Enhance meetup association and permissions management

- 🔍 Added `resolveInScope` method to `ResolvesEntities` for scoped entity resolution with stricter control.
- 👥 Introduced `AddMeetupToMineTool` MCP tool for adding external meetups to "My Meetups."
- 🛠️ Updated `ListMyMeetupsTool` and `ShowMyMeetupTool` to include both created and joined meetups.
- 📚 Updated `Meetup` model with `associatedWith` scope for querying user-related meetups.
-  Expanded feature tests for meetup membership, creator permissions, and scoped tool usage.
- 🛡️ Unified access checks across Livewire and APIs to restrict editing meetup details to creators or super-admins.
- 🔗 Registered `AddMeetupToMineTool` in `EinundzwanzigServer`.
This commit is contained in:
HolgerHatGarKeineNode
2026-06-08 11:59:02 +02:00
parent dc2b828777
commit 3a507cced2
13 changed files with 260 additions and 56 deletions
@@ -84,23 +84,14 @@ class extends Component {
}
/**
* Enforce that only users who have added the meetup to their personal
* "My-Meetups" list (the meetup_user pivot) may load or update this view.
* Editing is intentionally not restricted to the original `created_by`
* any member of the meetup's user list is treated as an editor.
* Stammdaten eines Meetups dürfen ausschließlich vom Ersteller (created_by) oder
* einem Super-Admin bearbeitet werden einheitlich mit MeetupPolicy, der REST-API
* und den MCP-Tools. Reine Mitglieder (meetup_user-Pivot) dürfen nur Termine anlegen
* (siehe meetups.create-edit-events), nicht aber die Stammdaten ändern.
*/
protected function authorizeAccess(): void
{
if (! auth()->check()) {
abort(403);
}
$isMember = $this->meetup
->users()
->whereKey(auth()->id())
->exists();
if (! $isMember) {
if (auth()->guest() || auth()->user()->cannot('update', $this->meetup)) {
abort(403);
}
}