Skip to content

Commit 1205cdb

Browse files
author
Mark
committed
Redirect user to dashboard on unauthorized route & Restrict backend permission
1 parent ebe4d45 commit 1205cdb

File tree

16 files changed

+219
-24
lines changed

16 files changed

+219
-24
lines changed

‎api/app/Http/Controllers/Api/Backend/AuthController.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010

1111
use App\Exceptions\EmailOrPasswordIncorrectException;
1212
use App\Exceptions\ResourceException;
13+
use App\Exceptions\UnauthorizedException;
1314

1415
class AuthController extends ApiController
1516
{
@@ -43,6 +44,9 @@ public function postLogin()
4344

4445
// Try to login
4546
if (UserAuth::once($credentials)) {
47+
if (!UserAuth::user()->can('auth.backend')) {
48+
throw new UnauthorizedException('You do not have permission to access.');
49+
}
4650
$payload = app('tymon.jwt.payload.factory')->sub(UserAuth::user()->id)->aud('user')->make();
4751
$token = JWTAuth::encode($payload);
4852

‎api/app/Http/Middleware/EntrustPermissionMiddleware.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,13 @@ class EntrustPermissionMiddleware
1212
* @param \Illuminate\Http\Request $request
1313
* @param Closure $next
1414
* @param $permissions
15+
*
1516
* @return mixed
1617
*/
1718
public function handle($request, \Closure $next, $permissions)
1819
{
1920

20-
if (!UserAuth::user()->can(explode('|', $permissions))) {
21+
if (!UserAuth::check() || !UserAuth::user()->can(explode('|', $permissions))) {
2122
throw new UnauthorizedException('You do not have permission to access.');
2223
}
2324

‎api/app/Http/routes.php‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,12 @@
1010

1111
Route::post('slug', 'Api\HelperController@slug');
1212

13+
1314
//AUTH =================================
14-
Route::post('auth/login', 'Api\Backend\AuthController@postLogin');
15-
Route::post('auth/logout', 'Api\Backend\AuthController@postLogout');
16-
Route::post('auth/refresh-token', 'Api\Backend\AuthController@postRefreshToken');
15+
16+
Route::post('auth/login', ['uses' => 'Api\Backend\AuthController@postLogin', 'as' => 'auth.login']);
17+
Route::post('auth/logout', ['uses' => 'Api\Backend\AuthController@postLogout', 'as' => 'auth.logout']);
18+
Route::post('auth/refresh-token', ['uses' => 'Api\Backend\AuthController@postRefreshToken', 'as' => 'auth.refresh']);
1719

1820
Route::group(['middleware' => ['auth.user']], function () {
1921
Route::get('me', 'Api\Backend\UserController@index');

‎api/database/seeds/UserAndRoleTableSeeder.php‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,13 @@ public function run()
1414
{
1515
$ownerRole = Role::create(['name' => 'owner', 'display_name' => 'owner']);
1616

17+
18+
1719
$allPermissions = [];
20+
21+
$adminRolePermission = Permission::create(['name' => 'auth.backend', 'display_name' => 'Login to backend']);
22+
array_push($allPermissions, $adminRolePermission->id);
23+
1824
$listRolePermission = Permission::create(['name' => 'roles.index', 'display_name' => 'List Roles']);
1925
$createRolePermission = Permission::create(['name' => 'roles.store', 'display_name' => 'Create Roles']);
2026
$editRolePermission = Permission::create(['name' => 'roles.update', 'display_name' => 'Edit Roles']);
@@ -54,7 +60,7 @@ public function run()
5460

5561
$ownerRole->perms()->sync($allPermissions);
5662

57-
$user = User::create(['firstname' => 'Mark', 'email' => '[email protected]', 'password' => Hash::make('adminmark'), 'last_login' => date('Y-m-d H:i:s')]);
63+
$user = User::create(['firstname' => 'Mark', 'email' => '[email protected]', 'password' => 'adminmark', 'last_login' => date('Y-m-d H:i:s')]);
5864
$user->attachRole($ownerRole);
5965

6066
}

‎backend/src/app/components/media.category/_media.category.module.js‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
'use strict';
1313

1414
angular.module('mediaCategoryModule', [])
15-
.run(function (Restangular, languageService, $filter, $log) {
15+
.run(function (Restangular) {
1616
//================================================
1717
// Restangular init
1818
//================================================
@@ -22,9 +22,7 @@
2222
Restangular.extendModel('medias', function (model) {
2323
model.init = function () {
2424
_.extend(model, {
25-
id: '',
26-
status: 'published',
27-
visibility: 'public'
25+
id: ''
2826
});
2927
};
3028

‎backend/src/app/components/media/_media.module.js‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,20 @@
4444
templateUrl: 'app/components/media/media.list.html',
4545
controller: 'MediaListController as listCtrl',
4646
resolve: {
47+
hasPermission: function (userService, $state, $q) {
48+
var deferred = $q.defer();
49+
userService.getMe().then(function (result) {
50+
if (!result.can('media.index')) {
51+
$state.go('main.index');
52+
deferred.resolve(false);
53+
}
54+
deferred.resolve(true);
55+
}, function () {
56+
$state.go('main.index');
57+
deferred.reject(false);
58+
});
59+
return deferred.promise;
60+
},
4761
meta: function ($rootScope, $translate, $q) {
4862
var deferred = $q.defer();
4963
$translate('media.media').then(function (translation) {

‎backend/src/app/components/media/media.list.controller.js‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@
1515
angular.module('mediaModule').controller('MediaListController', MediaListController);
1616

1717
function MediaListController($scope, mediaService, $location, toaster, $translate, $q, mediaCategoryService, $state) {
18-
1918
var vm = this;
2019
//================================================
2120
// Upload

‎backend/src/app/components/post.category/_post.category.module.js‎

Lines changed: 51 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,20 @@
4848
templateUrl: 'app/components/post.category/post.category.list.html',
4949
controller: 'PostCategoryListController as listCtrl',
5050
resolve: {
51+
hasPermission: function (userService, $state, $q) {
52+
var deferred = $q.defer();
53+
userService.getMe().then(function (result) {
54+
if (!result.can('posts.categories.index')) {
55+
$state.go('main.index');
56+
deferred.resolve(false);
57+
}
58+
deferred.resolve(true);
59+
}, function () {
60+
$state.go('main.index');
61+
deferred.reject();
62+
});
63+
return deferred.promise;
64+
},
5165
meta: function ($rootScope, $translate, $q) {
5266
var deferred = $q.defer();
5367
$translate('post.posts').then(function (translation) {
@@ -65,6 +79,20 @@
6579
templateUrl: 'app/components/post.category/post.category.form.html',
6680
controller: 'PostCategoryFormController as formCtrl',
6781
resolve: {
82+
hasPermission: function (userService, $state, $q) {
83+
var deferred = $q.defer();
84+
userService.getMe().then(function (result) {
85+
if (!result.can('posts.categories.store')) {
86+
$state.go('main.index');
87+
deferred.resolve(false);
88+
}
89+
deferred.resolve(true);
90+
}, function () {
91+
$state.go('main.index');
92+
deferred.reject();
93+
});
94+
return deferred.promise;
95+
},
6896
category: function () {
6997
return;
7098
},
@@ -85,8 +113,29 @@
85113
templateUrl: 'app/components/post.category/post.category.form.html',
86114
controller: 'PostCategoryFormController as formCtrl',
87115
resolve: {
88-
category: function (postCategoryService, $stateParams) {
89-
return postCategoryService.find($stateParams.id, {cache: false});
116+
hasPermission: function (userService, $state, $q) {
117+
var deferred = $q.defer();
118+
userService.getMe().then(function (result) {
119+
if (!result.can(['posts.categories.index', 'posts.categories.update'], true)) {
120+
$state.go('main.index');
121+
deferred.resolve(false);
122+
}
123+
deferred.resolve(true);
124+
}, function () {
125+
$state.go('main.index');
126+
deferred.reject();
127+
});
128+
return deferred.promise;
129+
},
130+
category: function (postCategoryService, $stateParams, $q, $state) {
131+
var deferred = $q.defer();
132+
postCategoryService.find($stateParams.id, {cache: false}).then(function (result) {
133+
deferred.resolve(result);
134+
}, function () {
135+
$state.go('main.post-category-list');
136+
deferred.reject();
137+
});
138+
return deferred.promise;
90139
},
91140
meta: function ($rootScope, $translate, $q) {
92141
var deferred = $q.defer();

‎backend/src/app/components/post.category/post.category.form.controller.js‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,7 @@
1212

1313
angular.module('postCategoryModule').controller('PostCategoryFormController', PostCategoryFormController);
1414

15-
function PostCategoryFormController($http, $location, postCategoryService, messageService, moment, angularMomentConfig, toaster, $translate, category, $filter, languageService, Restangular) {
16-
15+
function PostCategoryFormController($location, postCategoryService, messageService, toaster, $translate, category, Restangular) {
1716

1817
var vm = this;
1918
//==========================================

‎backend/src/app/components/post.category/post.category.list.controller.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
angular.module('postCategoryModule')
1515
.controller('PostCategoryListController', PostCategoryListController);
1616

17-
function PostCategoryListController(postCategoryService, $location, toaster, $timeout, $translate) {
17+
function PostCategoryListController(postCategoryService, toaster, $timeout, $translate) {
1818

1919
var vm = this;
2020
//================================================
@@ -66,7 +66,7 @@
6666
},
6767
dragStart: function (event) {
6868
var oldParent = event.dest.nodesScope.$parent.$parent.$modelValue;
69-
69+
7070
//if old parent get only a children, remove the handle tool
7171
if (!_.isUndefined(oldParent) && oldParent.children.length === 1) {
7272
oldParent.rgt = oldParent.lft + 1;

0 commit comments

Comments
 (0)