Implement leadership-based permissions for Meetup management

- 🔒 Restrict event creation, editing, and deletion to Meetup leaders (`is_leader`) and creators for consistency across APIs, frontend, and MCP.
-  Add new APIs for leader delegation: assign/remove Meetup leaders via `meetup_user.is_leader`.
- 🛠️ Replace loose member checks with specific leadership checks in policies, controllers, and views.
- 🧪 Add exhaustive tests to ensure only eligible leaders execute critical actions (e.g., event creation/edit, Meetup updates).
- 🔄 Refactor pivot relationships and models (`leadByMe`, `isLeader`) for explicit leadership handling.
-  Introduce artisan command `meetups:promote-existing-leaders` to transition legacy data.
This commit is contained in:
HolgerHatGarKeineNode
2026-06-16 22:04:34 +02:00
parent 39af153f52
commit 9f8fda294a
26 changed files with 691 additions and 70 deletions
+23 -8
View File
@@ -63,23 +63,38 @@ it('allows update when name is unchanged (Rule::unique ignores own id)', functio
->assertHasNoErrors();
});
it('allows updateMeetup for a member of the meetup_user pivot who is not the creator', function () {
it('allows updateMeetup for a delegated leader who is not the creator', function () {
$leader = actingAsUser();
$meetup = Meetup::factory()->create([
'city_id' => $this->city->id,
'name' => 'Original Name',
'created_by' => User::factory()->create()->id,
]);
$meetup->users()->attach($leader, ['is_leader' => true]);
Livewire::test('meetups.edit', ['meetup' => $meetup])
->set('name', 'Updated By Leader')
->set('city_id', $this->city->id)
->set('community', 'einundzwanzig')
->call('updateMeetup')
->assertHasNoErrors();
expect($meetup->refresh()->name)->toBe('Updated By Leader');
});
it('blocks updateMeetup for a plain member (is_leader = false) who is not the creator', function () {
$member = actingAsUser();
$meetup = Meetup::factory()->create([
'city_id' => $this->city->id,
'name' => 'Original Name',
'created_by' => User::factory()->create()->id,
]);
$meetup->users()->attach($member);
$meetup->users()->attach($member, ['is_leader' => false]);
Livewire::test('meetups.edit', ['meetup' => $meetup])
->set('name', 'Updated By Member')
->set('city_id', $this->city->id)
->set('community', 'einundzwanzig')
->call('updateMeetup')
->assertHasNoErrors();
->assertStatus(403);
expect($meetup->refresh()->name)->toBe('Updated By Member');
expect($meetup->refresh()->name)->toBe('Original Name');
});
it('blocks updateMeetup when the user is neither creator nor pivot member', function () {