Добавлена проверка прав доступа на работу с разделом.

По умолчанию проверка прав отключена и доступ к разделам можно отключать посредством методов $model->disableDisplay(); $model->disableCreating(); $model->disableEditing(); $model->disableDeleting(); $model->disableRestoring(); Также можно включить проверку прав с помощью Policies Для этого необходимо включить ее $model->enableAccessCheck(); После чего создать для модели Policy класс для модели, которая используется в текущем разделе https://laravel.com/docs/5.2/authorization#policies И в класс Policy добавить методы public function display(User $user, Model $model); public function create(User $user, Model $model); public function edit(User $user, Model $model); public function restore(User $user, Model $model); public function delete(User $user, Model $model); После чего проверка прав будет дополнительно осуществляться на его основе issue #7
LaravelRUS · Feb 23, 2016 · 8e2d969 · 8e2d969
1 parent 9e6842b
commit 8e2d969
Show file tree

Hide file tree

Showing 5 changed files with 228 additions and 24 deletions.
diff --git a/src/Display/Column/Control.php b/src/Display/Column/Control.php
@@ -51,7 +51,12 @@ protected function isTrashed()
      */
     protected function isEditable()
     {
-        return ! $this->isTrashed() && ! is_null($this->getModelConfiguration()->fireEdit($this->getModelKey()));
+        return
+            ! $this->isTrashed()
+            &&
+            $this->getModelConfiguration()->isEditable(
+                $this->getModel()
+            );
     }
 
     /**
@@ -70,7 +75,12 @@ protected function getEditUrl()
      */
     protected function isDeletable()
     {
-        return ! $this->isTrashed() && ! is_null($this->getModelConfiguration()->fireDelete($this->getModelKey()));
+        return
+            ! $this->isTrashed()
+            &&
+            $this->getModelConfiguration()->isDeletable(
+                $this->getModel()
+            );
     }
 
     /**
@@ -90,7 +100,12 @@ protected function getDeleteUrl()
      */
     protected function isRestorable()
     {
-        return $this->isTrashed() && ! is_null($this->getModelConfiguration()->fireRestore($this->getModelKey()));
+        return
+            $this->isTrashed()
+            &&
+            $this->getModelConfiguration()->isRestorable(
+                $this->getModel()
+            );
     }
 
     /**

diff --git a/src/Display/DisplayTable.php b/src/Display/DisplayTable.php
@@ -418,7 +418,7 @@ public function getParams()
         return [
             'title'     => $this->getTitle(),
             'columns'   => $this->getAllColumns(),
-            'creatable' => ! is_null($model->fireCreate()),
+            'creatable' => $model->isCreatable(),
             'createUrl' => $model->getCreateUrl($this->getParameters() + Request::all()),
             'actions'   => $this->getActions(),
             'attributes' => $this->getAttributes()

diff --git a/src/Http/Controllers/AdminController.php b/src/Http/Controllers/AdminController.php
@@ -20,6 +20,10 @@ class AdminController extends Controller
      */
     public function getDisplay(ModelConfiguration $model)
     {
+        if (! $model->isDisplayable()) {
+            abort(404);
+        }
+
         return $this->render($model, $model->fireDisplay());
     }
 
@@ -30,11 +34,11 @@ public function getDisplay(ModelConfiguration $model)
      */
     public function getCreate(ModelConfiguration $model)
     {
-        $create = $model->fireCreate();
-        if (is_null($create)) {
+        if (! $model->isCreatable()) {
             abort(404);
         }
 
+        $create = $model->fireCreate();
         return $this->render($model, $create);
     }
 
@@ -45,11 +49,11 @@ public function getCreate(ModelConfiguration $model)
      */
     public function postStore(ModelConfiguration $model)
     {
-        $createForm = $model->fireCreate();
-        if (is_null($createForm)) {
+        if (! $model->isCreatable()) {
             abort(404);
         }
 
+        $createForm = $model->fireCreate();
         $nextAction = Request::get('next_action');
 
         if ($createForm instanceof FormInterface) {
@@ -75,12 +79,13 @@ public function postStore(ModelConfiguration $model)
      */
     public function getEdit(ModelConfiguration $model, $id)
     {
-        $edit = $model->fireFullEdit($id);
-        if (is_null($edit)) {
+        $item = $model->getRepository()->find($id);
+
+        if (is_null($item) || ! $model->isEditable($item)) {
             abort(404);
         }
 
-        return $this->render($model, $edit);
+        return $this->render($model, $model->fireFullEdit($id));
     }
 
     /**
@@ -91,11 +96,13 @@ public function getEdit(ModelConfiguration $model, $id)
      */
     public function postUpdate(ModelConfiguration $model, $id)
     {
-        $editForm = $model->fireFullEdit($id);
-        if (is_null($editForm)) {
+        $item = $model->getRepository()->find($id);
+
+        if (is_null($item) || ! $model->isEditable($item)) {
             abort(404);
         }
 
+        $editForm = $model->fireFullEdit($id);
         $nextAction = Request::get('next_action');
 
         if ($editForm instanceof FormInterface) {
@@ -119,14 +126,15 @@ public function postUpdate(ModelConfiguration $model, $id)
      *
      * @return \Illuminate\Http\RedirectResponse
      */
-    public function postDestroy(ModelConfiguration $model, $id)
+    public function deleteDestroy(ModelConfiguration $model, $id)
     {
-        $delete = $model->fireDelete($id);
+        $item = $model->getRepository()->find($id);
 
-        if (is_null($delete)) {
+        if (is_null($item) || ! $model->isDeletable($item)) {
             abort(404);
         }
 
+        $model->fireDelete($id);
         $model->getRepository()->delete($id);
 
         return redirect()->back();
@@ -140,11 +148,13 @@ public function postDestroy(ModelConfiguration $model, $id)
      */
     public function postRestore($model, $id)
     {
-        $restore = $model->fireRestore($id);
-        if (is_null($restore)) {
+        $item = $model->getRepository()->find($id);
+
+        if (is_null($item) || ! $model->isRestorable($item)) {
             abort(404);
         }
 
+        $model->fireRestore($id);
         $model->getRepository()->restore($id);
 
         return redirect()->back();

diff --git a/src/Http/routes.php b/src/Http/routes.php
@@ -33,7 +33,7 @@
 
     Route::delete('{adminModel}/{adminModelId}/delete', [
         'as'   => 'model.destroy',
-        'uses' => 'AdminController@postDestroy',
+        'uses' => 'AdminController@deleteDestroy',
     ]);
 
     Route::post('{adminModel}/{adminModelId}/restore', [

diff --git a/src/Model/ModelConfiguration.php b/src/Model/ModelConfiguration.php
@@ -2,8 +2,10 @@
 
 namespace SleepingOwl\Admin\Model;
 
+use Gate;
 use Closure;
 use Illuminate\Support\Str;
+use Illuminate\Database\Eloquent\Model;
 use SleepingOwl\Admin\Contracts\FormInterface;
 use SleepingOwl\Admin\Repository\BaseRepository;
 use SleepingOwl\Admin\Contracts\DisplayInterface;
@@ -35,6 +37,36 @@ class ModelConfiguration
      */
     protected $create;
 
+    /**
+     * @var bool
+     */
+    protected $displayable = true;
+
+    /**
+     * @var bool
+     */
+    protected $creatable = true;
+
+    /**
+     * @var bool
+     */
+    protected $editable = true;
+
+    /**
+     * @var bool
+     */
+    protected $restorable = true;
+
+    /**
+     * @var bool
+     */
+    protected $deletable = true;
+
+    /**
+     * @var bool
+     */
+    protected $checkAccess = false;
+
     /**
      * @var Closure|null
      */
@@ -230,6 +262,145 @@ public function onDisplay(Closure $callback)
         return $this;
     }
 
+    /**
+     * @return boolean
+     */
+    public function isDisplayable()
+    {
+        return $this->displayable && $this->can('display', $this->makeModel());
+    }
+
+    /**
+     * @return $this
+     */
+    public function disableDisplay()
+    {
+        $this->displayable = false;
+
+        return $this;
+    }
+
+    /**
+     * @return boolean
+     */
+    public function isCreatable()
+    {
+        if (! is_callable($this->getCreate())) {
+            return false;
+        }
+
+        return $this->creatable && $this->can('create', $this->makeModel());
+    }
+
+    /**
+     * @return $this
+     */
+    public function disableCreating()
+    {
+        $this->creatable = false;
+
+        return $this;
+    }
+
+    /**
+     * @param Model $model
+     *
+     * @return bool
+     */
+    public function isEditable(Model $model)
+    {
+        if (! is_callable($this->getEdit())) {
+            return false;
+        }
+
+        return $this->editable && $this->can('edit', $model);
+    }
+
+    /**
+     * @return $this
+     */
+    public function disableEditing()
+    {
+        $this->editable = false;
+
+        return $this;
+    }
+
+    /**
+     * @param Model $model
+     *
+     * @return bool
+     */
+    public function isDeletable(Model $model)
+    {
+        return $this->deletable && $this->can('delete', $model);
+    }
+
+    /**
+     * @return $this
+     */
+    public function disableDeleting()
+    {
+        $this->deletable = false;
+
+        return $this;
+    }
+
+    /**
+     * @param Model $model
+     *
+     * @return boolean
+     */
+    public function isRestorable(Model $model)
+    {
+        return $this->restorable && $this->can('restore', $model);
+    }
+
+    /**
+     * @return $this
+     */
+    public function disableRestoring()
+    {
+        $this->restorable = false;
+
+        return $this;
+    }
+
+    /**
+     * @param string $action
+     * @param Model $model
+     *
+     * @return bool
+     */
+    public function can($action, Model $model)
+    {
+        if (! $this->checkAccess) {
+            return true;
+        }
+
+        return Gate::allows($action, $model);
+    }
+
+    /**
+     * @return $this
+     */
+    public function enableAccessCheck()
+    {
+        $this->checkAccess = true;
+
+        return $this;
+    }
+
+    /**
+     * @return $this
+     */
+    public function disableAccessCheck()
+    {
+        $this->checkAccess = false;
+
+        return $this;
+    }
+
     /**
      * @return DisplayInterface|mixed
      */
@@ -313,8 +484,8 @@ public function fireFullEdit($id)
      */
     public function fireDelete($id)
     {
-        if (is_callable($this->delete)) {
-            return app()->call($this->delete, [$id]);
+        if (is_callable($this->getDelete())) {
+            return app()->call($this->getDelete(), [$id]);
         }
     }
 
@@ -325,11 +496,11 @@ public function fireDelete($id)
      */
     public function fireRestore($id)
     {
-        if (is_callable($this->restore)) {
-            return app()->call($this->restore, [$id]);
+        if (is_callable($this->getRestore())) {
+            return app()->call($this->getRestore(), [$id]);
         }
 
-        return $this->restore;
+        return $this->getRestore();
     }
 
     /**
@@ -409,4 +580,12 @@ protected function setDefaultAlias()
         $alias = Str::snake(Str::plural(class_basename($this->getClass())));
         $this->setAlias($alias);
     }
+
+    /**
+     * @return Model
+     */
+    protected function makeModel()
+    {
+        return app()->make($this->getClass());
+    }
 }