Merge pull request #749 from code16/authorizations-checks

aguingand · web-flow · commit aa3e58cbd974 · 2026-07-16T19:54:47.000+02:00
Add more entity checks
diff --git a/src/Http/Controllers/Api/ApiFilterAutocompleteController.php b/src/Http/Controllers/Api/ApiFilterAutocompleteController.php
@@ -11,6 +11,8 @@ class ApiFilterAutocompleteController extends Controller
 {
     public function index(string $globalFilter, EntityKey $entityKey, string $filterHandlerKey): array
     {
+        $this->authorizationManager->check('entity', $entityKey);
+
         $entity = $this->entityManager->entityFor($entityKey);
 
         if ($entity instanceof SharpDashboardEntity) {
diff --git a/src/Http/Controllers/Api/ApiFormAutocompleteController.php b/src/Http/Controllers/Api/ApiFormAutocompleteController.php
@@ -18,7 +18,7 @@ class ApiFormAutocompleteController extends Controller
 
     public function index(string $globalFilter, EntityKey $entityKey, string $autocompleteFieldKey)
     {
-        $fieldContainer = $this->getFieldContainer($entityKey);
+        $fieldContainer = $this->getFieldContainer($entityKey, isUpdate: false);
         $field = $fieldContainer->findFieldByKey($autocompleteFieldKey);
 
         if ($field === null) {
diff --git a/src/Http/Controllers/Api/ApiFormRefreshController.php b/src/Http/Controllers/Api/ApiFormRefreshController.php
@@ -11,7 +11,7 @@ class ApiFormRefreshController extends Controller
 
     public function update(string $globalFilter, EntityKey $entityKey)
     {
-        $fieldContainer = $this->getFieldContainer($entityKey);
+        $fieldContainer = $this->getFieldContainer($entityKey, isUpdate: false);
 
         return response()->json([
             'form' => [
diff --git a/src/Http/Controllers/Api/ApiFormUploadController.php b/src/Http/Controllers/Api/ApiFormUploadController.php
@@ -16,8 +16,9 @@ class ApiFormUploadController extends Controller
 
     public function store(string $globalFilter, EntityKey $entityKey, string $uploadFieldKey, FileUtil $fileUtil)
     {
-        $field = $this->getFieldContainer($entityKey)
-            ->findFieldByKey($uploadFieldKey);
+        $container = $this->getFieldContainer($entityKey, isUpdate: true);
+
+        $field = $container->findFieldByKey($uploadFieldKey);
 
         if ($field instanceof SharpFormEditorField) {
             $field = $field->uploadsConfig();
diff --git a/src/Http/Controllers/Api/Commands/ApiDashboardCommandController.php b/src/Http/Controllers/Api/Commands/ApiDashboardCommandController.php
@@ -20,6 +20,8 @@ public function __construct(
 
     public function show(string $globalFilter, string $entityKey, string $commandKey)
     {
+        $this->authorizationManager->check('entity', $entityKey);
+
         $dashboard = $this->entityManager->entityFor($entityKey)->getViewOrFail();
         $dashboard->buildDashboardConfig();
         $dashboard->initQueryParams(request()->query());
@@ -35,6 +37,8 @@ public function show(string $globalFilter, string $entityKey, string $commandKey
 
     public function update(string $globalFilter, string $entityKey, string $commandKey)
     {
+        $this->authorizationManager->check('entity', $entityKey);
+
         $dashboard = $this->entityManager->entityFor($entityKey)->getViewOrFail();
         $dashboard->buildDashboardConfig();
         $dashboard->initQueryParams(request()->input('query'));
diff --git a/src/Http/Controllers/Api/Commands/ApiEntityListEntityCommandController.php b/src/Http/Controllers/Api/Commands/ApiEntityListEntityCommandController.php
@@ -20,6 +20,8 @@ public function __construct(
 
     public function show(string $globalFilter, string $entityKey, string $commandKey)
     {
+        $this->authorizationManager->check('entity', $entityKey);
+
         $list = $this->entityManager->entityFor($entityKey)->getListOrFail();
         $list->buildListConfig();
         $list->initQueryParams(request()->query());
@@ -35,6 +37,8 @@ public function show(string $globalFilter, string $entityKey, string $commandKey
 
     public function update(string $globalFilter, string $entityKey, string $commandKey)
     {
+        $this->authorizationManager->check('entity', $entityKey);
+
         $list = $this->entityManager->entityFor($entityKey)->getListOrFail();
         $list->buildListConfig();
         $list->initQueryParams(request()->input('query'));
diff --git a/src/Http/Controllers/Api/Commands/ApiEntityListEntityStateController.php b/src/Http/Controllers/Api/Commands/ApiEntityListEntityStateController.php
@@ -12,6 +12,8 @@ class ApiEntityListEntityStateController extends Controller
 
     public function update(string $globalFilter, string $entityKey, mixed $instanceId)
     {
+        $this->authorizationManager->check('entity', $entityKey);
+
         $list = $this->entityManager->entityFor($entityKey)->getListOrFail();
         $list->buildListConfig();
         $list->initQueryParams(request()->input('query'));
diff --git a/src/Http/Controllers/Api/Commands/ApiEntityListInstanceCommandController.php b/src/Http/Controllers/Api/Commands/ApiEntityListInstanceCommandController.php
@@ -20,6 +20,8 @@ public function __construct(
 
     public function show(string $globalFilter, string $entityKey, string $commandKey, mixed $instanceId)
     {
+        $this->authorizationManager->check('entity', $entityKey);
+
         $list = $this->entityManager->entityFor($entityKey)->getListOrFail();
         $list->buildListConfig();
         $list->initQueryParams(request()->query());
@@ -38,6 +40,8 @@ public function show(string $globalFilter, string $entityKey, string $commandKey
      */
     public function update(string $globalFilter, string $entityKey, string $commandKey, mixed $instanceId)
     {
+        $this->authorizationManager->check('entity', $entityKey);
+
         $list = $this->entityManager->entityFor($entityKey)->getListOrFail();
         $list->buildListConfig();
         $list->initQueryParams(request()->input('query'));
diff --git a/src/Http/Controllers/Api/Commands/ApiShowEntityStateController.php b/src/Http/Controllers/Api/Commands/ApiShowEntityStateController.php
@@ -13,6 +13,8 @@ class ApiShowEntityStateController extends Controller
 
     public function update(string $globalFilter, string $entityKey, mixed $instanceId = null)
     {
+        $this->authorizationManager->check('view', $entityKey, $instanceId);
+
         $showPage = $this->getShowPage($entityKey, $instanceId);
         $stateHandler = $showPage->entityStateHandler();
 
diff --git a/src/Http/Controllers/Api/Commands/ApiShowInstanceCommandController.php b/src/Http/Controllers/Api/Commands/ApiShowInstanceCommandController.php
@@ -21,6 +21,8 @@ public function __construct(
 
     public function show(string $globalFilter, string $entityKey, string $commandKey, mixed $instanceId = null)
     {
+        $this->authorizationManager->check('view', $entityKey, $instanceId);
+
         $showPage = $this->getShowPage($entityKey, $instanceId);
         $commandHandler = $this->getInstanceCommandHandler($showPage, $commandKey, $instanceId);
 
@@ -33,6 +35,8 @@ public function show(string $globalFilter, string $entityKey, string $commandKey
 
     public function update(string $globalFilter, string $entityKey, string $commandKey, mixed $instanceId = null)
     {
+        $this->authorizationManager->check('view', $entityKey, $instanceId);
+
         $showPage = $this->getShowPage($entityKey, $instanceId);
         $commandHandler = $this->getInstanceCommandHandler($showPage, $commandKey, $instanceId);
 
diff --git a/src/Http/Controllers/Api/HandlesFieldContainer.php b/src/Http/Controllers/Api/HandlesFieldContainer.php
@@ -19,17 +19,21 @@ trait HandlesFieldContainer
     use HandlesEntityCommand;
     use HandlesInstanceCommand;
 
-    private function getFieldContainer(EntityKey $entityKey): SharpFormEditorEmbed|Command|SharpForm
+    private function getFieldContainer(EntityKey $entityKey, bool $isUpdate): SharpFormEditorEmbed|Command|SharpForm
     {
         $requestFieldContainerData = RequestFieldContainerData::from(request()->query());
 
         if ($requestFieldContainerData->embed_key) {
+            $this->authorizationManager->check('entity', $entityKey);
+
             return $this->getEmbedFromKey($requestFieldContainerData->embed_key);
         }
 
         $entity = $this->entityManager->entityFor($entityKey);
 
         if ($commandKey = $requestFieldContainerData->entity_list_command_key) {
+            $this->authorizationManager->check('entity', $entityKey);
+
             if ($requestFieldContainerData->instance_id) {
                 return $this->getInstanceCommandHandler(
                     $entity->getListOrFail(),
@@ -45,6 +49,8 @@ private function getFieldContainer(EntityKey $entityKey): SharpFormEditorEmbed|C
         }
 
         if ($commandKey = $requestFieldContainerData->show_command_key) {
+            $this->authorizationManager->check('view', $entityKey, $requestFieldContainerData->instance_id);
+
             return $this->getInstanceCommandHandler(
                 $entity->getShowOrFail(),
                 $commandKey,
@@ -53,12 +59,28 @@ private function getFieldContainer(EntityKey $entityKey): SharpFormEditorEmbed|C
         }
 
         if ($commandKey = $requestFieldContainerData->dashboard_command_key) {
+            $this->authorizationManager->check('entity', $entityKey);
+
             return $this->getDashboardCommandHandler(
                 $entity->getViewOrFail(),
                 $commandKey
             );
         }
 
+        if ($requestFieldContainerData->instance_id !== null || $entity->isSingle()) {
+            if ($isUpdate) {
+                $this->authorizationManager->check('update', $entityKey, $requestFieldContainerData->instance_id);
+            } else {
+                $this->authorizationManager->check('view', $entityKey, $requestFieldContainerData->instance_id);
+            }
+        } else {
+            if ($isUpdate) {
+                $this->authorizationManager->check('create', $entityKey);
+            } else {
+                $this->authorizationManager->check('entity', $entityKey);
+            }
+        }
+
         return $entity->getFormOrFail($entityKey->multiformKey());
     }
 }
diff --git a/src/Http/Controllers/Api/Requests/EditorUploadFormRequest.php b/src/Http/Controllers/Api/Requests/EditorUploadFormRequest.php
@@ -15,6 +15,6 @@ public function rules(): array
 
     protected function prepareForValidation()
     {
-        $this->merge($this->get('data'));
+        $this->merge($this->input('data'));
     }
 }
diff --git a/tests/Http/Api/ApiFormAutocompleteControllerTest.php b/tests/Http/Api/ApiFormAutocompleteControllerTest.php
@@ -9,6 +9,7 @@
 use Code16\Sharp\Form\Fields\SharpFormListField;
 use Code16\Sharp\Form\Fields\SharpFormTextField;
 use Code16\Sharp\Tests\Fixtures\Entities\PersonEntity;
+use Code16\Sharp\Tests\Fixtures\Entities\SinglePersonEntity;
 use Code16\Sharp\Tests\Fixtures\Sharp\PersonForm;
 use Code16\Sharp\Tests\Fixtures\Sharp\PersonList;
 use Code16\Sharp\Tests\Fixtures\Sharp\PersonShow;
@@ -830,7 +831,9 @@ protected function executeSingle(array $data): array {}
 });
 
 it('allows to call an functional endpoint for a remote autocomplete field in an InstanceCommand of a SingleShow', function () {
-    fakeShowFor('person', new class() extends PersonSingleShow
+    sharp()->config()->declareEntity(SinglePersonEntity::class);
+
+    fakeShowFor(SinglePersonEntity::class, new class() extends PersonSingleShow
     {
         public function getInstanceCommands(): ?array
         {
@@ -867,7 +870,7 @@ protected function executeSingle(array $data): array {}
 
     $this
         ->postJson(route('code16.sharp.api.form.autocomplete.index', [
-            'entityKey' => 'person',
+            'entityKey' => 'single-person',
             'autocompleteFieldKey' => 'autocomplete_field',
             'show_command_key' => 'my-command',
             'endpoint' => '/my/endpoint',
diff --git a/tests/Http/Api/ApiFormUploadControllerTest.php b/tests/Http/Api/ApiFormUploadControllerTest.php
@@ -191,6 +191,8 @@ public function updateContent(array $data = []): array
 }
 
 it('allows to upload a file in an embed', function () {
+    sharp()->config()->declareEntity(PersonEntity::class);
+
     $this
         ->postJson(
             route('code16.sharp.api.form.upload', [

Original file line number	Diff line number	Diff line change
`@@ -11,6 +11,8 @@ class ApiFilterAutocompleteController extends Controller`
`11`	`11`	`{`
`12`	`12`	`public function index(string $globalFilter, EntityKey $entityKey, string $filterHandlerKey): array`
`13`	`13`	`{`
	`14`	`+ $this->authorizationManager->check('entity', $entityKey);`
	`15`	`+`
`14`	`16`	`$entity = $this->entityManager->entityFor($entityKey);`
`15`	`17`
`16`	`18`	`if ($entity instanceof SharpDashboardEntity) {`
Original file line number	Diff line number	Diff line change
`@@ -18,7 +18,7 @@ class ApiFormAutocompleteController extends Controller`
`18`	`18`
`19`	`19`	`public function index(string $globalFilter, EntityKey $entityKey, string $autocompleteFieldKey)`
`20`	`20`	`{`
`21`		`- $fieldContainer = $this->getFieldContainer($entityKey);`
	`21`	`+ $fieldContainer = $this->getFieldContainer($entityKey, isUpdate: false);`
`22`	`22`	`$field = $fieldContainer->findFieldByKey($autocompleteFieldKey);`
`23`	`23`
`24`	`24`	`if ($field === null) {`
Original file line number	Diff line number	Diff line change
`@@ -11,7 +11,7 @@ class ApiFormRefreshController extends Controller`
`11`	`11`
`12`	`12`	`public function update(string $globalFilter, EntityKey $entityKey)`
`13`	`13`	`{`
`14`		`- $fieldContainer = $this->getFieldContainer($entityKey);`
	`14`	`+ $fieldContainer = $this->getFieldContainer($entityKey, isUpdate: false);`
`15`	`15`
`16`	`16`	`return response()->json([`
`17`	`17`	`'form' => [`
Original file line number	Diff line number	Diff line change
`@@ -12,6 +12,8 @@ class ApiEntityListEntityStateController extends Controller`
`12`	`12`
`13`	`13`	`public function update(string $globalFilter, string $entityKey, mixed $instanceId)`
`14`	`14`	`{`
	`15`	`+ $this->authorizationManager->check('entity', $entityKey);`
	`16`	`+`
`15`	`17`	`$list = $this->entityManager->entityFor($entityKey)->getListOrFail();`
`16`	`18`	`$list->buildListConfig();`
`17`	`19`	`$list->initQueryParams(request()->input('query'));`
Original file line number	Diff line number	Diff line change
`@@ -13,6 +13,8 @@ class ApiShowEntityStateController extends Controller`
`13`	`13`
`14`	`14`	`public function update(string $globalFilter, string $entityKey, mixed $instanceId = null)`
`15`	`15`	`{`
	`16`	`+ $this->authorizationManager->check('view', $entityKey, $instanceId);`
	`17`	`+`
`16`	`18`	`$showPage = $this->getShowPage($entityKey, $instanceId);`
`17`	`19`	`$stateHandler = $showPage->entityStateHandler();`
`18`	`20`
Original file line number	Diff line number	Diff line change
`@@ -21,6 +21,8 @@ public function __construct(`
`21`	`21`
`22`	`22`	`public function show(string $globalFilter, string $entityKey, string $commandKey, mixed $instanceId = null)`
`23`	`23`	`{`
	`24`	`+ $this->authorizationManager->check('view', $entityKey, $instanceId);`
	`25`	`+`
`24`	`26`	`$showPage = $this->getShowPage($entityKey, $instanceId);`
`25`	`27`	`$commandHandler = $this->getInstanceCommandHandler($showPage, $commandKey, $instanceId);`
`26`	`28`
`@@ -33,6 +35,8 @@ public function show(string $globalFilter, string $entityKey, string $commandKey`
`33`	`35`
`34`	`36`	`public function update(string $globalFilter, string $entityKey, string $commandKey, mixed $instanceId = null)`
`35`	`37`	`{`
	`38`	`+ $this->authorizationManager->check('view', $entityKey, $instanceId);`
	`39`	`+`
`36`	`40`	`$showPage = $this->getShowPage($entityKey, $instanceId);`
`37`	`41`	`$commandHandler = $this->getInstanceCommandHandler($showPage, $commandKey, $instanceId);`
`38`	`42`