Implement leadership-based permissions for Meetup management

- 🔒 Restrict event creation, editing, and deletion to Meetup leaders (`is_leader`) and creators for consistency across APIs, frontend, and MCP.
-  Add new APIs for leader delegation: assign/remove Meetup leaders via `meetup_user.is_leader`.
- 🛠️ Replace loose member checks with specific leadership checks in policies, controllers, and views.
- 🧪 Add exhaustive tests to ensure only eligible leaders execute critical actions (e.g., event creation/edit, Meetup updates).
- 🔄 Refactor pivot relationships and models (`leadByMe`, `isLeader`) for explicit leadership handling.
-  Introduce artisan command `meetups:promote-existing-leaders` to transition legacy data.
This commit is contained in:
HolgerHatGarKeineNode
2026-06-16 22:04:34 +02:00
parent 39af153f52
commit 9f8fda294a
26 changed files with 691 additions and 70 deletions
+16 -1
View File
@@ -25,8 +25,23 @@ class MeetupEventPolicy
return true;
}
/**
* Termin bearbeiten: der Ersteller des Termins ODER ein Leader des
* zugehörigen Meetups (bzw. Super-Admin). Damit dürfen Meetup-Leader die
* Termine ihres Meetups pflegen, auch wenn sie sie nicht selbst angelegt
* haben analog zur Stammdaten-Bearbeitung (MeetupPolicy::update).
*/
public function update(User $user, MeetupEvent $meetupEvent): bool
{
return $this->owns($user, $meetupEvent);
return $this->owns($user, $meetupEvent)
|| ($meetupEvent->meetup !== null && $meetupEvent->meetup->isLeader($user));
}
/**
* Termin löschen: gleiche Regel wie das Bearbeiten.
*/
public function delete(User $user, MeetupEvent $meetupEvent): bool
{
return $this->update($user, $meetupEvent);
}
}