Merge pull request #108 from trypostit/fix/role-permissions-audit

fix(permissions): enforce workspace roles across backend and UI

Author: paulocastellano

app/Http/Controllers/App/AnalyticsController.php

@@ -42,6 +42,8 @@ public function index(Request $request): Response
     {
         $workspace = $request->user()->currentWorkspace;
 
+        $this->authorize('view', $workspace);
+
         $accounts = $workspace->socialAccounts()
             ->where('is_active', true)
             ->whereIn('platform', self::SUPPORTED_PLATFORMS)

app/Http/Controllers/App/AutomationController.php

@@ -48,6 +48,8 @@ class AutomationController extends Controller
 {
     public function index(ListAutomations $list): Response
     {
+        $this->authorize('viewAny', Automation::class);
+
         $workspace = request()->user()->currentWorkspace;
 
         $automations = Inertia::scroll(fn () => AutomationResource::collection(
@@ -61,6 +63,8 @@ public function index(ListAutomations $list): Response
 
     public function store(StoreAutomationRequest $request, CreateAutomation $create): RedirectResponse
     {
+        $this->authorize('create', Automation::class);
+
         $automation = $create(
             $request->user()->currentWorkspace,
             $request->user(),
@@ -71,6 +75,8 @@ public function store(StoreAutomationRequest $request, CreateAutomation $create)
 
     public function show(Automation $automation): RedirectResponse
     {
+        $this->authorize('view', $automation);
+
         return redirect()->route('app.automations.workflow', $automation->id);
     }
 

app/Http/Controllers/App/PostController.php

@@ -180,7 +180,9 @@ public function store(StorePostRequest $request): RedirectResponse|\Symfony\Comp
             session()->flash('flash.banner', __('posts.flash.connect_first'));
             session()->flash('flash.bannerStyle', 'danger');
 
-            return redirect()->route('app.accounts');
+            return $request->user()->can('manageAccounts', $workspace)
+                ? redirect()->route('app.accounts')
+                : redirect()->route('app.calendar');
         }
 
         $post = CreatePost::execute($workspace, $request->user(), [
@@ -232,13 +234,15 @@ public function edit(Request $request, Post $post): Response|RedirectResponse
             return redirect()->route('app.workspaces.create');
         }
 
-        $this->authorize('update', $post);
+        $this->authorize('view', $post);
 
         if (PostStatusRules::blocksEditing($post)) {
             return redirect()->route('app.posts.show', $post);
         }
 
-        SyncPostPlatforms::execute($post);
+        if ($request->user()->can('update', $post)) {
+            SyncPostPlatforms::execute($post);
+        }
 
         $post->load(['postPlatforms.socialAccount', 'labels']);
         $socialAccounts = $workspace->socialAccounts()->active()->get();

app/Http/Controllers/Auth/SocialController.php

@@ -41,7 +41,7 @@ public function index(Request $request): Response|RedirectResponse
             return redirect()->route('app.workspaces.create');
         }
 
-        $this->authorize('view', $workspace);
+        $this->authorize('manageAccounts', $workspace);
 
         $platforms = collect(SocialPlatform::enabled())->map(fn ($platform) => [
             'value' => $platform->value,

app/Policies/AutomationPolicy.php

@@ -21,17 +21,20 @@ public function view(User $user, Automation $automation): bool
 
     public function create(User $user): bool
     {
-        return $user->currentWorkspace !== null;
+        return $user->currentWorkspace !== null
+            && $user->can('createPost', $user->currentWorkspace);
     }
 
     public function update(User $user, Automation $automation): bool
     {
-        return $automation->workspace_id === $user->current_workspace_id;
+        return $automation->workspace_id === $user->current_workspace_id
+            && $user->can('createPost', $user->currentWorkspace);
     }
 
     public function delete(User $user, Automation $automation): bool
     {
-        return $automation->workspace_id === $user->current_workspace_id;
+        return $automation->workspace_id === $user->current_workspace_id
+            && $user->can('createPost', $user->currentWorkspace);
     }
 
     public function activate(User $user, Automation $automation): bool

app/Policies/PostPolicy.php

@@ -25,27 +25,29 @@ public function view(User $user, Post $post): bool|Response
     }
 
     /**
-     * Authorize updating a post. Same workspace-tenancy guard as `view`.
+     * Authorize updating a post: tenancy guard (404 across tenants) then the
+     * role gate — viewers are read-only (403).
      */
     public function update(User $user, Post $post): bool|Response
     {
         if ($post->workspace_id !== $user->current_workspace_id) {
             return Response::denyAsNotFound();
         }
 
-        return true;
+        return $user->can('createPost', $user->currentWorkspace);
     }
 
     /**
-     * Authorize deleting a post. Same workspace-tenancy guard as `view`.
+     * Authorize deleting a post: tenancy guard (404 across tenants) then the
+     * same role gate as `update` — viewers are read-only (403).
      */
     public function delete(User $user, Post $post): bool|Response
     {
         if ($post->workspace_id !== $user->current_workspace_id) {
             return Response::denyAsNotFound();
         }
 
-        return true;
+        return $user->can('createPost', $user->currentWorkspace);
     }
 
     /**

lang/en/posts.php

@@ -388,6 +388,7 @@
         ],
 
         'status' => [
+            'pending' => 'Pending',
             'scheduled' => 'Scheduled',
             'published' => 'Published',
             'publishing' => 'Publishing...',

lang/en/sidebar.php

@@ -24,7 +24,7 @@
     'groups' => [
         'posts' => 'Posts',
         'workspace' => 'Workspace',
-        'support' => 'Support',
+        'others' => 'Others',
     ],
 
     'analytics' => 'Analytics',
@@ -54,9 +54,8 @@
     'no_notifications' => 'No notifications',
 
     'support' => [
-        'discord' => 'Discord',
-        'share_feedback' => 'Share feedback',
-        'last_updates' => 'Last Updates',
         'docs' => 'Documentation',
+        'referral' => 'Earn 30% referral',
+        'stay_updated' => 'Stay updated',
     ],
 ];

lang/es/posts.php

@@ -388,6 +388,7 @@
         ],
 
         'status' => [
+            'pending' => 'Pendiente',
             'scheduled' => 'Programado',
             'published' => 'Publicado',
             'publishing' => 'Publicando...',

lang/es/sidebar.php

@@ -24,7 +24,7 @@
     'groups' => [
         'posts' => 'Posts',
         'workspace' => 'Workspace',
-        'support' => 'Soporte',
+        'others' => 'Otros',
     ],
 
     'analytics' => 'Analytics',
@@ -54,9 +54,8 @@
     'no_notifications' => 'Sin notificaciones',
 
     'support' => [
-        'discord' => 'Discord',
-        'share_feedback' => 'Dar feedback',
-        'last_updates' => 'Últimas actualizaciones',
         'docs' => 'Documentación',
+        'referral' => 'Gana 30% de comisión',
+        'stay_updated' => 'Mantente al día',
     ],
 ];