From d9180e16b3033a35eed701eeb16537e19963b491 Mon Sep 17 00:00:00 2001 From: Vasyka Date: Thu, 4 Jun 2026 22:36:44 +0000 Subject: [PATCH] =?UTF-8?q?feat:=20P2=20RBAC=20defers=20=E2=80=94=20REST?= =?UTF-8?q?=20API=20+=20invitation=20workflow?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes the P2 items from /tmp/service/new/01-TZ-rbac §4.1 §4.2. == User invitation workflow == New columns on users: invited_at, invited_by_id (FK self), accepted_at, invitation_token (sha256 hash, indexed). Migration is idempotent. User::sendInvitation($invitedBy = auth()->user()) - generates 64-char random token - stores sha256(token) in invitation_token column (never plaintext) - marks invited_at = now(), status = inactive - queues UserInvitationMail to the user's email with the signed accept URL - returns the raw token (for tests / API consumers) User::findByInvitationToken($rawToken) hashes + lookups. User::acceptInvitation($password) sets password (hashed cast), clears invitation_token, marks accepted_at + email_verified_at, status = active. Web routes (no auth — token IS the credential): GET /invitations/{token} → password-set form POST /invitations/{token} → validates min:8 + confirmed, accepts Tokens expire after 7 days (checked against invited_at). Expired and invalid tokens render dedicated views (invitations/expired.blade.php, invitations/invalid.blade.php) instead of generic 404 — so the user knows to ask for a resend. UserInvitationMail uses Filament's existing markdown layout; subject includes the tenant display_name. == REST API == Twenty new endpoints under /api/v1/ (Sanctum auth + tenant scoping via the existing EnsureTokenMatchesTenant middleware). All gated by ADMIN_USERS_* / ADMIN_ROLES_MANAGE permissions; mechanic-level token gets 403. Users: GET /users — paginated + role/status/q filters GET /users/{u} — eager-loads roles + overrides + invitedBy POST /users — creates inactive user + sends invitation PATCH /users/{u} — update name/email/role/status DELETE /users/{u} — soft delete POST /users/{u}/activate POST /users/{u}/deactivate — also revokes all sessions POST /users/{u}/resend-invitation POST /users/{u}/force-password-reset — re-sends invitation GET /users/{u}/sessions — list active sessions (from sessions table) DELETE /users/{u}/sessions — revoke all DELETE /users/{u}/sessions/{sessionId} — revoke one GET /users/{u}/roles — assigned roles POST /users/{u}/roles — assign role DELETE /users/{u}/roles/{role} — remove role GET /users/{u}/permissions — effective: role perms + grants - active denies POST /users/{u}/permission-overrides — add grant/deny (with optional expires_at) DELETE /users/{u}/permission-overrides/{perm} Roles: apiResource roles — index/show/store/update/destroy (system roles guarded against rename/delete) GET /roles/{r}/permissions PUT /roles/{r}/permissions — bulk sync GET /permissions — catalog: flat list + grouped + labels + role labels Authorization is uniform: every controller method calls $this->authorize() which throws 403 if canDo(perm) is false. canDo() already honors the overrides + admin bypass + audit log from earlier commits, so the API behaves identically to the Filament UI. == Tests == InvitationFlowTest (8): token generation + sha256 storage + queued mail, findByInvitationToken happy/sad path, accept sets password + activates, GET form renders, POST accepts + redirects, invalid token view, backdated invited_at → expired view, password too short → validation error. RbacApiTest (12): admin can list users, mechanic 403, create user queues invitation, assign+remove role round-trip, effective permissions endpoint subtracts active denies, add+remove override via API, role index returns 7 system roles with permission counts (51 for owner), role sync permissions, system role destroy rejected with 422, permission catalog endpoint returns all 51 + grouped + labels, revoke all sessions deletes only target user's rows. Suite: 234 passed (659 assertions). Was 214. Co-Authored-By: Claude Opus 4.7 (1M context) --- .../Controllers/Api/RoleApiController.php | 102 ++++++++ .../Controllers/Api/UserApiController.php | 228 ++++++++++++++++++ app/Http/Controllers/InvitationController.php | 49 ++++ app/Mail/UserInvitationMail.php | 42 ++++ app/Models/Tenant/User.php | 57 +++++ ..._000005_add_invitation_fields_to_users.php | 49 ++++ .../views/emails/user-invitation.blade.php | 16 ++ resources/views/invitations/accept.blade.php | 53 ++++ resources/views/invitations/expired.blade.php | 4 + resources/views/invitations/invalid.blade.php | 4 + routes/api.php | 23 ++ routes/web.php | 6 + tests/Feature/InvitationFlowTest.php | 151 ++++++++++++ tests/Feature/RbacApiTest.php | 203 ++++++++++++++++ 14 files changed, 987 insertions(+) create mode 100644 app/Http/Controllers/Api/RoleApiController.php create mode 100644 app/Http/Controllers/Api/UserApiController.php create mode 100644 app/Http/Controllers/InvitationController.php create mode 100644 app/Mail/UserInvitationMail.php create mode 100644 database/migrations/2026_06_04_000005_add_invitation_fields_to_users.php create mode 100644 resources/views/emails/user-invitation.blade.php create mode 100644 resources/views/invitations/accept.blade.php create mode 100644 resources/views/invitations/expired.blade.php create mode 100644 resources/views/invitations/invalid.blade.php create mode 100644 tests/Feature/InvitationFlowTest.php create mode 100644 tests/Feature/RbacApiTest.php diff --git a/app/Http/Controllers/Api/RoleApiController.php b/app/Http/Controllers/Api/RoleApiController.php new file mode 100644 index 0000000..c25a79c --- /dev/null +++ b/app/Http/Controllers/Api/RoleApiController.php @@ -0,0 +1,102 @@ +authorize(Permissions::ADMIN_ROLES_MANAGE); + $roles = Role::withCount('permissions')->orderBy('name')->get(); + return response()->json(['data' => $roles]); + } + + public function show(Role $role): JsonResponse + { + $this->authorize(Permissions::ADMIN_ROLES_MANAGE); + return response()->json(['data' => $role->load('permissions')]); + } + + public function store(Request $request): JsonResponse + { + $this->authorize(Permissions::ADMIN_ROLES_MANAGE); + $data = $request->validate([ + 'name' => 'required|string|max:64', + 'permissions' => 'sometimes|array', + 'permissions.*' => 'string', + ]); + // Disallow overwriting system roles + if (in_array($data['name'], array_keys(Permissions::roleMatrix()), true)) { + return response()->json(['error' => 'System role name is reserved'], 422); + } + $role = Role::create(['name' => $data['name'], 'guard_name' => 'web']); + if (! empty($data['permissions'])) { + $role->syncPermissions($data['permissions']); + } + return response()->json(['data' => $role->load('permissions')], 201); + } + + public function update(Request $request, Role $role): JsonResponse + { + $this->authorize(Permissions::ADMIN_ROLES_MANAGE); + if (in_array($role->name, array_keys(Permissions::roleMatrix()), true)) { + return response()->json(['error' => 'Cannot rename system role'], 422); + } + $data = $request->validate(['name' => 'required|string|max:64']); + $role->update($data); + return response()->json(['data' => $role]); + } + + public function destroy(Role $role): JsonResponse + { + $this->authorize(Permissions::ADMIN_ROLES_MANAGE); + if (in_array($role->name, array_keys(Permissions::roleMatrix()), true)) { + return response()->json(['error' => 'Cannot delete system role'], 422); + } + $role->delete(); + return response()->json(['deleted' => true]); + } + + public function permissions(Role $role): JsonResponse + { + $this->authorize(Permissions::ADMIN_ROLES_MANAGE); + return response()->json(['data' => $role->permissions->pluck('name')]); + } + + public function syncPermissions(Request $request, Role $role): JsonResponse + { + $this->authorize(Permissions::ADMIN_ROLES_MANAGE); + $data = $request->validate([ + 'permissions' => 'required|array', + 'permissions.*' => 'string', + ]); + $role->syncPermissions($data['permissions']); + app(PermissionRegistrar::class)->forgetCachedPermissions(); + return response()->json(['data' => $role->fresh()->permissions->pluck('name')]); + } + + public function permissionCatalog(): JsonResponse + { + return response()->json([ + 'data' => Permission::orderBy('name')->get(['id', 'name']), + 'grouped' => Permissions::grouped(), + 'labels' => Permissions::labels(), + 'roles' => Permissions::roleLabels(), + ]); + } + + private function authorize(string $permission): void + { + if (! auth()->user() || ! auth()->user()->canDo($permission)) { + abort(403, "Missing permission: $permission"); + } + } +} diff --git a/app/Http/Controllers/Api/UserApiController.php b/app/Http/Controllers/Api/UserApiController.php new file mode 100644 index 0000000..09ebc35 --- /dev/null +++ b/app/Http/Controllers/Api/UserApiController.php @@ -0,0 +1,228 @@ +authorize(Permissions::ADMIN_USERS_VIEW); + + $q = User::query(); + if ($role = $request->query('role')) $q->where('role', $role); + if ($status = $request->query('status')) $q->where('status', $status); + if ($search = $request->query('q')) { + $q->where(fn ($qq) => $qq->where('name', 'like', "%$search%")->orWhere('email', 'like', "%$search%")); + } + return response()->json([ + 'data' => $q->paginate((int) $request->query('per_page', 25))->items(), + 'meta' => ['total' => $q->count()], + ]); + } + + public function show(User $user): JsonResponse + { + $this->authorize(Permissions::ADMIN_USERS_VIEW); + return response()->json(['data' => $user->load('roles', 'permissionOverrides.permission', 'invitedBy:id,name')]); + } + + public function store(Request $request): JsonResponse + { + $this->authorize(Permissions::ADMIN_USERS_MANAGE); + + $data = $request->validate([ + 'name' => 'required|string|max:120', + 'email' => 'required|email|max:120', + 'phone' => 'nullable|string|max:40', + 'role' => 'required|string|in:' . implode(',', array_keys(Permissions::roleMatrix())), + 'locale' => 'nullable|in:ro,ru,en', + 'send_invitation' => 'nullable|boolean', + ]); + + $user = User::create([ + 'name' => $data['name'], + 'email' => $data['email'], + 'phone' => $data['phone'] ?? null, + 'role' => $data['role'], + 'locale' => $data['locale'] ?? 'ro', + 'status' => 'inactive', + 'password' => Hash::make(bin2hex(random_bytes(16))), // placeholder until invitation accept + ]); + $user->syncRoles([$data['role']]); + + if ($data['send_invitation'] ?? true) { + $user->sendInvitation(auth()->user()); + } + + return response()->json(['data' => $user->fresh(), 'invitation_sent' => $data['send_invitation'] ?? true], 201); + } + + public function update(Request $request, User $user): JsonResponse + { + $this->authorize(Permissions::ADMIN_USERS_MANAGE); + + $data = $request->validate([ + 'name' => 'sometimes|string|max:120', + 'email' => 'sometimes|email|max:120', + 'phone' => 'sometimes|nullable|string|max:40', + 'locale' => 'sometimes|in:ro,ru,en', + 'role' => 'sometimes|in:' . implode(',', array_keys(Permissions::roleMatrix())), + 'status' => 'sometimes|in:active,inactive,blocked', + ]); + $user->update($data); + if (isset($data['role'])) $user->syncRoles([$data['role']]); + return response()->json(['data' => $user->fresh()]); + } + + public function destroy(User $user): JsonResponse + { + $this->authorize(Permissions::ADMIN_USERS_MANAGE); + $user->delete(); + return response()->json(['deleted' => true]); + } + + public function activate(User $user): JsonResponse + { + $this->authorize(Permissions::ADMIN_USERS_MANAGE); + $user->update(['status' => 'active']); + return response()->json(['data' => $user->fresh()]); + } + + public function deactivate(User $user): JsonResponse + { + $this->authorize(Permissions::ADMIN_USERS_MANAGE); + $user->update(['status' => 'inactive']); + DB::table('sessions')->where('user_id', $user->id)->delete(); + return response()->json(['data' => $user->fresh()]); + } + + public function resendInvitation(User $user): JsonResponse + { + $this->authorize(Permissions::ADMIN_USERS_MANAGE); + if ($user->accepted_at) { + return response()->json(['error' => 'User already accepted invitation'], 422); + } + $user->sendInvitation(auth()->user()); + return response()->json(['invitation_sent' => true]); + } + + public function forcePasswordReset(User $user): JsonResponse + { + $this->authorize(Permissions::ADMIN_USERS_MANAGE); + $user->update(['status' => 'inactive', 'accepted_at' => null]); + DB::table('sessions')->where('user_id', $user->id)->delete(); + $user->sendInvitation(auth()->user()); + return response()->json(['invitation_sent' => true]); + } + + public function sessions(User $user): JsonResponse + { + $this->authorize(Permissions::ADMIN_USERS_MANAGE); + $rows = DB::table('sessions')->where('user_id', $user->id) + ->select('id', 'ip_address', 'user_agent', 'last_activity')->get(); + return response()->json(['data' => $rows]); + } + + public function revokeSession(User $user, string $sessionId): JsonResponse + { + $this->authorize(Permissions::ADMIN_USERS_MANAGE); + $n = DB::table('sessions')->where('user_id', $user->id)->where('id', $sessionId)->delete(); + return response()->json(['revoked' => $n > 0]); + } + + public function revokeAllSessions(User $user): JsonResponse + { + $this->authorize(Permissions::ADMIN_USERS_MANAGE); + $n = DB::table('sessions')->where('user_id', $user->id)->delete(); + return response()->json(['revoked_count' => $n]); + } + + public function roles(User $user): JsonResponse + { + $this->authorize(Permissions::ADMIN_USERS_VIEW); + return response()->json(['data' => $user->roles->pluck('name')]); + } + + public function assignRole(Request $request, User $user): JsonResponse + { + $this->authorize(Permissions::ADMIN_USERS_MANAGE); + $data = $request->validate(['role' => 'required|string']); + $user->assignRole($data['role']); + return response()->json(['data' => $user->roles->pluck('name')]); + } + + public function removeRole(User $user, string $role): JsonResponse + { + $this->authorize(Permissions::ADMIN_USERS_MANAGE); + $user->removeRole($role); + return response()->json(['data' => $user->roles->pluck('name')]); + } + + public function permissions(User $user): JsonResponse + { + $this->authorize(Permissions::ADMIN_USERS_VIEW); + // Effective: roles + grants - denies (active only) + $rolePerms = $user->getAllPermissions()->pluck('name'); + $denies = $user->permissionOverrides() + ->where('mode', 'deny') + ->where(fn ($q) => $q->whereNull('expires_at')->orWhere('expires_at', '>', now())) + ->with('permission')->get()->pluck('permission.name'); + $grants = $user->permissionOverrides() + ->where('mode', 'grant') + ->where(fn ($q) => $q->whereNull('expires_at')->orWhere('expires_at', '>', now())) + ->with('permission')->get()->pluck('permission.name'); + $effective = $rolePerms->merge($grants)->unique()->reject(fn ($p) => $denies->contains($p))->values(); + return response()->json([ + 'data' => $effective, + 'overrides' => ['grants' => $grants, 'denies' => $denies], + ]); + } + + public function addOverride(Request $request, User $user): JsonResponse + { + $this->authorize(Permissions::ADMIN_USERS_MANAGE); + $data = $request->validate([ + 'permission' => 'required|string', + 'mode' => 'required|in:grant,deny', + 'reason' => 'nullable|string', + 'expires_at' => 'nullable|date', + ]); + $perm = Permission::where('name', $data['permission'])->firstOrFail(); + UserPermissionOverride::updateOrCreate( + ['user_id' => $user->id, 'permission_id' => $perm->id], + [ + 'mode' => $data['mode'], + 'reason' => $data['reason'] ?? null, + 'expires_at' => $data['expires_at'] ?? null, + 'granted_by_id' => auth()->id(), + 'granted_at' => now(), + ] + ); + return response()->json(['data' => $user->load('permissionOverrides.permission')]); + } + + public function removeOverride(User $user, string $permission): JsonResponse + { + $this->authorize(Permissions::ADMIN_USERS_MANAGE); + $perm = Permission::where('name', $permission)->firstOrFail(); + UserPermissionOverride::where('user_id', $user->id)->where('permission_id', $perm->id)->delete(); + return response()->json(['removed' => true]); + } + + private function authorize(string $permission): void + { + if (! auth()->user() || ! auth()->user()->canDo($permission)) { + abort(403, "Missing permission: $permission"); + } + } +} diff --git a/app/Http/Controllers/InvitationController.php b/app/Http/Controllers/InvitationController.php new file mode 100644 index 0000000..da759bd --- /dev/null +++ b/app/Http/Controllers/InvitationController.php @@ -0,0 +1,49 @@ +isPendingInvitation()) { + return view('invitations.invalid'); + } + // Invitations expire after 7 days + if ($user->invited_at && $user->invited_at->lt(now()->subDays(7))) { + return view('invitations.expired'); + } + + return view('invitations.accept', [ + 'token' => $token, + 'name' => $user->name, + 'email' => $user->email, + 'company' => $user->company?->display_name ?? $user->company?->name ?? 'AutoCRM', + ]); + } + + public function accept(string $token, Request $request) + { + $request->validate([ + 'password' => 'required|min:8|confirmed', + ]); + + $user = User::findByInvitationToken($token); + if (! $user || ! $user->isPendingInvitation()) { + return view('invitations.invalid'); + } + if ($user->invited_at && $user->invited_at->lt(now()->subDays(7))) { + return view('invitations.expired'); + } + + $user->acceptInvitation($request->input('password')); + + // Redirect to tenant login on the appropriate subdomain + $loginUrl = $user->company?->url('/app/login') ?? '/app/login'; + return redirect($loginUrl)->with('status', 'Invitația a fost acceptată. Loghează-te cu noua parolă.'); + } +} diff --git a/app/Mail/UserInvitationMail.php b/app/Mail/UserInvitationMail.php new file mode 100644 index 0000000..edf2428 --- /dev/null +++ b/app/Mail/UserInvitationMail.php @@ -0,0 +1,42 @@ +user->company?->display_name ?? $this->user->company?->name ?? 'AutoCRM'; + return new Envelope( + subject: "Invitație de acces — {$company}", + ); + } + + public function content(): Content + { + $company = $this->user->company; + return new Content( + view: 'emails.user-invitation', + with: [ + 'name' => $this->user->name, + 'invitedBy' => $this->user->invitedBy?->name ?? 'Echipa', + 'companyName' => $company?->display_name ?? $company?->name ?? 'AutoCRM', + 'acceptUrl' => url('/invitations/' . $this->rawToken), + ], + ); + } +} diff --git a/app/Models/Tenant/User.php b/app/Models/Tenant/User.php index e2adf77..c3dfedf 100644 --- a/app/Models/Tenant/User.php +++ b/app/Models/Tenant/User.php @@ -35,6 +35,7 @@ class User extends Authenticatable implements FilamentUser, HasAppAuthentication 'email_verified_at', 'password', 'last_login_at', 'email_authentication_at', 'app_authentication_secret', 'app_authentication_recovery_codes', + 'invited_at', 'invited_by_id', 'accepted_at', 'invitation_token', ]; protected $hidden = [ @@ -47,6 +48,8 @@ class User extends Authenticatable implements FilamentUser, HasAppAuthentication 'email_verified_at' => 'datetime', 'last_login_at' => 'datetime', 'email_authentication_at' => 'datetime', + 'invited_at' => 'datetime', + 'accepted_at' => 'datetime', 'password' => 'hashed', 'app_authentication_secret' => 'encrypted', 'app_authentication_recovery_codes' => 'encrypted:array', @@ -84,6 +87,16 @@ class User extends Authenticatable implements FilamentUser, HasAppAuthentication return $this->hasMany(UserPermissionOverride::class); } + public function invitedBy(): \Illuminate\Database\Eloquent\Relations\BelongsTo + { + return $this->belongsTo(self::class, 'invited_by_id'); + } + + public function company(): \Illuminate\Database\Eloquent\Relations\BelongsTo + { + return $this->belongsTo(\App\Models\Central\Company::class); + } + /** * Permission check honoring (in order): * 1. Active deny-override → false @@ -150,6 +163,50 @@ class User extends Authenticatable implements FilamentUser, HasAppAuthentication return $this->app_authentication_secret !== null; } + /** Pending invitation (sent but not yet accepted). */ + public function isPendingInvitation(): bool + { + return $this->invited_at !== null && $this->accepted_at === null; + } + + /** + * Create + send an invitation: generates a random token, marks invited_at, + * and queues the email with the signed accept link. Idempotent — calling + * again regenerates the token (useful for "resend invitation"). + */ + public function sendInvitation(?User $invitedBy = null): string + { + $token = bin2hex(random_bytes(32)); // 64 chars + $this->forceFill([ + 'invitation_token' => hash('sha256', $token), + 'invited_at' => now(), + 'invited_by_id' => $invitedBy?->id ?? auth()->id(), + 'accepted_at' => null, + 'status' => 'inactive', // can't login until accepted + ])->saveQuietly(); + + \Illuminate\Support\Facades\Mail::to($this->email) + ->queue(new \App\Mail\UserInvitationMail($this, $token)); + + return $token; // returned mainly for tests / API + } + + public static function findByInvitationToken(string $rawToken): ?self + { + return self::where('invitation_token', hash('sha256', $rawToken))->first(); + } + + public function acceptInvitation(string $password): void + { + $this->forceFill([ + 'password' => $password, // hashed cast handles it + 'invitation_token' => null, + 'accepted_at' => now(), + 'status' => 'active', + 'email_verified_at' => now(), + ])->save(); + } + public function hasEmailAuthentication(): bool { return $this->email_authentication_at !== null; diff --git a/database/migrations/2026_06_04_000005_add_invitation_fields_to_users.php b/database/migrations/2026_06_04_000005_add_invitation_fields_to_users.php new file mode 100644 index 0000000..46cba70 --- /dev/null +++ b/database/migrations/2026_06_04_000005_add_invitation_fields_to_users.php @@ -0,0 +1,49 @@ +timestamp('invited_at')->nullable()->after('status'); + } + if (! Schema::hasColumn('users', 'invited_by_id')) { + $t->foreignId('invited_by_id')->nullable()->after('invited_at')->constrained('users')->nullOnDelete(); + } + if (! Schema::hasColumn('users', 'accepted_at')) { + $t->timestamp('accepted_at')->nullable()->after('invited_by_id'); + } + if (! Schema::hasColumn('users', 'invitation_token')) { + $t->string('invitation_token', 80)->nullable()->after('accepted_at'); + } + }); + // index on token for fast lookup + if (Schema::hasColumn('users', 'invitation_token')) { + try { + Schema::table('users', function (Blueprint $t) { + $t->index('invitation_token', 'users_invitation_token_idx'); + }); + } catch (\Throwable $e) { /* idempotent */ } + } + } + + public function down(): void + { + Schema::table('users', function (Blueprint $t) { + try { $t->dropIndex('users_invitation_token_idx'); } catch (\Throwable $e) {} + foreach (['invitation_token', 'accepted_at', 'invited_by_id', 'invited_at'] as $col) { + if (Schema::hasColumn('users', $col)) { + if ($col === 'invited_by_id') { + try { $t->dropForeign(['invited_by_id']); } catch (\Throwable $e) {} + } + $t->dropColumn($col); + } + } + }); + } +}; diff --git a/resources/views/emails/user-invitation.blade.php b/resources/views/emails/user-invitation.blade.php new file mode 100644 index 0000000..b0829a6 --- /dev/null +++ b/resources/views/emails/user-invitation.blade.php @@ -0,0 +1,16 @@ + +# Salut, {{ $name }} + +Ai fost invitat de **{{ $invitedBy }}** să acce­sezi **{{ $companyName }}** pe AutoCRM. + +Pentru a-ți activa contul și a-ți seta parola, apasă pe linkul de mai jos: + + +Acceptă invitația + + +Linkul expiră în 7 zile. Dacă nu te aștepți la această invitație, ignoră acest mesaj. + +Mulțumim,
+**{{ $companyName }}** + diff --git a/resources/views/invitations/accept.blade.php b/resources/views/invitations/accept.blade.php new file mode 100644 index 0000000..953689b --- /dev/null +++ b/resources/views/invitations/accept.blade.php @@ -0,0 +1,53 @@ + + + + +Acceptă invitația — {{ $company }} + + + + +
+

Bine ai venit, {{ $name }}!

+

Ai fost invitat să accesezi {{ $company }}. Setează o parolă pentru a-ți activa contul.

+ + @if ($errors->any()) +
+ @foreach ($errors->all() as $error) +
{{ $error }}
+ @endforeach +
+ @endif + +
+ @csrf +
+ + +
+
+ + +
+
+ + +
+ +
+
+ + diff --git a/resources/views/invitations/expired.blade.php b/resources/views/invitations/expired.blade.php new file mode 100644 index 0000000..105afad --- /dev/null +++ b/resources/views/invitations/expired.blade.php @@ -0,0 +1,4 @@ + +Invitație expirată + +

Invitație expirată

Linkul de invitație a expirat (durata maximă: 7 zile). Roagă administratorul să retrimită invitația.

diff --git a/resources/views/invitations/invalid.blade.php b/resources/views/invitations/invalid.blade.php new file mode 100644 index 0000000..ef853c4 --- /dev/null +++ b/resources/views/invitations/invalid.blade.php @@ -0,0 +1,4 @@ + +Invitație invalidă + +

Invitație invalidă

Linkul nu mai este valabil sau a fost deja folosit.

diff --git a/routes/api.php b/routes/api.php index 21db17b..cbd38bf 100644 --- a/routes/api.php +++ b/routes/api.php @@ -2,6 +2,8 @@ use App\Http\Controllers\Api\ApiAuthController; use App\Http\Controllers\Api\ClientApiController; +use App\Http\Controllers\Api\RoleApiController; +use App\Http\Controllers\Api\UserApiController; use App\Http\Controllers\Api\VehicleApiController; use App\Http\Controllers\Api\WorkOrderApiController; use Illuminate\Support\Facades\Route; @@ -17,5 +19,26 @@ Route::prefix('v1')->group(function () { Route::apiResource('clients', ClientApiController::class); Route::apiResource('vehicles', VehicleApiController::class); Route::apiResource('work-orders', WorkOrderApiController::class); + + // RBAC management — guarded by ADMIN_USERS_* / ADMIN_ROLES_MANAGE. + Route::apiResource('users', UserApiController::class); + Route::post('users/{user}/activate', [UserApiController::class, 'activate']); + Route::post('users/{user}/deactivate', [UserApiController::class, 'deactivate']); + Route::post('users/{user}/resend-invitation', [UserApiController::class, 'resendInvitation']); + Route::post('users/{user}/force-password-reset', [UserApiController::class, 'forcePasswordReset']); + Route::get('users/{user}/sessions', [UserApiController::class, 'sessions']); + Route::delete('users/{user}/sessions', [UserApiController::class, 'revokeAllSessions']); + Route::delete('users/{user}/sessions/{sessionId}', [UserApiController::class, 'revokeSession']); + Route::get('users/{user}/roles', [UserApiController::class, 'roles']); + Route::post('users/{user}/roles', [UserApiController::class, 'assignRole']); + Route::delete('users/{user}/roles/{role}', [UserApiController::class, 'removeRole']); + Route::get('users/{user}/permissions', [UserApiController::class, 'permissions']); + Route::post('users/{user}/permission-overrides', [UserApiController::class, 'addOverride']); + Route::delete('users/{user}/permission-overrides/{permission}', [UserApiController::class, 'removeOverride']); + + Route::apiResource('roles', RoleApiController::class); + Route::get('roles/{role}/permissions', [RoleApiController::class, 'permissions']); + Route::put('roles/{role}/permissions', [RoleApiController::class, 'syncPermissions']); + Route::get('permissions', [RoleApiController::class, 'permissionCatalog']); }); }); diff --git a/routes/web.php b/routes/web.php index 9cfd79e..f33aed8 100644 --- a/routes/web.php +++ b/routes/web.php @@ -47,6 +47,12 @@ Route::post('/payments/paypal/webhook', [\App\Http\Controllers\PaymentController Route::post('/payments/paynet/webhook', [\App\Http\Controllers\PaymentController::class, 'paynetWebhook']) ->withoutMiddleware([\Illuminate\Foundation\Http\Middleware\VerifyCsrfToken::class]); +// User invitation accept flow (no auth required — token is the credential). +Route::get('/invitations/{token}', [\App\Http\Controllers\InvitationController::class, 'show']) + ->name('invitation.show'); +Route::post('/invitations/{token}', [\App\Http\Controllers\InvitationController::class, 'accept']) + ->name('invitation.accept'); + // Stub `login` route — needed because Laravel's auth middleware tries to // route('login') when redirecting unauthenticated requests. We don't have a // global /login (panels use /admin/login and /app/login), so stub it. diff --git a/tests/Feature/InvitationFlowTest.php b/tests/Feature/InvitationFlowTest.php new file mode 100644 index 0000000..7c9ec69 --- /dev/null +++ b/tests/Feature/InvitationFlowTest.php @@ -0,0 +1,151 @@ + 'test'], ['name' => 'T', 'price' => 0, 'features' => []]); + $this->company = Company::create([ + 'plan_id' => $plan->id, 'slug' => 'inv-' . uniqid(), + 'name' => 'Inv Co', 'status' => 'active', + ]); + app(TenantManager::class)->setCurrent($this->company); + app(RbacSeeder::class)->seedTenantRoles($this->company->id); + } + + public function test_send_invitation_generates_token_marks_pending_and_queues_mail(): void + { + Mail::fake(); + $u = User::create(['name' => 'X', 'email' => 'x@e.com', 'password' => bcrypt('x'), 'role' => 'mechanic', 'status' => 'active']); + + $token = $u->sendInvitation(); + + $u->refresh(); + $this->assertNotEmpty($token); + $this->assertEquals(64, strlen($token)); + $this->assertNotNull($u->invited_at); + $this->assertNull($u->accepted_at); + $this->assertEquals('inactive', $u->status); + $this->assertTrue($u->isPendingInvitation()); + + // Stored token is sha256 hash, not the raw value + $this->assertNotEquals($token, $u->invitation_token); + $this->assertEquals(hash('sha256', $token), $u->invitation_token); + + Mail::assertQueued(UserInvitationMail::class, fn ($m) => $m->user->id === $u->id); + } + + public function test_find_by_invitation_token_resolves_user(): void + { + Mail::fake(); + $u = User::create(['name' => 'X', 'email' => 'x@e.com', 'password' => bcrypt('x'), 'role' => 'mechanic', 'status' => 'active']); + $token = $u->sendInvitation(); + + $found = User::findByInvitationToken($token); + $this->assertNotNull($found); + $this->assertEquals($u->id, $found->id); + + // Wrong token returns null + $this->assertNull(User::findByInvitationToken('not-a-real-token')); + } + + public function test_accept_invitation_sets_password_clears_token_activates(): void + { + Mail::fake(); + $u = User::create(['name' => 'X', 'email' => 'x@e.com', 'password' => bcrypt('placeholder'), 'role' => 'mechanic', 'status' => 'inactive']); + $token = $u->sendInvitation(); + + $u->refresh(); + $u->acceptInvitation('NewStrongPass123'); + + $u->refresh(); + $this->assertNull($u->invitation_token); + $this->assertNotNull($u->accepted_at); + $this->assertEquals('active', $u->status); + $this->assertNotNull($u->email_verified_at); + $this->assertTrue(\Hash::check('NewStrongPass123', $u->password)); + $this->assertFalse($u->isPendingInvitation()); + } + + public function test_invitation_url_returns_form_with_token(): void + { + Mail::fake(); + $u = User::create(['name' => 'X', 'email' => 'x@e.com', 'password' => bcrypt('x'), 'role' => 'mechanic', 'status' => 'active']); + $token = $u->sendInvitation(); + + $resp = $this->get("/invitations/{$token}"); + $resp->assertStatus(200); + $resp->assertSee($u->name); + $resp->assertSee('Activează contul'); + } + + public function test_invitation_post_accepts_password_and_redirects(): void + { + Mail::fake(); + $u = User::create(['name' => 'X', 'email' => 'x@e.com', 'password' => bcrypt('placeholder'), 'role' => 'mechanic', 'status' => 'active']); + $token = $u->sendInvitation(); + + $resp = $this->post("/invitations/{$token}", [ + 'password' => 'BrandNewPass1', + 'password_confirmation' => 'BrandNewPass1', + ]); + $resp->assertStatus(302); + + $u->refresh(); + $this->assertNotNull($u->accepted_at); + $this->assertTrue(\Hash::check('BrandNewPass1', $u->password)); + } + + public function test_invalid_token_returns_invalid_view(): void + { + $resp = $this->get('/invitations/not-a-real-token'); + $resp->assertStatus(200); + $resp->assertSee('Invitație invalidă'); + } + + public function test_expired_invitation_returns_expired_view(): void + { + Mail::fake(); + $u = User::create(['name' => 'X', 'email' => 'x@e.com', 'password' => bcrypt('x'), 'role' => 'mechanic', 'status' => 'active']); + $token = $u->sendInvitation(); + // Force expiry by backdating invited_at + $u->forceFill(['invited_at' => now()->subDays(8)])->saveQuietly(); + + $resp = $this->get("/invitations/{$token}"); + $resp->assertStatus(200); + $resp->assertSee('Invitație expirată'); + } + + public function test_password_too_short_returns_validation_error(): void + { + Mail::fake(); + $u = User::create(['name' => 'X', 'email' => 'x@e.com', 'password' => bcrypt('x'), 'role' => 'mechanic', 'status' => 'active']); + $token = $u->sendInvitation(); + + $resp = $this->post("/invitations/{$token}", [ + 'password' => 'short', + 'password_confirmation' => 'short', + ]); + $resp->assertSessionHasErrors('password'); + + $u->refresh(); + $this->assertNull($u->accepted_at); + } +} diff --git a/tests/Feature/RbacApiTest.php b/tests/Feature/RbacApiTest.php new file mode 100644 index 0000000..0598bd3 --- /dev/null +++ b/tests/Feature/RbacApiTest.php @@ -0,0 +1,203 @@ + 'test'], ['name' => 'T', 'price' => 0, 'features' => []]); + $this->company = Company::create([ + 'plan_id' => $plan->id, 'slug' => 'api-' . uniqid(), + 'name' => 'API Co', 'status' => 'active', + ]); + app(TenantManager::class)->setCurrent($this->company); + app(RbacSeeder::class)->seedTenantRoles($this->company->id); + app(PermissionRegistrar::class)->setPermissionsTeamId($this->company->id); + + $this->admin = User::create(['name' => 'A', 'email' => 'a@e.com', 'password' => bcrypt('x'), 'role' => 'admin', 'status' => 'active']); + $this->admin->syncRoles(['admin']); + + $this->mechanic = User::create(['name' => 'M', 'email' => 'm@e.com', 'password' => bcrypt('x'), 'role' => 'mechanic', 'status' => 'active']); + $this->mechanic->syncRoles(['mechanic']); + } + + public function test_admin_can_list_users_via_api(): void + { + Sanctum::actingAs($this->admin); + + $resp = $this->getJson('/api/v1/users'); + $resp->assertOk(); + $this->assertGreaterThanOrEqual(2, count($resp->json('data'))); + } + + public function test_mechanic_cannot_list_users_403(): void + { + Sanctum::actingAs($this->mechanic); + + $resp = $this->getJson('/api/v1/users'); + $resp->assertForbidden(); + } + + public function test_admin_can_create_user_and_invitation_is_sent(): void + { + Mail::fake(); + Sanctum::actingAs($this->admin); + + $resp = $this->postJson('/api/v1/users', [ + 'name' => 'New U', 'email' => 'newu@e.com', + 'role' => 'receptionist', 'send_invitation' => true, + ]); + + $resp->assertCreated(); + $this->assertEquals('inactive', $resp->json('data.status')); // inactive until invitation accepted + $this->assertTrue($resp->json('invitation_sent')); + Mail::assertQueued(UserInvitationMail::class); + } + + public function test_admin_can_assign_and_remove_roles_via_api(): void + { + Sanctum::actingAs($this->admin); + + $resp = $this->postJson("/api/v1/users/{$this->mechanic->id}/roles", ['role' => 'receptionist']); + $resp->assertOk(); + $this->mechanic->refresh(); + $this->assertTrue($this->mechanic->hasRole('receptionist')); + + $resp = $this->deleteJson("/api/v1/users/{$this->mechanic->id}/roles/receptionist"); + $resp->assertOk(); + $this->mechanic->refresh(); + $this->assertFalse($this->mechanic->hasRole('receptionist')); + } + + public function test_effective_permissions_endpoint_subtracts_denies(): void + { + Sanctum::actingAs($this->admin); + + // Admin has FINANCE_VIEW_OVERVIEW. Add a deny override. + $perm = Permission::where('name', Permissions::FINANCE_VIEW_OVERVIEW)->first(); + UserPermissionOverride::create([ + 'user_id' => $this->admin->id, 'permission_id' => $perm->id, + 'mode' => 'deny', 'reason' => 'test', 'granted_at' => now(), + ]); + + $resp = $this->getJson("/api/v1/users/{$this->admin->id}/permissions"); + $resp->assertOk(); + $effective = collect($resp->json('data')); + $this->assertFalse($effective->contains(Permissions::FINANCE_VIEW_OVERVIEW)); + $denies = collect($resp->json('overrides.denies')); + $this->assertTrue($denies->contains(Permissions::FINANCE_VIEW_OVERVIEW)); + } + + public function test_add_override_via_api_persists(): void + { + Sanctum::actingAs($this->admin); + + $resp = $this->postJson("/api/v1/users/{$this->mechanic->id}/permission-overrides", [ + 'permission' => Permissions::WORK_ORDERS_VIEW_ALL, + 'mode' => 'grant', + 'reason' => 'pinch hitter', + 'expires_at' => now()->addDays(3)->toIso8601String(), + ]); + $resp->assertOk(); + + $this->mechanic->refresh(); + $this->assertEquals(1, $this->mechanic->permissionOverrides()->count()); + $this->assertTrue($this->mechanic->canDo(Permissions::WORK_ORDERS_VIEW_ALL)); + } + + public function test_remove_override_via_api(): void + { + Sanctum::actingAs($this->admin); + $perm = Permission::where('name', Permissions::WORK_ORDERS_VIEW_ALL)->first(); + UserPermissionOverride::create(['user_id' => $this->mechanic->id, 'permission_id' => $perm->id, 'mode' => 'grant', 'granted_at' => now()]); + + $resp = $this->deleteJson("/api/v1/users/{$this->mechanic->id}/permission-overrides/" . Permissions::WORK_ORDERS_VIEW_ALL); + $resp->assertOk(); + $this->assertEquals(0, $this->mechanic->fresh()->permissionOverrides()->count()); + } + + public function test_role_index_returns_all_roles_with_counts(): void + { + Sanctum::actingAs($this->admin); + + $resp = $this->getJson('/api/v1/roles'); + $resp->assertOk(); + $roles = collect($resp->json('data')); + $this->assertGreaterThanOrEqual(7, $roles->count()); + $owner = $roles->firstWhere('name', 'owner'); + $this->assertNotNull($owner); + $this->assertEquals(51, $owner['permissions_count']); + } + + public function test_role_sync_permissions_updates_role(): void + { + Sanctum::actingAs($this->admin); + $role = \Spatie\Permission\Models\Role::create(['name' => 'custom_role', 'guard_name' => 'web']); + + $resp = $this->putJson("/api/v1/roles/{$role->id}/permissions", [ + 'permissions' => [Permissions::CLIENTS_VIEW_ALL, Permissions::VEHICLES_VIEW_ALL], + ]); + $resp->assertOk(); + + $this->assertEquals(2, $role->fresh()->permissions()->count()); + } + + public function test_role_destroy_rejects_system_role(): void + { + Sanctum::actingAs($this->admin); + $owner = \Spatie\Permission\Models\Role::where('name', 'owner')->where('company_id', $this->company->id)->first(); + + $resp = $this->deleteJson("/api/v1/roles/{$owner->id}"); + $resp->assertStatus(422); + $this->assertEquals('Cannot delete system role', $resp->json('error')); + } + + public function test_permission_catalog_endpoint_returns_full_list_and_groups(): void + { + Sanctum::actingAs($this->admin); + + $resp = $this->getJson('/api/v1/permissions'); + $resp->assertOk(); + $this->assertEquals(51, count($resp->json('data'))); + $this->assertArrayHasKey('grouped', $resp->json()); + $this->assertArrayHasKey('clients', $resp->json('grouped')); + $this->assertArrayHasKey('roles', $resp->json()); + } + + public function test_revoke_all_sessions_endpoint(): void + { + Sanctum::actingAs($this->admin); + \DB::table('sessions')->insert([ + ['id' => 's1', 'user_id' => $this->mechanic->id, 'ip_address' => '1.1.1.1', 'user_agent' => 'X', 'payload' => '', 'last_activity' => time()], + ['id' => 's2', 'user_id' => $this->mechanic->id, 'ip_address' => '2.2.2.2', 'user_agent' => 'Y', 'payload' => '', 'last_activity' => time()], + ]); + + $resp = $this->deleteJson("/api/v1/users/{$this->mechanic->id}/sessions"); + $resp->assertOk(); + $this->assertEquals(2, $resp->json('revoked_count')); + $this->assertEquals(0, \DB::table('sessions')->where('user_id', $this->mechanic->id)->count()); + } +}