StarMC/Astral-nook
StarMC/Astral-nook
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Always return the primary allocation for a server, even without the allocation permissions

Browse source
This commit is contained in:
Dane Everitt 2020-11-07 09:57:53 -08:00
parent f99ac0ecde
commit c20d53bb17
No known key found for this signature in database
GPG key ID: EEA66103B3D71F53
3 changed files with 43 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

2
app/Models/Permission.php
View file

@ -163,7 +163,7 @@ class Permission extends Model
'allocation' => [
'description' => 'Permissions that control a user\'s ability to modify the port allocations for this server.',
'keys' => [
'read' => 'Allows a user to view the allocations assigned to this server.',
'read' => 'Allows a user to view all allocations currently assigned to this server. Users with any level of access to this server can always view the primary allocation.',
'create' => 'Allows a user to assign additional allocations to the server.',
'update' => 'Allows a user to change the primary server allocation and attach notes to each allocation.',
'delete' => 'Allows a user to delete an allocation from the server.',

20
app/Transformers/Api/Client/ServerTransformer.php
View file

@ -83,15 +83,23 @@ class ServerTransformer extends BaseClientTransformer
*/
public function includeAllocations(Server $server)
{
$transformer = $this->makeTransformer(AllocationTransformer::class);
// While we include this permission, we do need to actually handle it slightly different here
// for the purpose of keeping things functionally working. If the user doesn't have read permissions
// for the allocations we'll only return the primary server allocation, and any notes associated
// with it will be hidden.
//
// This allows us to avoid too much permission regression, without also hiding information that
// is generally needed for the frontend to make sense when browsing or searching results.
if (! $this->getUser()->can(Permission::ACTION_ALLOCATION_READ, $server)) {
return $this->null();
$primary = clone $server->allocation;
$primary->notes = null;
return $this->collection([$primary], $transformer, Allocation::RESOURCE_NAME);
}
return $this->collection(
$server->allocations,
$this->makeTransformer(AllocationTransformer::class),
Allocation::RESOURCE_NAME
);
return $this->collection($server->allocations, $transformer, Allocation::RESOURCE_NAME);
}
/**