security: Rechteausweitung schließen & Admin-Panel feingranular gaten (K1, H1, H2, M8)
- users:manage/roles:manage auf allen User-/Rollen-Masken erzwungen; is_super_admin aus $fillable entfernt und nur per autorisiertem forceFill setzbar; zentraler Gate::before-Super-Admin-Kurzschluss (K1/M8). - Nicht-Super-Admins können Super-Admin-Konten nicht mehr bearbeiten (Fix#2); Impersonation mit Rangprüfung, keine Token-Erstellung während Impersonation (H1). - Destruktive/verwaltende Admin-Aktionen (CRM/Billing/Compliance/Struktur) hängen an neuen admin-only Permissions; Editor behält reine Content-Rechte (H2). - Kanonischer Permission-Katalog (App\Authorization\Permission) als Single Source of Truth für Seeder und Monitoring. Deployment: `php artisan db:seed --class=RolesAndPermissionsSeeder` auf allen Umgebungen ausführen (neue Permissions). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
parent
299837d2ba
commit
40783192d0
34 changed files with 748 additions and 100 deletions
|
|
@ -40,6 +40,7 @@
|
|||
? app(\App\Services\Admin\AdminPerformanceCache::class)->pressReleaseReviewCount()
|
||||
: 0;
|
||||
$legalOpenCount = $canAdmin ? \App\Models\LegalRequest::query()->open()->count() : 0;
|
||||
$contactOpenCount = $canAdmin ? \App\Models\ContactMessage::query()->open()->count() : 0;
|
||||
@endphp
|
||||
|
||||
<flux:navlist variant="outline">
|
||||
|
|
@ -115,14 +116,18 @@
|
|||
:badge="$reviewCount > 0 ? $reviewCount : null" badge-color="yellow" wire:navigate>
|
||||
{{ __('Pressemitteilungen') }}
|
||||
</flux:navlist.item>
|
||||
<flux:navlist.item icon="folder" :href="route('admin.categories.index')"
|
||||
:current="request()->routeIs('admin.categories.*')" wire:navigate>
|
||||
{{ __('Kategorien') }}
|
||||
</flux:navlist.item>
|
||||
<flux:navlist.item icon="code-bracket-square" :href="route('admin.footer-codes.index')"
|
||||
:current="request()->routeIs('admin.footer-codes.*')" wire:navigate>
|
||||
{{ __('Footer-Codes') }}
|
||||
</flux:navlist.item>
|
||||
@can('categories:manage')
|
||||
<flux:navlist.item icon="folder" :href="route('admin.categories.index')"
|
||||
:current="request()->routeIs('admin.categories.*')" wire:navigate>
|
||||
{{ __('Kategorien') }}
|
||||
</flux:navlist.item>
|
||||
@endcan
|
||||
@can('footer-codes:manage')
|
||||
<flux:navlist.item icon="code-bracket-square" :href="route('admin.footer-codes.index')"
|
||||
:current="request()->routeIs('admin.footer-codes.*')" wire:navigate>
|
||||
{{ __('Footer-Codes') }}
|
||||
</flux:navlist.item>
|
||||
@endcan
|
||||
</flux:navlist.group>
|
||||
|
||||
{{-- CRM --}}
|
||||
|
|
@ -137,16 +142,28 @@
|
|||
</flux:navlist.item>
|
||||
</flux:navlist.group>
|
||||
|
||||
{{-- Recht & Compliance --}}
|
||||
<flux:navlist.group :heading="__('Recht & Compliance')" class="grid mb-4">
|
||||
<flux:navlist.item icon="scale" :href="route('admin.legal-requests.index')"
|
||||
:current="request()->routeIs('admin.legal-requests.*')"
|
||||
:badge="$legalOpenCount > 0 ? $legalOpenCount : null" badge-color="red" wire:navigate>
|
||||
{{ __('Anfragen') }}
|
||||
</flux:navlist.item>
|
||||
</flux:navlist.group>
|
||||
@can('compliance:manage')
|
||||
{{-- Kontakt: Anliegen aus dem Kontakt-Widget (Widget + Hub-Formular) --}}
|
||||
<flux:navlist.group :heading="__('Kontakt')" class="grid mb-4">
|
||||
<flux:navlist.item icon="chat-bubble-left-right" :href="route('admin.contact-messages.index')"
|
||||
:current="request()->routeIs('admin.contact-messages.*')"
|
||||
:badge="$contactOpenCount > 0 ? $contactOpenCount : null" badge-color="red" wire:navigate>
|
||||
{{ __('Anliegen') }}
|
||||
</flux:navlist.item>
|
||||
</flux:navlist.group>
|
||||
|
||||
{{-- Recht & Compliance --}}
|
||||
<flux:navlist.group :heading="__('Recht & Compliance')" class="grid mb-4">
|
||||
<flux:navlist.item icon="scale" :href="route('admin.legal-requests.index')"
|
||||
:current="request()->routeIs('admin.legal-requests.*')"
|
||||
:badge="$legalOpenCount > 0 ? $legalOpenCount : null" badge-color="red" wire:navigate>
|
||||
{{ __('Anfragen') }}
|
||||
</flux:navlist.item>
|
||||
</flux:navlist.group>
|
||||
@endcan
|
||||
|
||||
{{-- Billing --}}
|
||||
@can('billing:manage')
|
||||
<flux:navlist.group :heading="__('Billing')" class="grid mb-4">
|
||||
<flux:navlist.item icon="archive-box" :href="route('admin.invoices.index')"
|
||||
:current="request()->routeIs('admin.invoices.*')" wire:navigate>
|
||||
|
|
@ -169,6 +186,7 @@
|
|||
{{ __('Newsletter Sync') }}
|
||||
</flux:navlist.item>
|
||||
</flux:navlist.group>
|
||||
@endcan
|
||||
|
||||
{{-- Administration --}}
|
||||
<flux:navlist.group :heading="__('Administration')" class="grid mb-4">
|
||||
|
|
@ -176,22 +194,32 @@
|
|||
:current="request()->routeIs('admin.presets.*')" wire:navigate>
|
||||
{{ __('Voreinstellungen') }}
|
||||
</flux:navlist.item>
|
||||
<flux:navlist.item icon="users" :href="route('admin.users.index')"
|
||||
:current="request()->routeIs('admin.users.*')" wire:navigate>
|
||||
{{ __('Benutzer') }}
|
||||
</flux:navlist.item>
|
||||
<flux:navlist.item icon="shield-check" :href="route('admin.roles.index')"
|
||||
:current="request()->routeIs('admin.roles.*')" wire:navigate>
|
||||
{{ __('Rollen & Rechte') }}
|
||||
</flux:navlist.item>
|
||||
@can('users:manage')
|
||||
<flux:navlist.item icon="users" :href="route('admin.users.index')"
|
||||
:current="request()->routeIs('admin.users.*')" wire:navigate>
|
||||
{{ __('Benutzer') }}
|
||||
</flux:navlist.item>
|
||||
@endcan
|
||||
@can('roles:manage')
|
||||
<flux:navlist.item icon="shield-check" :href="route('admin.roles.index')"
|
||||
:current="request()->routeIs('admin.roles.*')" wire:navigate>
|
||||
{{ __('Rollen & Rechte') }}
|
||||
</flux:navlist.item>
|
||||
@endcan
|
||||
</flux:navlist.group>
|
||||
|
||||
{{-- Reports --}}
|
||||
<flux:navlist.group :heading="__('Reports')" class="grid mb-4">
|
||||
<flux:navlist.item icon="chart-bar-square" :href="route('admin.reports.slow-requests')"
|
||||
:current="request()->routeIs('admin.reports.*')" wire:navigate>
|
||||
:current="request()->routeIs('admin.reports.slow-requests')" wire:navigate>
|
||||
{{ __('Performance') }}
|
||||
</flux:navlist.item>
|
||||
@can('settings:manage')
|
||||
<flux:navlist.item icon="heart" :href="route('admin.reports.system-health')"
|
||||
:current="request()->routeIs('admin.reports.system-health')" wire:navigate>
|
||||
{{ __('Betriebsüberwachung') }}
|
||||
</flux:navlist.item>
|
||||
@endcan
|
||||
</flux:navlist.group>
|
||||
@endif
|
||||
|
||||
|
|
@ -387,6 +415,9 @@
|
|||
|
||||
{{ $slot }}
|
||||
|
||||
{{-- Schwebendes Kontakt-Widget (unten rechts, eingeloggter Bereich) --}}
|
||||
<x-web.contact-launcher />
|
||||
|
||||
@persist('toast')
|
||||
<flux:toast position="top end" class="pt-24" />
|
||||
@endpersist
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue