gitmedia/presseportale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

security: Rechteausweitung schließen & Admin-Panel feingranular gaten (K1, H1, H2, M8)

Browse source 
- users:manage/roles:manage auf allen User-/Rollen-Masken erzwungen;
  is_super_admin aus $fillable entfernt und nur per autorisiertem
  forceFill setzbar; zentraler Gate::before-Super-Admin-Kurzschluss (K1/M8).
- Nicht-Super-Admins können Super-Admin-Konten nicht mehr bearbeiten (Fix#2);
  Impersonation mit Rangprüfung, keine Token-Erstellung während Impersonation (H1).
- Destruktive/verwaltende Admin-Aktionen (CRM/Billing/Compliance/Struktur)
  hängen an neuen admin-only Permissions; Editor behält reine Content-Rechte (H2).
- Kanonischer Permission-Katalog (App\Authorization\Permission) als Single
  Source of Truth für Seeder und Monitoring.

Deployment: `php artisan db:seed --class=RolesAndPermissionsSeeder` auf allen
Umgebungen ausführen (neue Permissions).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Kevin Adametz 2026-07-14 13:48:50 +00:00
parent 39e13d6d84
commit 77f8f9cb35
34 changed files with 748 additions and 100 deletions
Download patch file Download diff file Expand all files Collapse all files

45
database/seeders/RolesAndPermissionsSeeder.php
View file

@ -2,6 +2,7 @@
namespace Database\Seeders;
use App\Authorization\Permission as PermissionCatalog;
use Illuminate\Database\Seeder;
use Spatie\Permission\Models\Permission;
use Spatie\Permission\Models\Role;
@ -24,48 +25,18 @@ class RolesAndPermissionsSeeder extends Seeder
Role::firstOrCreate(['name' => $role]);
}
$permissions = [
'press-releases:read',
'press-releases:write',
'press-releases:publish',
'press-release-images:write',
'companies:read',
'newsletter:subscribe',
'users:manage',
'roles:manage',
// Legacy-API-Parität (10.07.2026): Bestandskunden mit dem alten
// immediatePublication-Recht (connektar) veröffentlichen per
// /service-POST sofort — sofern der Admin-Schalter „KI-Prüfung
// Legacy-API" aus ist. Zuweisung je User (WS-7-Checkliste).
'api:immediate-publication',
];
// Kanonischer Permission-Katalog inkl. Rollen-Zuordnung: siehe
// App\Authorization\Permission. Schreibende CRM-/Verwaltungsrechte gehen
// nur an `admin` (Befund H2); der `editor` behält reine Content-Rechte.
$permissions = PermissionCatalog::all();
foreach ($permissions as $permission) {
Permission::firstOrCreate(['name' => $permission]);
}
Role::findByName('admin')->syncPermissions($permissions);
Role::findByName('editor')->syncPermissions([
'press-releases:read',
'press-releases:write',
'press-releases:publish',
'press-release-images:write',
'companies:read',
'newsletter:subscribe',
]);
Role::findByName('customer')->syncPermissions([
'press-releases:read',
'press-releases:write',
'press-release-images:write',
'companies:read',
'newsletter:subscribe',
]);
Role::findByName('api-only')->syncPermissions([
'press-releases:read',
'press-releases:write',
'press-release-images:write',
'companies:read',
'newsletter:subscribe',
]);
Role::findByName('editor')->syncPermissions(PermissionCatalog::editor());
Role::findByName('customer')->syncPermissions(PermissionCatalog::customer());
Role::findByName('api-only')->syncPermissions(PermissionCatalog::apiOnly());
}
}