javier
8025fa6d05
Permissions now actually govern access instead of the hard-coded Admin role:
- Super-admin bypass (see all projects / full access) -> can('manage all')
in Project::scopeAccessibleBy, ProjectMap, ProjectDashboard, PhaseGantt,
LayerManager, ProjectReportController.
- Redundant '|| hasRole(Admin)' fallbacks dropped (Gate::before already lets
manage-all through can()): LayerManager (upload/delete layers), MediaManager
(upload), ProjectMap (update progress), ProjectUsers/ProjectCompanies
(assign users).
- Admin-only screens now gated by the matching permission: AdminUsers/UserView
-> can('view users'), UserForm -> can('create users')|can('edit users'),
CompanyView -> can('view companies').
- MediaManager delete: can('delete media') OR owner.
- Kept UserForm's domain guard (can't remove your own Admin role).
Note: the /admin route group still has middleware can:manage all, so admin
screens stay super-admin-only until that group is relaxed per-route.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
47 lines
1.1 KiB
PHP
47 lines
1.1 KiB
PHP
<?php
|
|
|
|
namespace App\Livewire;
|
|
|
|
use Livewire\Component;
|
|
use App\Models\User;
|
|
use Spatie\Permission\Models\Role;
|
|
use Illuminate\Support\Facades\Auth;
|
|
|
|
class AdminUsers extends Component
|
|
{
|
|
public string $search = '';
|
|
public $roles;
|
|
|
|
public function mount(): void
|
|
{
|
|
abort_unless(Auth::user()->can('view users'), 403);
|
|
$this->roles = Role::orderBy('name')->get();
|
|
}
|
|
|
|
public function getUsersProperty()
|
|
{
|
|
return User::with('roles')
|
|
->when($this->search, fn($q) =>
|
|
$q->where(fn($q2) => $q2
|
|
->where('name', 'like', '%' . $this->search . '%')
|
|
->orWhere('email', 'like', '%' . $this->search . '%')))
|
|
->orderBy('name')
|
|
->get();
|
|
}
|
|
|
|
public function deleteUser(int $userId): void
|
|
{
|
|
if ($userId === Auth::id()) {
|
|
$this->dispatch('notify', 'No puedes eliminarte a ti mismo.');
|
|
return;
|
|
}
|
|
User::findOrFail($userId)->delete();
|
|
$this->dispatch('notify', 'Usuario eliminado.');
|
|
}
|
|
|
|
public function render()
|
|
{
|
|
return view('livewire.admin-users');
|
|
}
|
|
}
|