mirror of
https://github.com/HolgerHatGarKeineNode/einundzwanzig-app.git
synced 2026-06-17 16:40:31 +00:00
✨ Implement leadership-based permissions for Meetup management
- 🔒 Restrict event creation, editing, and deletion to Meetup leaders (`is_leader`) and creators for consistency across APIs, frontend, and MCP. - ➕ Add new APIs for leader delegation: assign/remove Meetup leaders via `meetup_user.is_leader`. - 🛠️ Replace loose member checks with specific leadership checks in policies, controllers, and views. - 🧪 Add exhaustive tests to ensure only eligible leaders execute critical actions (e.g., event creation/edit, Meetup updates). - 🔄 Refactor pivot relationships and models (`leadByMe`, `isLeader`) for explicit leadership handling. - ✨ Introduce artisan command `meetups:promote-existing-leaders` to transition legacy data.
This commit is contained in:
@@ -85,15 +85,13 @@ class extends Component {
|
||||
}
|
||||
|
||||
/**
|
||||
* Portal-Frontend nutzt die gelockerte updateViaPortal-Ability: Ersteller,
|
||||
* Super-Admins UND Mitglieder der meetup_user-Pivot („Meine Meetups") dürfen
|
||||
* die Stammdaten bearbeiten. REST-API und MCP-Tools bleiben auf der strikten
|
||||
* update()-Ability (nur Ersteller/Super-Admin). Übergangslösung, bis ein
|
||||
* echtes Rollen-/Freigabekonzept existiert.
|
||||
* Stammdaten bearbeiten dürfen der Ersteller, Super-Admins UND delegierte
|
||||
* Leader (meetup_user.is_leader). Einheitliche update-Ability für Portal-
|
||||
* Frontend, REST-API und MCP-Tools (MeetupPolicy::update).
|
||||
*/
|
||||
protected function authorizeAccess(): void
|
||||
{
|
||||
if (auth()->guest() || auth()->user()->cannot('updateViaPortal', $this->meetup)) {
|
||||
if (auth()->guest() || auth()->user()->cannot('update', $this->meetup)) {
|
||||
abort(403);
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user