gitmedia/presseportale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

security: Rechteausweitung schließen & Admin-Panel feingranular gaten (K1, H1, H2, M8)

Browse source 
- users:manage/roles:manage auf allen User-/Rollen-Masken erzwungen;
  is_super_admin aus $fillable entfernt und nur per autorisiertem
  forceFill setzbar; zentraler Gate::before-Super-Admin-Kurzschluss (K1/M8).
- Nicht-Super-Admins können Super-Admin-Konten nicht mehr bearbeiten (Fix#2);
  Impersonation mit Rangprüfung, keine Token-Erstellung während Impersonation (H1).
- Destruktive/verwaltende Admin-Aktionen (CRM/Billing/Compliance/Struktur)
  hängen an neuen admin-only Permissions; Editor behält reine Content-Rechte (H2).
- Kanonischer Permission-Katalog (App\Authorization\Permission) als Single
  Source of Truth für Seeder und Monitoring.

Deployment: `php artisan db:seed --class=RolesAndPermissionsSeeder` auf allen
Umgebungen ausführen (neue Permissions).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Kevin Adametz 2026-07-14 13:48:50 +00:00
parent 39e13d6d84
commit 77f8f9cb35
34 changed files with 748 additions and 100 deletions
Download patch file Download diff file Expand all files Collapse all files

69
routes/admin.php
View file

@ -42,41 +42,54 @@ Route::middleware(['auth', 'verified', BlockAdminDuringImpersonation::class, Ens
Volt::route('admin/press-releases/{id}', 'admin.press-releases.show')->name('admin.press-releases.show');
Volt::route('admin/press-releases/{id}/edit', 'admin.press-releases.edit')->name('admin.press-releases.edit');
Volt::route('admin/categories', 'admin.categories.index')->name('admin.categories.index');
Volt::route('admin/categories/create', 'admin.categories.create')->name('admin.categories.create');
Volt::route('admin/categories/{id}/edit', 'admin.categories.edit')->name('admin.categories.edit');
// Rubriken-Taxonomie: portalweite Struktur — nur admin (Befund H2).
Route::middleware('can:categories:manage')->group(function (): void {
Volt::route('admin/categories', 'admin.categories.index')->name('admin.categories.index');
Volt::route('admin/categories/create', 'admin.categories.create')->name('admin.categories.create');
Volt::route('admin/categories/{id}/edit', 'admin.categories.edit')->name('admin.categories.edit');
});
Volt::route('admin/footer-codes', 'admin.footer-codes.index')->name('admin.footer-codes.index');
Volt::route('admin/footer-codes/create', 'admin.footer-codes.create')->name('admin.footer-codes.create');
Volt::route('admin/footer-codes/{id}/edit', 'admin.footer-codes.edit')->name('admin.footer-codes.edit');
Route::middleware('can:footer-codes:manage')->group(function (): void {
Volt::route('admin/footer-codes', 'admin.footer-codes.index')->name('admin.footer-codes.index');
Volt::route('admin/footer-codes/create', 'admin.footer-codes.create')->name('admin.footer-codes.create');
Volt::route('admin/footer-codes/{id}/edit', 'admin.footer-codes.edit')->name('admin.footer-codes.edit');
});
// CRM
// Lesen (companies:read) auch für Editoren; Schreiben nur admin (companies:write, Befund H2).
Volt::route('admin/companies', 'admin.companies.index')->name('admin.companies.index');
Volt::route('admin/companies/create', 'admin.companies.create')->name('admin.companies.create');
Volt::route('admin/companies/{id}', 'admin.companies.show')->name('admin.companies.show');
Volt::route('admin/companies/{id}/edit', 'admin.companies.edit')->name('admin.companies.edit');
Volt::route('admin/companies/{companyId}/contacts/create', 'admin.contacts.create')->name('admin.companies.contacts.create');
Volt::route('admin/companies/{id}', 'admin.companies.show')->where('id', '[0-9]+')->name('admin.companies.show');
Volt::route('admin/contacts', 'admin.contacts.index')->name('admin.contacts.index');
Volt::route('admin/contacts/create', 'admin.contacts.create')->name('admin.contacts.create');
Volt::route('admin/contacts/{id}/edit', 'admin.contacts.edit')->name('admin.contacts.edit');
Route::middleware('can:companies:write')->group(function (): void {
Volt::route('admin/companies/create', 'admin.companies.create')->name('admin.companies.create');
Volt::route('admin/companies/{id}/edit', 'admin.companies.edit')->name('admin.companies.edit');
Volt::route('admin/companies/{companyId}/contacts/create', 'admin.contacts.create')->name('admin.companies.contacts.create');
Volt::route('admin/contacts/create', 'admin.contacts.create')->name('admin.contacts.create');
Volt::route('admin/contacts/{id}/edit', 'admin.contacts.edit')->name('admin.contacts.edit');
});
// Recht & Compliance (WS-3): Queue für DSGVO-/Persönlichkeitsrechts-/Meldungen
Volt::route('admin/legal-requests', 'admin.legal-requests.index')->name('admin.legal-requests.index');
Volt::route('admin/legal-requests/{id}', 'admin.legal-requests.show')->name('admin.legal-requests.show');
// — sensible Vorgänge, nur admin (Befund H2).
Route::middleware('can:compliance:manage')->group(function (): void {
Volt::route('admin/legal-requests', 'admin.legal-requests.index')->name('admin.legal-requests.index');
Volt::route('admin/legal-requests/{id}', 'admin.legal-requests.show')->name('admin.legal-requests.show');
// Kontakt: Queue für Anliegen aus dem Kontakt-Widget (Kontaktaufnahme,
// Fehlermeldung, PM-Meldung, Feedback)
Volt::route('admin/contact-messages', 'admin.contact-messages.index')->name('admin.contact-messages.index');
Volt::route('admin/contact-messages/{id}', 'admin.contact-messages.show')->name('admin.contact-messages.show');
// Kontakt: Queue für Anliegen aus dem Kontakt-Widget (Kontaktaufnahme,
// Fehlermeldung, PM-Meldung, Feedback)
Volt::route('admin/contact-messages', 'admin.contact-messages.index')->name('admin.contact-messages.index');
Volt::route('admin/contact-messages/{id}', 'admin.contact-messages.show')->name('admin.contact-messages.show');
});
// Billing
Volt::route('admin/invoices', 'admin.invoices.index')->name('admin.invoices.index');
Route::get('admin/legacy-invoices/{legacyInvoice}/pdf', LegacyInvoicePdfController::class)->name('admin.legacy-invoices.pdf');
Volt::route('admin/payments', 'admin.payments.index')->name('admin.payments.index');
Volt::route('admin/payments/plans', 'admin.payments.plans')->name('admin.payments.plans');
Volt::route('admin/coupons', 'admin.coupons.index')->name('admin.coupons.index');
Volt::route('admin/newsletter-sync', 'admin.newsletter.sync')->name('admin.newsletter.sync');
// Billing: Rechnungen, Zahlungen, Tarife, Gutscheine — nur admin (Befund H2).
Route::middleware('can:billing:manage')->group(function (): void {
Volt::route('admin/invoices', 'admin.invoices.index')->name('admin.invoices.index');
Route::get('admin/legacy-invoices/{legacyInvoice}/pdf', LegacyInvoicePdfController::class)->name('admin.legacy-invoices.pdf');
Volt::route('admin/payments', 'admin.payments.index')->name('admin.payments.index');
Volt::route('admin/payments/plans', 'admin.payments.plans')->name('admin.payments.plans');
Volt::route('admin/coupons', 'admin.coupons.index')->name('admin.coupons.index');
Volt::route('admin/newsletter-sync', 'admin.newsletter.sync')->name('admin.newsletter.sync');
});
// Administration
Volt::route('admin/presets', 'admin.presets.index')->name('admin.presets.index');
@ -94,4 +107,8 @@ Route::middleware(['auth', 'verified', BlockAdminDuringImpersonation::class, Ens
// Reports
Volt::route('admin/reports/slow-requests', 'admin.reports.slow-requests')->name('admin.reports.slow-requests');
Route::middleware('can:settings:manage')->group(function (): void {
Volt::route('admin/reports/system-health', 'admin.reports.system-health')->name('admin.reports.system-health');
});
});