mirror of
https://github.com/projectsend/projectsend.git
synced 2026-09-17 00:55:07 +00:00
denkfabrik-li
28e18497b5
ProfileController::destroy() validates current_password and soft-deletes. It never asks StaffAccounts::guardLastAdministrator(), and every other door does: Staff update(), guardDeletable(), and both directions of the role conversion. This is the one door where the account being removed is certainly signed in. An installation with a single administrator therefore had a button that emptied it. Measured on main: DELETE /settings/profile 302, the account is gone live staff rows 0 (the row is trashed, not removed) anonymous GET / 302 -> /setup anonymous POST /setup a new active System Administrator EnsureSetupIsComplete asks ->exists(), which excludes trashed rows, and routes/web.php registers GET and POST setup with no auth and no guest middleware -- correctly, since a fresh installation has nobody to authenticate. SetupController::store() re-checks the same condition, so both halves agreed with each other and both were wrong once the last staff row was trashed. Two locks, because one of them is asked at five doors and the other at one. First: destroy() now asks guardLastAdministrator(), the same call with the same message as everywhere else. An administrator with a colleague still goes, a non-administrator staff member still goes, and a client still closes their own account. Second: "has this installation been set up" is not the same question as "does it have a working administrator right now", and only the first one belongs in EnsureSetupIsComplete. A trashed staff row is still evidence that setup happened, so it now counts -- in the middleware and in SetupController::setupIsComplete(), which have to agree or the result is either a redirect loop or an open form. That second lock holds even if a future door forgets the first one. Measured with the guard bypassed entirely and the row trashed directly: GET / answers with the login screen and POST /setup creates nothing. Worth stating plainly: an installation that has already lost its last administrator will now find setup shut rather than open. That is the point -- the recovery path for it is `php artisan projectsend:admin`, which is also how every unattended container installs itself, not a form that anybody on the internet can reach. Six tests, two measured red against the unfixed code (2 failed / 4 passed) -- one per lock. The other four are the boundaries: a colleague present, a staff member who is not an administrator, a client, and a genuinely fresh installation that must still reach setup. Two existing tests needed saying more clearly rather than changing: ProfileUpdateTest's deletion cases now create a second administrator, so that what they assert is self-deletion and not this new refusal; and GettingStartedTest's "fresh installation" cases forceDelete rather than delete, because a soft-deleted staff row is no longer a fresh installation -- which is the whole of the second lock. Full suite passes (2054 passed / 2 skipped), PHPStan level 8 clean.
45 lines
1.6 KiB
PHP
45 lines
1.6 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Modules\Identity\Http\Middleware;
|
|
|
|
use App\Models\User;
|
|
use App\Modules\Identity\UserType;
|
|
use App\Support\WriteSafeRedirect;
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
/**
|
|
* A fresh install has no staff user; until one exists every request is
|
|
* sent to the first-run setup screen. The database is the only source of
|
|
* truth — no install flags. Client accounts do not count: setup is about
|
|
* having an administrator.
|
|
*
|
|
* Trashed staff count. "Has this installation been set up" is not the
|
|
* same question as "does it have a working administrator right now", and
|
|
* only the first one belongs here: a soft-deleted staff row is still
|
|
* evidence that setup happened, and an installation that has lost its
|
|
* last administrator needs a recovery path, not a stranger filling in
|
|
* the first-run form. Deleting a staff account is guarded against
|
|
* reaching zero (StaffAccounts::guardLastAdministrator), so this is the
|
|
* second lock rather than the first — but the first one is asked at five
|
|
* separate doors, and this one is asked once.
|
|
*/
|
|
class EnsureSetupIsComplete
|
|
{
|
|
public function handle(Request $request, Closure $next): Response
|
|
{
|
|
if ($request->routeIs('setup', 'setup.store', 'locale.update')) {
|
|
return $next($request);
|
|
}
|
|
|
|
if (User::query()->withTrashed()->where('type', UserType::Staff)->exists()) {
|
|
return $next($request);
|
|
}
|
|
|
|
return WriteSafeRedirect::apply($request, redirect()->route('setup'));
|
|
}
|
|
}
|