
test('duplicate team slugs are rejected', function (string $method, string $routeName) {
$user = User::factory()->create();
$team = TeamFactory::new()->create();
TeamFactory::new()->create(['name' => 'Taken Name', 'slug' => 'taken-name']);
$team->members()->attach($user, ['role' => TeamMemberRole::Admin]);
$this->actingAs($user)->{$method}(route($routeName, $team->slug), [
'name' => 'Taken Name', 'require_2fa' => false,
])->assertUnprocessable()->assertJsonValidationErrors(['slug' => 'The name has already been taken.']);
})->with([['postJson', 'teams.store'], ['patchJson', 'teams.update']]);
test('team index only lists memberships', function () {
$user = User::factory()->create();
$team = TeamFactory::new()->create();
TeamFactory::new()->create();
$team->members()->attach($user, ['role' => TeamMemberRole::Member]);
$this->actingAs($user)->get(route('teams.index'))->assertInertia(fn (Assert $page) => $page
->component('team/Index')->has('teams', 1)->where('teams.0.slug', $team->slug));
});
test('members can view their team without seeing pending invites', function () {
$user = User::factory()->create();
$team = TeamFactory::new()->create();
$team->members()->attach($user, ['role' => TeamMemberRole::Member]);
TeamInviteFactory::new()->createQuietly(['team_id' => $team->id, 'invited_by_user_id' => $user->id]);
$this->actingAs($user)->get(route('teams.show', $team->slug))->assertInertia(fn (Assert $page) => $page
->component('team/Show')->where('canManageTeam', false)->missing('teamInvites'));
});
test('admins see pending invites without tokens or repeated team data', function () {
$user = User::factory()->create();
$team = TeamFactory::new()->create();
$team->members()->attach($user, ['role' => TeamMemberRole::Admin]);
$invite = TeamInviteFactory::new()->createQuietly(['team_id' => $team->id, 'invited_by_user_id' => $user->id]);
$this->actingAs($user)->get(route('teams.show', $team->slug))->assertInertia(fn (Assert $page) => $page
->component('team/Show')->where('canManageTeam', true)->has('teamInvites', 1)
->where('teamInvites.0.invitedEmail', $invite->invited_email)
->missing('teamInvites.0.invite_token')->missing('teamInvites.0.team')
->missing('team.members.0.password')->missing('team.members.0.two_factor_secret'));
});
test('member two factor status requires confirmed two factor authentication', function (bool $enabled, bool $confirmed, bool $expected) {
$user = User::factory()->create();
$member = User::factory()->create([
'two_factor_secret' => $enabled ? encrypt('secret') : null,
'two_factor_confirmed_at' => $confirmed ? now() : null,
]);
$team = TeamFactory::new()->create();
$team->members()->attach($user, ['role' => TeamMemberRole::Admin]);
$team->members()->attach($member, ['role' => TeamMemberRole::Member]);
$this->actingAs($user)->get(route('teams.show', $team->slug))->assertInertia(fn (Assert $page) => $page
->where('team.members.1.has_multi_factor', $expected));
})->with([
'verified email only' => [false, false, false],
'unconfirmed setup' => [true, false, false],
'confirmed 2fa' => [true, true, true],
]);
test('members cannot revoke invitations even with invalid input', function () {
$user = User::factory()->create();
$team = TeamFactory::new()->create();
$team->members()->attach($user, ['role' => TeamMemberRole::Member]);
$invite = TeamInviteFactory::new()->createQuietly(['team_id' => $team->id, 'invited_by_user_id' => $user->id]);
$this->actingAs($user)->postJson(route('teams.invite.revoke', $team->slug), [])->assertForbidden();
$this->assertModelExists($invite);
});
test('admins cannot revoke invitations of another team', function () {
$user = User::factory()->create();
$ownTeam = TeamFactory::new()->create();
$ownTeam->members()->attach($user, ['role' => TeamMemberRole::Admin]);
$invite = TeamInviteFactory::new()->createQuietly();
$this->actingAs($user)->postJson(route('teams.invite.revoke', $invite->team->slug), [
'email' => $invite->invited_email,
])->assertForbidden();
$this->assertModelExists($invite);
});
test('revoke does not reveal whether an email is invited to another team', function (bool $hasOtherInvite) {
$user = User::factory()->create();
$team = TeamFactory::new()->create();
$team->members()->attach($user, ['role' => TeamMemberRole::Admin]);
if ($hasOtherInvite) {
TeamInviteFactory::new()->createQuietly(['invited_email' => 'elsewhere@example.com']);
}
$this->actingAs($user)->postJson(route('teams.invite.revoke', $team->slug), [
'email' => 'elsewhere@example.com',
])->assertNotFound();
$this->assertDatabaseCount('team_invites', $hasOtherInvite ? 1 : 0);
})->with([true, false]);
test('admins revoke only the matching invitation and return to the team', function () {
$user = User::factory()->create();
$team = TeamFactory::new()->create();
$team->members()->attach($user, ['role' => TeamMemberRole::Admin]);
$invite = TeamInviteFactory::new()->createQuietly(['team_id' => $team->id, 'invited_by_user_id' => $user->id]);
$otherInvite = TeamInviteFactory::new()->createQuietly(['invited_email' => $invite->invited_email]);
$this->actingAs($user)->post(route('teams.invite.revoke', $team->slug), [
'email' => $invite->invited_email,
])->assertSessionHasNoErrors()->assertRedirect(route('teams.show', $team->slug));
$this->assertModelMissing($invite);
$this->assertModelExists($otherInvite);
});
test('slug preview reports availability and allows the unchanged slug', function (string $name, ?string $ignoredSlug, bool $taken) {
$user = User::factory()->create();
TeamFactory::new()->create(['name' => 'Existing Team', 'slug' => 'existing-team']);
$this->actingAs($user)->postJson(route('teams.nameToSlug'), [
'name' => $name, 'ignored_slug' => $ignoredSlug,
])->assertOk()->assertJsonPath('taken', $taken);
})->with([
['Existing Team', null, true],
['Existing Team', 'existing-team', false],
['New Team', null, false],
['Create', null, true],
]);
test('team creation rolls back when admin membership cannot be saved', function () {
$user = User::factory()->create();
$exception = new RuntimeException('Membership persistence failed.');
Exceptions::fake();
Event::listen('eloquent.creating: '.TeamMember::class, function () use ($exception): void {
throw $exception;
});
$this->actingAs($user)->from(route('teams.create'))->post(route('teams.store'), [
'name' => 'Test Team', 'require_2fa' => false,
])->assertRedirect(route('teams.create'))->assertSessionHas('_old_input.name', 'Test Team');
$this->assertDatabaseCount('teams', 0);
$this->assertDatabaseCount('team_members', 0);
$this->assertModelExists($user);
Exceptions::assertReported(fn (RuntimeException $reported): bool => $reported === $exception);
});
test('failed updates return to the original edit form and report the error', function () {
$user = User::factory()->create();
$team = TeamFactory::new()->create();
$team->members()->attach($user, ['role' => TeamMemberRole::Admin]);
$exception = new RuntimeException('Team persistence failed.');
Exceptions::fake();
Event::listen('eloquent.updating: '.Team::class, function () use ($exception): void {
throw $exception;
});
$this->actingAs($user)->from(route('teams.edit', $team->slug))->patch(route('teams.update', $team->slug), [
'name' => 'New Name', 'require_2fa' => true,
])->assertRedirect(route('teams.edit', $team->slug))->assertSessionHas('_old_input.name', 'New Name');
$this->assertDatabaseHas('teams', ['id' => $team->id, 'name' => $team->name, 'slug' => $team->slug, 'require_2fa' => false]);
Exceptions::assertReported(fn (RuntimeException $reported): bool => $reported === $exception);
});
test('failed revocations preserve the invitation and report the error', function () {
$user = User::factory()->create();
$team = TeamFactory::new()->create();
$team->members()->attach($user, ['role' => TeamMemberRole::Admin]);
$invite = TeamInviteFactory::new()->createQuietly(['team_id' => $team->id, 'invited_by_user_id' => $user->id]);
$exception = new RuntimeException('Invite deletion failed.');
Exceptions::fake();
Event::listen('eloquent.deleting: '.TeamInvite::class, function () use ($exception): void {
throw $exception;
});
$this->actingAs($user)->post(route('teams.invite.revoke', $team->slug), [
'email' => $invite->invited_email,
])->assertRedirect(route('teams.show', $team->slug));
$this->assertModelExists($invite);
Exceptions::assertReported(fn (RuntimeException $reported): bool => $reported === $exception);
});
tests/Feature/TeamPolicyTest.php
+29
View File
@@ -0,0 +1,29 @@
<?php
use App\Enums\TeamMemberRole;
use App\Models\Team;
use App\Models\User;
use Database\Factories\TeamFactory;
test('team permissions follow membership and role', function (?TeamMemberRole $role, bool $canView, bool $canManage) {
$user = User::factory()->create();
$team = TeamFactory::new()->create();
if ($role !== null) {
$team->members()->attach($user, ['role' => $role]);
}
expect($user->can('view', $team))->toBe($canView);
expect($user->can('manage', $team))->toBe($canManage);
})->with([
'outsider' => [null, false, false],
'member' => [TeamMemberRole::Member, true, false],
'admin' => [TeamMemberRole::Admin, true, true],
]);
test('team creation requires a verified email', function () {
$verified = User::factory()->create();
$unverified = User::factory()->unverified()->create();
expect($verified->can('create', Team::class))->toBeTrue();
expect($unverified->can('create', Team::class))->toBeFalse();
});