snapshot of https://github.com/krayin/laravel-crm.git (2.2, 2026-09-18; blobs > 131072B omitted)

packages/Webkul/Admin/src/Http/Middleware/Bouncer.php

@@ -0,0 +1,191 @@
+<?php
+
+namespace Webkul\Admin\Http\Middleware;
+
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Route;
+
+class Bouncer
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  Request  $request
+     * @param  string|null  $guard
+     * @return mixed
+     */
+    public function handle($request, \Closure $next, $guard = 'user')
+    {
+        if (! auth()->guard($guard)->check()) {
+            return redirect()->route('admin.session.create');
+        }
+
+        /**
+         * If user status is changed by admin. Then session should be
+         * logged out.
+         */
+        if (! (bool) auth()->guard($guard)->user()->status) {
+            $this->terminateSession($guard);
+
+            return redirect()->route('admin.session.create');
+        }
+
+        /**
+         * If somehow the user deleted all permissions, then it should be
+         * auto logged out and need to contact the administrator again.
+         */
+        if ($this->isPermissionsEmpty()) {
+            $this->terminateSession($guard);
+
+            return redirect()->route('admin.session.create');
+        }
+
+        return $next($request);
+    }
+
+    /**
+     * Log the user out and tear the session down, then flash the reason.
+     *
+     * The session is invalidated and its token rotated so nothing the revoked
+     * session held survives; the message is flashed afterwards because
+     * invalidating would otherwise discard it.
+     */
+    protected function terminateSession($guard): void
+    {
+        auth()->guard($guard)->logout();
+
+        session()->invalidate();
+
+        session()->regenerateToken();
+
+        session()->flash('error', trans('admin::app.errors.401'));
+    }
+
+    /**
+     * Check for user, if they have empty permissions or not except admin.
+     *
+     * @return bool
+     */
+    public function isPermissionsEmpty()
+    {
+        if (! $role = auth()->guard('user')->user()->role) {
+            abort(401, 'This action is unauthorized.');
+        }
+
+        if ($role->permission_type === 'all') {
+            return false;
+        }
+
+        if ($role->permission_type !== 'all' && empty($role->permissions)) {
+            return true;
+        }
+
+        $this->checkIfAuthorized();
+
+        return false;
+    }
+
+    /**
+     * Check authorization.
+     *
+     * The middleware fails closed: an administrative route that is not covered by the ACL map is
+     * denied rather than allowed. A route without its own mapping inherits the permission of the
+     * nearest mapped ancestor feature (so, for example, an unmapped `admin.leads.search` still
+     * requires the `leads` permission), while a small allow-list covers authentication, self-service
+     * account management, and generic UI helpers that expose no privileged data.
+     *
+     * @return void
+     */
+    public function checkIfAuthorized()
+    {
+        $routeName = Route::currentRouteName();
+
+        if (! $routeName) {
+            return;
+        }
+
+        $roles = acl()->getRoles();
+
+        /**
+         * Exact ACL mapping.
+         */
+        if (isset($roles[$routeName])) {
+            bouncer()->allow($roles[$routeName]);
+
+            return;
+        }
+
+        /**
+         * Public and self-service routes that any authenticated user may reach.
+         */
+        if ($this->isAllowlistedRoute($routeName)) {
+            return;
+        }
+
+        /**
+         * Fail closed: authorize against the nearest mapped ancestor feature, otherwise deny.
+         */
+        if (! $this->isAuthorizedByFeature($routeName, $roles)) {
+            abort(401, 'This action is unauthorized.');
+        }
+    }
+
+    /**
+     * Routes every authenticated user may reach regardless of their role — authentication,
+     * self-service account management, and generic UI helpers exposing no privileged data.
+     */
+    protected function isAllowlistedRoute(string $routeName): bool
+    {
+        return in_array($routeName, [
+            'admin.session.create',
+            'admin.session.store',
+            'admin.session.destroy',
+            'admin.forgot_password.create',
+            'admin.forgot_password.store',
+            'admin.reset_password.create',
+            'admin.reset_password.store',
+            'admin.user.account.edit',
+            'admin.user.account.update',
+            'admin.datagrid.look_up',
+            'admin.datagrid.saved_filters.index',
+            'admin.datagrid.saved_filters.store',
+            'admin.datagrid.saved_filters.update',
+            'admin.datagrid.saved_filters.destroy',
+            'admin.tinymce.upload',
+            'admin.settings.web_forms.form_js',
+            'admin.settings.web_forms.form_store',
+            'admin.settings.web_forms.preview',
+            'admin.mail.inbound_parse',
+        ], true);
+    }
+
+    /**
+     * Authorize an unmapped route against the permission of its nearest mapped ancestor feature.
+     * Walks up the dotted route name until a mapped feature is found, then requires the user to hold
+     * at least one permission within that feature.
+     */
+    protected function isAuthorizedByFeature(string $routeName, $roles): bool
+    {
+        $segments = explode('.', $routeName);
+
+        while (count($segments) > 2) {
+            array_pop($segments);
+
+            $prefix = implode('.', $segments).'.';
+
+            $featureKeys = collect($roles)
+                ->filter(fn ($key, $route) => str_starts_with($route, $prefix))
+                ->values();
+
+            if ($featureKeys->isEmpty()) {
+                continue;
+            }
+
+            $user = auth()->guard('user')->user();
+
+            return $featureKeys->contains(fn ($key) => $user->hasPermission($key));
+        }
+
+        return false;
+    }
+}