From 987639fefa41834c7899650cb101bf98ea2c94d4 Mon Sep 17 00:00:00 2001 From: Jasper Smet Date: Fri, 13 Nov 2026 11:26:27 +0100 Subject: [PATCH 1/6] Add admin backend for users and featured plugins --- README.md | 60 ++++- composer.json | 7 +- composer.lock | 94 +++++++- .../20261113090000_AddUserAccess.php | 18 ++ .../20261113090100_AddFeaturedPlugins.php | 52 ++++ config/Migrations/schema-dump-default.lock | Bin 14829 -> 19786 bytes config/app.php | 15 -- config/plugins.php | 2 + phpcs.xml | 1 + phpstan.neon | 1 + phpunit.xml.dist | 1 + playwright.config.js | 2 +- plugins/Admin/src/AdminPlugin.php | 25 ++ .../Admin/src/Controller/AppController.php | 24 ++ .../Controller/FeaturedPluginsController.php | 14 ++ .../Admin/src/Controller/UsersController.php | 24 ++ plugins/Admin/src/Island/AdminIsland.php | 24 ++ .../src/Island/FeaturedPluginsIsland.php | 226 ++++++++++++++++++ plugins/Admin/src/Island/UsersIsland.php | 155 ++++++++++++ .../Admin/templates/FeaturedPlugins/index.php | 5 + plugins/Admin/templates/Users/index.php | 5 + plugins/Admin/templates/element/feedback.php | 22 ++ plugins/Admin/templates/element/paging.php | 10 + .../templates/island/featured_plugins.php | 134 +++++++++++ plugins/Admin/templates/island/users.php | 104 ++++++++ plugins/Admin/templates/layout/admin.php | 62 +++++ .../Controller/AdminControllerTest.php | 72 ++++++ .../TestCase/Island/AdminIslandsTest.php | 140 +++++++++++ resources/css/style.css | 1 + resources/js/app.js | 9 + src/Application.php | 29 ++- src/Command/CleanCommand.php | 3 +- src/Command/UsersCommand.php | 62 +++++ src/Island/FeaturedPluginsIsland.php | 11 +- src/Middleware/AdminAccessMiddleware.php | 37 +++ src/Middleware/RefreshIdentityMiddleware.php | 39 +++ src/Model/Entity/FeaturedPlugin.php | 26 ++ src/Model/Entity/User.php | 4 + src/Model/Enum/FeaturedPluginStatus.php | 24 ++ src/Model/Enum/UserRole.php | 15 ++ src/Model/Enum/UserStatus.php | 23 ++ src/Model/Table/FeaturedPluginsTable.php | 62 +++++ src/Model/Table/UsersTable.php | 20 ++ src/Policy/RequestPolicy.php | 35 +++ src/Service/UserAccessService.php | 60 +++++ templates/element/navbar.php | 8 + templates/island/featured_plugins.php | 6 +- tests/Fixture/FeaturedPluginsFixture.php | 22 ++ tests/Fixture/UsersFixture.php | 22 ++ tests/TestCase/Command/UsersCommandTest.php | 57 +++++ .../Controller/PackagesControllerTest.php | 4 +- tests/TestCase/Island/CatalogueIslandTest.php | 10 +- .../Island/FeaturedPluginsIslandTest.php | 56 ++--- tests/TestCase/Model/Table/UsersTableTest.php | 62 +++++ .../Service/UserAccessServiceTest.php | 56 +++++ tests/browser/admin-state.php | 44 ++++ tests/browser/admin.spec.js | 155 ++++++++++++ tests/browser/setup.php | 12 + 58 files changed, 2185 insertions(+), 88 deletions(-) create mode 100644 config/Migrations/20261113090000_AddUserAccess.php create mode 100644 config/Migrations/20261113090100_AddFeaturedPlugins.php create mode 100644 plugins/Admin/src/AdminPlugin.php create mode 100644 plugins/Admin/src/Controller/AppController.php create mode 100644 plugins/Admin/src/Controller/FeaturedPluginsController.php create mode 100644 plugins/Admin/src/Controller/UsersController.php create mode 100644 plugins/Admin/src/Island/AdminIsland.php create mode 100644 plugins/Admin/src/Island/FeaturedPluginsIsland.php create mode 100644 plugins/Admin/src/Island/UsersIsland.php create mode 100644 plugins/Admin/templates/FeaturedPlugins/index.php create mode 100644 plugins/Admin/templates/Users/index.php create mode 100644 plugins/Admin/templates/element/feedback.php create mode 100644 plugins/Admin/templates/element/paging.php create mode 100644 plugins/Admin/templates/island/featured_plugins.php create mode 100644 plugins/Admin/templates/island/users.php create mode 100644 plugins/Admin/templates/layout/admin.php create mode 100644 plugins/Admin/tests/TestCase/Controller/AdminControllerTest.php create mode 100644 plugins/Admin/tests/TestCase/Island/AdminIslandsTest.php create mode 100644 src/Command/UsersCommand.php create mode 100644 src/Middleware/AdminAccessMiddleware.php create mode 100644 src/Middleware/RefreshIdentityMiddleware.php create mode 100644 src/Model/Entity/FeaturedPlugin.php create mode 100644 src/Model/Enum/FeaturedPluginStatus.php create mode 100644 src/Model/Enum/UserRole.php create mode 100644 src/Model/Enum/UserStatus.php create mode 100644 src/Model/Table/FeaturedPluginsTable.php create mode 100644 src/Policy/RequestPolicy.php create mode 100644 src/Service/UserAccessService.php create mode 100644 tests/Fixture/FeaturedPluginsFixture.php create mode 100644 tests/Fixture/UsersFixture.php create mode 100644 tests/TestCase/Command/UsersCommandTest.php create mode 100644 tests/TestCase/Model/Table/UsersTableTest.php create mode 100644 tests/TestCase/Service/UserAccessServiceTest.php create mode 100644 tests/browser/admin-state.php create mode 100644 tests/browser/admin.spec.js diff --git a/README.md b/README.md index 58c6cef7..01ab04d6 100644 --- a/README.md +++ b/README.md @@ -99,21 +99,59 @@ in `Packages.awesomeAliases` in `config/app.php`: Both importers and the Markdown parser are registered in `Application::services()`. The console command receives its importers through CakePHP's container. -## Featured plugin logos +## Administration -Set an optional logo URL or image path alongside the package name in -`Packages.featured` in `config/app.php`: +The local `Admin` plugin provides `/admin/users` and `/admin/featured-plugins`. +It reuses GitHub sign-in, the public theme preference, and Interact's standard +update endpoint. Every admin island checks current authorization on every request. +The plugin owns the admin interface; shared models, migrations, and access services +remain in the application. -```php -'featured' => [ - 'cakedc/users' => ['logo' => '/img/plugins/users.svg'], - 'vendor/plugin' => ['logo' => 'https://example.com/plugin-logo.png'], - 'friendsofcake/crud' => ['logo' => null], -], +Apply the application migrations, sign in with GitHub once, then promote that +existing account from the console: + +```bash +ddev exec bin/cake migrations migrate +ddev exec bin/cake users your-github-username --role admin --active yes +``` + +New and existing accounts default to active users. The `users` command without +flags prompts for role and active status. Explicit flags also support suspension +and reactivation: + +```bash +ddev exec bin/cake users some-user --active no +ddev exec bin/cake users some-user --active yes +ddev exec bin/cake users some-user --role user ``` -A null or broken logo falls back to the name-based emblem. Each entry can hold -additional metadata alongside `logo` as needed. +Admins can search/filter users and change their role or suspend/reactivate access. +The interface prevents self-demotion and self-suspension, and both the console and +interface preserve the last active admin. Role/status changes take effect on the +next request in existing sessions. Suspended accounts may still browse anonymously. +Roles use CakePHP's ORM-backed `UserRole` enum. Status labels and filter options +come from shared enums; active/enabled flags remain booleans. + +### Featured plugins + +Manage featured selections in the admin interface. Entries have an enabled flag, +optional logo, and optional plain-text title/description overrides. The homepage +randomly displays up to three enabled entries that exist in the catalogue. Blank +overrides use imported package values. Logos accept HTTPS URLs or local `/img/` +paths; missing or broken logos use a name-based emblem. +All featured table data columns support sorting, including catalogue stars and +downloads. Sorting and filters update through Interact without a page reload. + +The migration preserves the previous configured selections once. Configuration +then lives exclusively in the database. Package synchronization and cleanup leave +editorial settings intact; missing packages are marked unavailable in admin. + +### Admin browser tests + +The Playwright suite includes admin access, user management, featured-card editing, +theme, and mobile navigation checks. Test identities are created by a CLI-only +fixture helper against `tmp/browser.sqlite`, with sessions in `tmp/browser-sessions`. +No application login bypass is installed. ## Get social auth working diff --git a/composer.json b/composer.json index 85f4bc63..878c34fc 100644 --- a/composer.json +++ b/composer.json @@ -8,12 +8,13 @@ "php": "^8.5", "admad/cakephp-social-auth": "^2.2", "cakephp/authentication": "^4.0", + "cakephp/authorization": "^3.0", "cakephp/cakephp": "5.4.*", "cakephp/migrations": "^5.0.0", "cakephp/plugin-installer": "^2.0", "dereuromark/cakephp-tags": "^3.0", "friendsofcake/search": "^7.5", - "josbeir/cakephp-interact": "^0.2", + "josbeir/cakephp-interact": "^0.2.1", "josbeir/cakephp-vite": "^0.1.4", "knplabs/packagist-api": "^3.0", "league/commonmark": "^2.7", @@ -36,12 +37,14 @@ }, "autoload": { "psr-4": { - "App\\": "src/" + "App\\": "src/", + "Admin\\": "plugins/Admin/src/" } }, "autoload-dev": { "psr-4": { "App\\Test\\": "tests/", + "Admin\\Test\\": "plugins/Admin/tests/", "Cake\\Test\\": "vendor/cakephp/cakephp/tests/" } }, diff --git a/composer.lock b/composer.lock index 3b2457bd..702f8a3e 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "9df7a35774f30bc92672c7b898254e91", + "content-hash": "09bbbfd9826c6cc598249ab1cd42b51e", "packages": [ { "name": "admad/cakephp-social-auth", @@ -121,6 +121,72 @@ }, "time": "2026-07-08T03:44:13+00:00" }, + { + "name": "cakephp/authorization", + "version": "3.5.3", + "source": { + "type": "git", + "url": "https://github.com/cakephp/authorization.git", + "reference": "6727b15a3006da323c23306d241e15efdca77a9c" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/cakephp/authorization/zipball/6727b15a3006da323c23306d241e15efdca77a9c", + "reference": "6727b15a3006da323c23306d241e15efdca77a9c", + "shasum": "" + }, + "require": { + "cakephp/http": "^5.1", + "php": ">=8.1", + "psr/http-client": "^1.0", + "psr/http-message": "^1.1 || ^2.0", + "psr/http-server-handler": "^1.0", + "psr/http-server-middleware": "^1.0" + }, + "require-dev": { + "cakephp/authentication": "^3.0 || ^4.0", + "cakephp/bake": "^3.2", + "cakephp/cakephp": "^5.1", + "cakephp/cakephp-codesniffer": "^5.1", + "phpunit/phpunit": "^10.5.58 || ^11.5.3 || ^12.4 || ^13.0" + }, + "suggest": { + "cakephp/http": "To use \"RequestPolicyInterface\" (Not needed separately if using full CakePHP framework).", + "cakephp/orm": "To use \"OrmResolver\" (Not needed separately if using full CakePHP framework)." + }, + "type": "cakephp-plugin", + "autoload": { + "psr-4": { + "Authorization\\": "src/" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "CakePHP Community", + "homepage": "https://github.com/cakephp/authorization/graphs/contributors" + } + ], + "description": "Authorization abstraction layer plugin for CakePHP", + "keywords": [ + "access", + "auth", + "authorization", + "cakephp" + ], + "support": { + "docs": "https://cakephp.org/authorization/2/en/", + "forum": "https://stackoverflow.com/tags/cakephp", + "irc": "irc://irc.freenode.org/cakephp", + "issues": "https://github.com/cakephp/authorization/issues", + "source": "https://github.com/cakephp/authorization" + }, + "time": "2026-07-07T14:41:50+00:00", + "published-time": "2026-07-07T14:47:21+00:00" + }, { "name": "cakephp/cakephp", "version": "5.4.4", @@ -1004,16 +1070,16 @@ }, { "name": "josbeir/cakephp-interact", - "version": "0.2.0", + "version": "0.2.1", "source": { "type": "git", "url": "https://github.com/josbeir/cakephp-interact.git", - "reference": "5fb351e15f4d327d8ffc205d395c7f2504a83907" + "reference": "681e4dbf5cd8468c0a3a487b5c239cc7e93b2b07" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/josbeir/cakephp-interact/zipball/5fb351e15f4d327d8ffc205d395c7f2504a83907", - "reference": "5fb351e15f4d327d8ffc205d395c7f2504a83907", + "url": "https://api.github.com/repos/josbeir/cakephp-interact/zipball/681e4dbf5cd8468c0a3a487b5c239cc7e93b2b07", + "reference": "681e4dbf5cd8468c0a3a487b5c239cc7e93b2b07", "shasum": "" }, "require": { @@ -1021,14 +1087,20 @@ "php": "^8.5" }, "require-dev": { + "cakephp/authentication": "^3.0", + "cakephp/authorization": "^3.0", + "cakephp/bake": "^3.8", "cakephp/mago-rules": "dev-main", - "carthage-software/mago": "^1.47", + "carthage-software/mago": "^1.59", "josbeir/cakephp-mercure": "^0.3.1", - "phpunit/phpunit": "^12.5", - "rector/rector": "^2.7", + "phpunit/phpunit": "^12.5 || ^13.0", + "rector/rector": "^2.8.1", "symfony/process": "^8.0" }, "suggest": { + "cakephp/authentication": "Use AuthenticationTrait for direct access to the application's authentication service. Install ^3.0 for CakePHP 5.", + "cakephp/authorization": "Use AuthorizationTrait for optional policy checks and scopes in islands. Install ^3.0 for CakePHP 5.", + "cakephp/bake": "Generate island classes and matching templates with bin/cake bake island. Install as a development dependency.", "josbeir/cakephp-mercure": "Mercure 1.x publishing and subscription authorization with the CakePHP 5 compatible package." }, "type": "cakephp-plugin", @@ -1049,10 +1121,10 @@ "description": "Reactive server-rendered PHP islands for CakePHP.", "support": { "issues": "https://github.com/josbeir/cakephp-interact/issues", - "source": "https://github.com/josbeir/cakephp-interact/tree/0.2.0" + "source": "https://github.com/josbeir/cakephp-interact/tree/0.2.1" }, - "time": "2026-11-07T09:29:14+00:00", - "published-time": "2026-11-07T09:30:27+00:00" + "time": "2026-11-12T10:18:43+00:00", + "published-time": "2026-11-12T10:22:33+00:00" }, { "name": "josbeir/cakephp-vite", diff --git a/config/Migrations/20261113090000_AddUserAccess.php b/config/Migrations/20261113090000_AddUserAccess.php new file mode 100644 index 00000000..aa34ae9d --- /dev/null +++ b/config/Migrations/20261113090000_AddUserAccess.php @@ -0,0 +1,18 @@ +table('users') + ->addColumn('role', 'string', ['limit' => 16, 'default' => 'user']) + ->addColumn('is_active', 'boolean', ['default' => true]) + ->update(); + } +} diff --git a/config/Migrations/20261113090100_AddFeaturedPlugins.php b/config/Migrations/20261113090100_AddFeaturedPlugins.php new file mode 100644 index 00000000..fbb532dd --- /dev/null +++ b/config/Migrations/20261113090100_AddFeaturedPlugins.php @@ -0,0 +1,52 @@ +table('featured_plugins') + ->addColumn('package', 'string', ['limit' => 191]) + ->addColumn('enabled', 'boolean', ['default' => true]) + ->addColumn('logo', 'string', ['limit' => 2048, 'null' => true]) + ->addColumn('title', 'string', ['null' => true]) + ->addColumn('description', 'text', ['null' => true]) + ->addTimestamps('created', 'modified') + ->addIndex(['package'], ['unique' => true]) + ->create(); + $featured = [ + // Optional logo URL or image path; null uses a name-based emblem. + 'cakedc/users' => ['logo' => null], + 'dereuromark/cakephp-ide-helper' => ['logo' => 'https://dereuromark.github.io/cakephp-ide-helper/logo.svg'], + 'dereuromark/cakephp-queue' => ['logo' => 'https://dereuromark.github.io/cakephp-queue/logo.svg'], + 'dereuromark/cakephp-tools' => ['logo' => 'https://dereuromark.github.io/cakephp-tools/logo.svg'], + 'friendsofcake/cakepdf' => ['logo' => null], + 'friendsofcake/crud' => ['logo' => null], + 'friendsofcake/search' => ['logo' => null], + 'josbeir/cakephp-interact' => ['logo' => 'https://www.cakeinteract.dev/docs/branding/interact-mark.svg'], + 'josbeir/cakephp-vite' => ['logo' => null], + 'josegonzalez/cakephp-upload' => ['logo' => null], + 'lordsimal/cakephp-sentry' => ['logo' => null], + 'markstory/asset_compress' => ['logo' => null], + ]; + + $rows = []; + foreach ($featured as $package => $metadata) { + $rows[] = ['package' => $package, 'enabled' => true, 'logo' => $metadata['logo'], 'created' => date('Y-m-d H:i:s')]; + } + $this->table('featured_plugins')->insert($rows)->saveData(); + } + + /** + * Remove only the editorial configuration on rollback. + */ + public function down(): void + { + $this->table('featured_plugins')->drop()->save(); + } +} diff --git a/config/Migrations/schema-dump-default.lock b/config/Migrations/schema-dump-default.lock index 287a5f6d1b69c6e066176692b05d8961577e1e3a..16238958d3cd695c712df84efbc71ddc12d472d0 100644 GIT binary patch delta 1144 zcmaJ=OKTHR7-jO9rV_E_U86RRZA3%O%$VjeL6QnCMBPZRxEgPhX&9VLLMG8}+JNH9 zMM*zbt*ErFT(yj@gxW3y5fO1Ou3Reh2MFFfd32JgZif54&OP6`XMSoQ*C;y@X148H zUN4svm<0(nnsuop)|6&hR^i>qtjC&eqmVw~i&Ib=ZNXRnhF)=uQSim@q$L&2D-z^g z!e~lhI#GK!0CU{5T^2Zf%Qi_llxn#Ov#!iYLST&ZUhI~gO{C#>cojqXVgI}jmi-0S zjKDPH2F4@J-2irD1=tURxe+#l58ziUI+UN&U-MT9$v&dqN}Qn}Z(o5MNgm!X;cTB} ziOFgLj^?XXMM5fxy7b5qYoImivRWoVkI4?hf-j}O80};(vKH|)v4)CwQCSjYwInS9 zie^vzuMM8Lr{H}w2jA#Vy6#=?$@^kxt%AN8%nqyti{l%XrfcD}fuN6^WIIrAPwiN` zUPW%3p>B4C`Qzd7LS6ovs5MYsgPi-)VQE4;IQ2NB2|QM;KU1pSSCuL%8FPVul*nvk zas>)Uk7F6>aoz-AQP0O8QZ}mw%V!sC9IHos7syf%Vg208;fexcWvozKNpW#mY@)5&MO--sZfC63{mmGGxJ0mc% zCZb|PzGqAiB-(p^(@!)(!ICq8SA{hu46WqngaJ?PwYb#`ONs{`Uv-C|m|{ZYsR=Vp tBwrO(OpY}ke6VOJp2*~bn!sVOPEo2LSvfHJv7w4F^C+Ez@AL<1=`XUUmy`ei delta 996 zcmX>#i}7tSbE1{WM&=E|o0qA~W@Ib2GO$uo+MFn=z{qT5YC1VleG*h`av`V4sd=eIi8=AfnM#udU4l0kXjsEcAxcNsWNoeateIA1S$0d? z0?D$v%@cJEkol7x^!Jf#G@oH4l2IU^r%kS96`TA@(R{ML@gp8fE2WhD^1Ph<#FXO6 z4yNXl<#hxmU-glmyvekmtJuoaN~yRcu?Q^10q0!wk)J%>qC%PU)RA#p+K-ID3H?pcOwlcF)O3h2p%u7|W26H^~^737r zKpdcZlJj$N5=%1k^FVwYab!JN&sTc#ck_(RLaO>m9&DN{WVM9Mu$p|#nry9AwsXj{ zHEgn`J-O*-@(qXiz*KE$rDQNkekp4D&e%NL$p [ // Resolve moved or ambiguous Awesome-list repositories to an exact Composer package name. 'awesomeAliases' => [], - 'featured' => [ - // Optional logo URL or image path; null uses a name-based emblem. - 'cakedc/users' => ['logo' => null], - 'dereuromark/cakephp-ide-helper' => ['logo' => 'https://dereuromark.github.io/cakephp-ide-helper/logo.svg'], - 'dereuromark/cakephp-queue' => ['logo' => 'https://dereuromark.github.io/cakephp-queue/logo.svg'], - 'dereuromark/cakephp-tools' => ['logo' => 'https://dereuromark.github.io/cakephp-tools/logo.svg'], - 'friendsofcake/cakepdf' => ['logo' => null], - 'friendsofcake/crud' => ['logo' => null], - 'friendsofcake/search' => ['logo' => null], - 'josbeir/cakephp-interact' => ['logo' => 'https://www.cakeinteract.dev/docs/branding/interact-mark.svg'], - 'josbeir/cakephp-vite' => ['logo' => null], - 'josegonzalez/cakephp-upload' => ['logo' => null], - 'lordsimal/cakephp-sentry' => ['logo' => null], - 'markstory/asset_compress' => ['logo' => null], - ], ], 'CakeVite' => [ diff --git a/config/plugins.php b/config/plugins.php index 0d6d9c5d..8b68b80d 100644 --- a/config/plugins.php +++ b/config/plugins.php @@ -42,5 +42,7 @@ 'Tags', 'ADmad/SocialAuth', 'Authentication', + 'Authorization', + 'Admin', 'IdeHelper' => ['onlyDebug' => true], ]; diff --git a/phpcs.xml b/phpcs.xml index 7b47eea8..b2e04da5 100644 --- a/phpcs.xml +++ b/phpcs.xml @@ -16,4 +16,5 @@ tests/ config/ templates/ + plugins/Admin/ diff --git a/phpstan.neon b/phpstan.neon index 577b36ae..98a30018 100644 --- a/phpstan.neon +++ b/phpstan.neon @@ -7,6 +7,7 @@ parameters: bootstrapFiles: - config/bootstrap.php paths: + - plugins/Admin/ - src/ - config/app.php - templates/ diff --git a/phpunit.xml.dist b/phpunit.xml.dist index 38c7d781..21300dba 100644 --- a/phpunit.xml.dist +++ b/phpunit.xml.dist @@ -14,6 +14,7 @@ tests/TestCase/ + plugins/Admin/tests/TestCase/ diff --git a/playwright.config.js b/playwright.config.js index 3c962aef..ab7fdb2e 100644 --- a/playwright.config.js +++ b/playwright.config.js @@ -8,7 +8,7 @@ export default defineConfig({ use: { baseURL: 'http://127.0.0.1:8765', trace: 'retain-on-failure' }, projects: [{ name: 'chromium', use: { ...devices['Desktop Chrome'] } }], webServer: { - command: 'php tests/browser/setup.php && php -S 127.0.0.1:8765 -t webroot webroot/index.php 2>tmp/browser-server.log', + command: 'php tests/browser/setup.php && php -d session.save_path=tmp/browser-sessions -S 127.0.0.1:8765 -t webroot webroot/index.php 2>tmp/browser-server.log', url: 'http://127.0.0.1:8765', reuseExistingServer: false, env: { diff --git a/plugins/Admin/src/AdminPlugin.php b/plugins/Admin/src/AdminPlugin.php new file mode 100644 index 00000000..78f86bab --- /dev/null +++ b/plugins/Admin/src/AdminPlugin.php @@ -0,0 +1,25 @@ +plugin('Admin', ['path' => '/admin'], function (RouteBuilder $builder): void { + $builder->get('/', ['controller' => 'Users', 'action' => 'home'], 'admin:home'); + $builder->get('/users', ['controller' => 'Users', 'action' => 'index'], 'admin:users'); + $builder->get('/featured-plugins', ['controller' => 'FeaturedPlugins', 'action' => 'index'], 'admin:featured'); + }); + } +} diff --git a/plugins/Admin/src/Controller/AppController.php b/plugins/Admin/src/Controller/AppController.php new file mode 100644 index 00000000..dec3669f --- /dev/null +++ b/plugins/Admin/src/Controller/AppController.php @@ -0,0 +1,24 @@ +loadComponent('Flash'); + $this->loadComponent('Authentication.Authentication'); + $this->viewBuilder()->setClassName(AppView::class)->setLayout('Admin.admin'); + } +} diff --git a/plugins/Admin/src/Controller/FeaturedPluginsController.php b/plugins/Admin/src/Controller/FeaturedPluginsController.php new file mode 100644 index 00000000..45299018 --- /dev/null +++ b/plugins/Admin/src/Controller/FeaturedPluginsController.php @@ -0,0 +1,14 @@ +redirect(['_name' => 'admin:users']); + } + + /** + * The island owns user management interactions. + */ + public function index(): void + { + } +} diff --git a/plugins/Admin/src/Island/AdminIsland.php b/plugins/Admin/src/Island/AdminIsland.php new file mode 100644 index 00000000..2f3fa9d7 --- /dev/null +++ b/plugins/Admin/src/Island/AdminIsland.php @@ -0,0 +1,24 @@ +Authorization->authorize($context->request->withParam('plugin', 'Admin'), 'access'); + } +} diff --git a/plugins/Admin/src/Island/FeaturedPluginsIsland.php b/plugins/Admin/src/Island/FeaturedPluginsIsland.php new file mode 100644 index 00000000..248af3be --- /dev/null +++ b/plugins/Admin/src/Island/FeaturedPluginsIsland.php @@ -0,0 +1,226 @@ + 20, + 'order' => ['FeaturedPlugins.package' => 'asc', 'FeaturedPlugins.id' => 'asc'], + 'sortableFields' => [ + 'package' => 'FeaturedPlugins.package', + 'title' => 'FeaturedPlugins.title', + 'stars' => 'CataloguePackages.stars', + 'downloads' => 'CataloguePackages.downloads', + 'enabled' => 'FeaturedPlugins.enabled', + ], + ], + url: ['page' => 'page', 'sort' => 'sort', 'direction' => 'direction'], + defaults: ['sort' => 'package', 'direction' => 'asc'], + )] + public PaginationState $paging; + + #[State] + public bool $editing = false; + + #[State] + public ?int $editingId = null; + + #[State(writable: true)] + public string $packageSearch = ''; + + #[State] + public string $package = ''; + + #[State(writable: true)] + public bool $enabled = true; + + #[State(writable: true)] + public string $logo = ''; + + #[State(writable: true)] + public string $title = ''; + + #[State(writable: true)] + public string $description = ''; + + #[State] + public ?int $removingId = null; + + #[State] + public string $message = ''; + + /** + * Restart paging when editing list filters. + */ + public function updated(UpdatedPaths $paths): void + { + if ($paths->has('search') || $paths->has('status')) { + $this->paging->page = 1; + } + } + + /** + * Start an empty editorial draft. + */ + #[Action] + public function create(): void + { + $this->editing = true; + $this->editingId = null; + $this->packageSearch = $this->package = $this->logo = $this->title = $this->description = $this->message = ''; + $this->enabled = true; + } + + /** + * Only existing catalogue entries may be selected for a new feature. + */ + #[Action] + public function selectPackage(int $id): void + { + if ($this->editingId !== null || !$this->editing) { + throw new BadRequestException('Start a new featured entry first.'); + } + $this->package = $this->fetchTable(PackagesTable::class)->get($id)->package; + $this->packageSearch = ''; + } + + /** + * Load an existing entry, including entries missing from the catalogue. + */ + #[Action] + public function edit(int $id): void + { + $entry = $this->fetchTable(FeaturedPluginsTable::class)->get($id); + $this->editing = true; + $this->editingId = $id; + $this->package = $entry->package; + $this->enabled = $entry->enabled; + $this->logo = $entry->logo ?? ''; + $this->title = $entry->title ?? ''; + $this->description = $entry->description ?? ''; + $this->packageSearch = $this->message = ''; + } + + /** + * Validate and save plain-text overrides without changing imported metadata. + */ + #[Action] + public function save(): void + { + if (!$this->editing) { + throw new BadRequestException('Open the featured editor first.'); + } + $table = $this->fetchTable(FeaturedPluginsTable::class); + if ($this->editingId === null && !$this->fetchTable(PackagesTable::class)->exists(['package' => $this->package])) { + $this->setErrors(['package' => ['Choose an existing plugin.']]); + + return; + } + $entry = $this->editingId !== null ? $table->get($this->editingId) : $table->newEmptyEntity(); + $entry = $table->patchEntity($entry, [ + 'package' => $this->package, + 'enabled' => $this->enabled, + 'logo' => trim($this->logo) === '' ? null : trim($this->logo), + 'title' => trim($this->title) === '' ? null : trim($this->title), + 'description' => trim($this->description) === '' ? null : trim($this->description), + ]); + if (!$table->save($entry)) { + $this->setErrors($entry->getErrors() ?: ['_form' => ['Unable to save this featured plugin.']]); + + return; + } + $this->cancel(); + $this->message = 'Featured plugin saved.'; + } + + /** + * Discard the draft and any removal confirmation. + */ + #[Action] + public function cancel(): void + { + $this->editing = false; + $this->editingId = $this->removingId = null; + } + + /** + * Load the entry before offering a removal confirmation. + */ + #[Action] + public function confirmRemoval(int $id): void + { + $this->fetchTable(FeaturedPluginsTable::class)->get($id); + $this->removingId = $id; + $this->editing = false; + $this->message = ''; + } + + /** + * Remove only the confirmed editorial entry, never its package. + */ + #[Action] + public function remove(): void + { + if ($this->removingId === null) { + throw new BadRequestException('Confirm removal first.'); + } + $table = $this->fetchTable(FeaturedPluginsTable::class); + $table->deleteOrFail($table->get($this->removingId)); + $this->cancel(); + $this->message = 'Featured plugin removed.'; + } + + /** + * @return array + */ + public function viewData(): array + { + $status = FeaturedPluginStatus::tryFrom($this->status); + if (mb_strlen($this->search) > 100 || mb_strlen($this->packageSearch) > 100 || ($this->status !== '' && $status === null)) { + throw new BadRequestException('Invalid featured plugin filters.'); + } + $table = $this->fetchTable(FeaturedPluginsTable::class); + $query = $table->find()->contain(['CataloguePackages']); + if (trim($this->search) !== '') { + $query->where(['FeaturedPlugins.package LIKE' => '%' . trim($this->search) . '%']); + } + if ($status === FeaturedPluginStatus::Unavailable) { + $query->where(['CataloguePackages.id IS' => null]); + } elseif ($status !== null) { + $query->where(['FeaturedPlugins.enabled' => $status === FeaturedPluginStatus::Enabled]); + } + $packages = $this->fetchTable(PackagesTable::class); + $matches = []; + if ($this->editing && $this->editingId === null && $this->package === '') { + $matches = $packages->find()->select(['id', 'package'])->where(['package LIKE' => '%' . trim($this->packageSearch) . '%']) + ->orderByAsc('package')->limit(10)->all(); + } + + return [ + 'entries' => $this->paginate($query), + 'matches' => $matches, + 'previewLogo' => $this->logo !== '' && $table->getValidator()->validate(['logo' => $this->logo], false) === [] ? $this->logo : null, + 'previewPackage' => $this->editing && $this->package !== '' ? $packages->find()->where(['package' => $this->package])->first() : null, + 'removingEntry' => $this->removingId !== null ? $table->get($this->removingId) : null, + ]; + } +} diff --git a/plugins/Admin/src/Island/UsersIsland.php b/plugins/Admin/src/Island/UsersIsland.php new file mode 100644 index 00000000..d0e9ea90 --- /dev/null +++ b/plugins/Admin/src/Island/UsersIsland.php @@ -0,0 +1,155 @@ + 20, 'order' => ['Users.username' => 'asc']], url: ['page' => 'page'])] + public PaginationState $paging; + + #[State] + public ?int $editingId = null; + + #[State(writable: true)] + public string $role = UserRole::User->value; + + #[State(writable: true)] + public bool $active = true; + + #[State] + public bool $confirming = false; + + #[State] + public string $message = ''; + + /** + * Filters start at page one; all list queries remain server-side. + */ + public function updated(UpdatedPaths $paths): void + { + if ($paths->has('search') || $paths->has('roleFilter') || $paths->has('status')) { + $this->paging->page = 1; + } + if ($paths->has('role') || $paths->has('active')) { + $this->confirming = false; + } + } + + /** + * Load a fresh account into a small editable access draft. + */ + #[Action] + public function edit(int $id): void + { + $user = $this->fetchTable(UsersTable::class)->get($id); + $this->editingId = $id; + $this->role = $user->role->value; + $this->active = $user->is_active; + $this->confirming = false; + $this->message = ''; + } + + /** + * Require a separate confirmation before committing access changes. + */ + #[Action] + public function confirm(): void + { + if ($this->editingId !== null) { + $this->confirming = true; + } + } + + /** + * Revalidate target and actor inside the shared transactional service. + */ + #[Action] + public function save(): void + { + if ($this->editingId === null || !$this->confirming) { + throw new BadRequestException('Confirm the access change first.'); + } + $role = UserRole::tryFrom($this->role); + if ($role === null) { + $this->setErrors(['role' => ['Choose a valid user role.']]); + + return; + } + try { + new UserAccessService($this->fetchTable(UsersTable::class))->update( + $this->editingId, + $role, + $this->active, + (int)$this->getRequest()->getAttribute('identity')->getIdentifier(), + ); + } catch (DomainException $exception) { + $this->setErrors(['_form' => [$exception->getMessage()]]); + + return; + } + $this->cancel(); + $this->message = 'User access updated.'; + } + + /** + * Discard the open access editor. + */ + #[Action] + public function cancel(): void + { + $this->editingId = null; + $this->confirming = false; + } + + /** + * @return array + */ + public function viewData(): array + { + $roleFilter = UserRole::tryFrom($this->roleFilter); + $status = UserStatus::tryFrom($this->status); + if (mb_strlen($this->search) > 100 || ($this->roleFilter !== '' && $roleFilter === null) || ($this->status !== '' && $status === null)) { + throw new BadRequestException('Invalid user filters.'); + } + $table = $this->fetchTable(UsersTable::class); + $query = $table->find(); + if (trim($this->search) !== '') { + $search = '%' . trim($this->search) . '%'; + $query->where(['OR' => ['Users.username LIKE' => $search, 'Users.email LIKE' => $search, 'Users.first_name LIKE' => $search, 'Users.last_name LIKE' => $search]]); + } + if ($roleFilter !== null) { + $query->where(['Users.role' => $roleFilter]); + } + if ($status !== null) { + $query->where(['Users.is_active' => $status === UserStatus::Active]); + } + + return [ + 'users' => $this->paginate($query), + 'editingUser' => $this->editingId !== null ? $table->get($this->editingId) : null, + 'actorId' => (int)$this->getRequest()->getAttribute('identity')->getIdentifier(), + ]; + } +} diff --git a/plugins/Admin/templates/FeaturedPlugins/index.php b/plugins/Admin/templates/FeaturedPlugins/index.php new file mode 100644 index 00000000..d9a1bd90 --- /dev/null +++ b/plugins/Admin/templates/FeaturedPlugins/index.php @@ -0,0 +1,5 @@ +assign('title', __('Featured plugins')); +?> +Interact->render('Admin.FeaturedPlugins'); diff --git a/plugins/Admin/templates/Users/index.php b/plugins/Admin/templates/Users/index.php new file mode 100644 index 00000000..a343132b --- /dev/null +++ b/plugins/Admin/templates/Users/index.php @@ -0,0 +1,5 @@ +assign('title', __('Users')); +?> +Interact->render('Admin.Users'); diff --git a/plugins/Admin/templates/element/feedback.php b/plugins/Admin/templates/element/feedback.php new file mode 100644 index 00000000..ce0c61a1 --- /dev/null +++ b/plugins/Admin/templates/element/feedback.php @@ -0,0 +1,22 @@ +> $errors + * @var string $message + */ +?> + +
+ + + + + + diff --git a/plugins/Admin/templates/element/paging.php b/plugins/Admin/templates/element/paging.php new file mode 100644 index 00000000..d527b59b --- /dev/null +++ b/plugins/Admin/templates/element/paging.php @@ -0,0 +1,10 @@ + +
+

Paginator->counter(__('Page {{page}} of {{pages}} · {{count}} records')) ?>

+ +
diff --git a/plugins/Admin/templates/island/featured_plugins.php b/plugins/Admin/templates/island/featured_plugins.php new file mode 100644 index 00000000..19f14f9c --- /dev/null +++ b/plugins/Admin/templates/island/featured_plugins.php @@ -0,0 +1,134 @@ + $matches + * @var \App\Model\Entity\Package|null $previewPackage + * @var \App\Model\Entity\FeaturedPlugin|null $removingEntry + * @var string $search + * @var string $status + * @var bool $editing + * @var int|null $editingId + * @var string $package + * @var string $packageSearch + * @var bool $enabled + * @var string $logo + * @var string|null $previewLogo + * @var string $title + * @var string $description + * @var string $message + * @var array> $errors + */ +use App\Model\Enum\FeaturedPluginStatus; + +?> +
+
+

+ +
+ element('Admin.feedback', compact('message', 'errors')) ?> +
+ + +
+
+ + + + + + + + + + + + + + + + + + + + +
Paginator->sort('package', __('Plugin')) ?>Paginator->sort('title', __('Featured title')) ?>Paginator->sort('stars', __('GitHub stars')) ?>Paginator->sort('downloads', __('Downloads')) ?>Paginator->sort('enabled', __('Status')) ?>
package) ?>title ?? '—') ?>catalogue_package !== null ? $this->Number->format($entry->catalogue_package->stars) : '—' ?>catalogue_package !== null ? $this->Number->format($entry->catalogue_package->downloads) : '—' ?> + + enabled)->label()) ?> + + catalogue_package === null) : + ?>label()) ?> + + +
+
+ element('Admin.paging') ?> + + +
+

+ element('Admin.feedback', ['message' => '', 'errors' => $errors]) ?> + + + +
    + +
    • + +
+
+ +

+ Form->create(null, ['url' => false, 'x-interact:submit' => '$server.call("save")']) ?> +
+ + + + + + + +

+
+
+

+ element('Packages/plugin-avatar', ['packageName' => $package, 'logo' => $previewLogo, 'plugin' => false]) ?> +

+

description ?? __('Plugin unavailable in the catalogue.'))) ?>

+
+
+ + +
+ Form->end() ?> + +
+ + + + +
+

+

package)) ?>

+
+ + +
+
+ + +
diff --git a/plugins/Admin/templates/island/users.php b/plugins/Admin/templates/island/users.php new file mode 100644 index 00000000..cc285833 --- /dev/null +++ b/plugins/Admin/templates/island/users.php @@ -0,0 +1,104 @@ +> $errors + */ +use App\Model\Enum\UserRole; +use App\Model\Enum\UserStatus; + +?> +
+

+

+ element('Admin.feedback', compact('message', 'errors')) ?> +
+ + + +
+
+ + + + + + + + + + + + + + + + + + +
@username) ?>
first_name . ' ' . $user->last_name)) ?>
email) ?>role->label()) ?>is_active)->label()) ?>created->format('Y-m-d')) ?> + id) : ?> + + + + +
+
+ element('Admin.paging') ?> + + +
+

username)) ?>

+ element('Admin.feedback', ['message' => '', 'errors' => $errors]) ?> + +

label() ?? $role), h(UserStatus::fromActive($active)->label())) ?>

+
+ + +
+ + Form->create(null, ['url' => false, 'x-interact:submit' => '$server.call("confirm")']) ?> +
+ + + +
+
+ + +
+ Form->end() ?> + +
+ + +
diff --git a/plugins/Admin/templates/layout/admin.php b/plugins/Admin/templates/layout/admin.php new file mode 100644 index 00000000..783abff6 --- /dev/null +++ b/plugins/Admin/templates/layout/admin.php @@ -0,0 +1,62 @@ +getRequest()->getCookie('theme') === 'cakephp-dark' ? 'cakephp-dark' : 'cakephp'; +$controller = $this->getRequest()->getParam('controller'); +?> + + + + Html->charset() ?> + + + <?= h($this->fetch('title')) ?> · CakePHP Plugins Admin + Html->meta('icon') ?> + Vite->css(['files' => ['resources/css/style.css'], 'block' => false, 'attributes' => ['x-interact:asset' => 'reload', 'timestamp' => false]]) ?> + Vite->script(['files' => ['resources/js/app.js'], 'block' => false, 'attributes' => ['x-interact:asset' => 'reload', 'timestamp' => false]]) ?> + fetch('script') ?> + + + +
+ +
+
+ + +
+ Interact->render('ThemeToggle', key: 'admin-theme') ?> + + Html->link(__('Sign out'), ['plugin' => false, 'prefix' => false, 'controller' => 'Users', 'action' => 'logout'], ['class' => 'btn btn-ghost btn-sm']) ?> +
+
+
+ Flash->render() ?> + fetch('content') ?> +
+
+
+ + +
+
+ + diff --git a/plugins/Admin/tests/TestCase/Controller/AdminControllerTest.php b/plugins/Admin/tests/TestCase/Controller/AdminControllerTest.php new file mode 100644 index 00000000..31b592bd --- /dev/null +++ b/plugins/Admin/tests/TestCase/Controller/AdminControllerTest.php @@ -0,0 +1,72 @@ +get('/admin/users'); + $this->assertRedirect('/?redirect=%2Fadmin%2Fusers'); + } + + /** + * Signed-in ordinary users receive 403, rather than a login loop. + */ + public function testUserForbidden(): void + { + $this->session(['Auth' => ['id' => 2]]); + $this->get('/admin/users'); + $this->assertResponseCode(403); + } + + /** + * Plugin templates mount islands against Interact's standard endpoint. + */ + public function testAdminPages(): void + { + $this->session(['Auth' => ['id' => 1]]); + $this->get('/admin/users'); + $this->assertResponseOk(); + $this->assertResponseContains('Admin navigation'); + $this->assertResponseContains('/_interact/update'); + $this->assertResponseContains('member@example.com'); + $this->get('/admin/featured-plugins'); + $this->assertResponseOk(); + $this->assertResponseContains('markstory/asset_compress'); + } + + /** + * A previously privileged session is refreshed before policy evaluation. + */ + public function testStaleRoleAndSuspension(): void + { + $this->session(['Auth' => ['id' => 2, 'role' => 'admin', 'is_active' => true]]); + $this->get('/admin/users'); + $this->assertResponseCode(403); + $this->session(['Auth' => ['id' => 3, 'role' => 'admin', 'is_active' => true]]); + $this->get('/admin/users'); + $this->assertRedirect('/?redirect=%2Fadmin%2Fusers'); + } + + /** + * Even authenticated admin updates require CSRF. + */ + public function testCsrf(): void + { + $this->session(['Auth' => ['id' => 1]]); + $this->post('/_interact/update', []); + $this->assertResponseCode(403); + } +} diff --git a/plugins/Admin/tests/TestCase/Island/AdminIslandsTest.php b/plugins/Admin/tests/TestCase/Island/AdminIslandsTest.php new file mode 100644 index 00000000..1b787b86 --- /dev/null +++ b/plugins/Admin/tests/TestCase/Island/AdminIslandsTest.php @@ -0,0 +1,140 @@ + '/admin/users']); + $authorization = new Application(CONFIG)->getAuthorizationService($request); + $identity = $id !== null ? new AuthorizedIdentity($authorization, new Identity($this->fetchTable(UsersTable::class)->get($id))) : null; + + return $request->withAttribute('authorization', $authorization)->withAttribute('identity', $identity); + } + + /** + * Search, confirm and persist both access fields through real island updates. + */ + public function testUserManagement(): void + { + $island = $this->testIsland('Admin.Users', request: $this->adminRequest()); + $island->set('search', 'member')->assertSee('member@example.com')->assertDontSee('suspended@example.com') + ->call('edit', 2)->fill(['role' => 'admin', 'active' => false])->call('confirm')->assertSet('confirming', true) + ->call('save')->assertSee('User access updated.'); + $user = $this->fetchTable(UsersTable::class)->get(2); + $this->assertSame(UserRole::Admin, $user->role); + $this->assertFalse($user->is_active); + } + + /** + * Hiding self-edit controls is backed by server-side enforcement. + */ + public function testSelfEditRejected(): void + { + $this->testIsland('Admin.Users', request: $this->adminRequest())->call('edit', 1) + ->fill(['role' => 'user'])->call('confirm')->call('save')->assertHasErrors(['_form']); + $this->assertSame(UserRole::Admin, $this->fetchTable(UsersTable::class)->get(1)->role); + } + + /** + * Browser state remains scalar and invalid role values cannot reach the service. + */ + public function testInvalidRoleRejected(): void + { + $this->testIsland('Admin.Users', request: $this->adminRequest())->call('edit', 2) + ->set('role', 'owner')->call('confirm')->call('save')->assertHasErrors(['role']); + $this->assertSame(UserRole::User, $this->fetchTable(UsersTable::class)->get(2)->role); + } + + /** + * The standard update endpoint still rechecks current admin access. + */ + public function testRevokedSnapshotDenied(): void + { + $island = $this->testIsland('Admin.FeaturedPlugins', request: $this->adminRequest()); + $this->fetchTable(UsersTable::class)->updateAll(['role' => 'user'], ['id' => 1]); + $this->expectException(ForbiddenException::class); + $island->call('create'); + } + + /** + * Guessing a plugin island name never grants access to guests. + */ + public function testGuestCannotMount(): void + { + $this->expectException(ForbiddenException::class); + $this->testIsland('Admin.Users', request: $this->adminRequest(null)); + } + + /** + * Add, validate, disable and remove entries without package mutation. + */ + public function testFeaturedManagement(): void + { + $table = $this->fetchTable(FeaturedPluginsTable::class); + $island = $this->testIsland('Admin.FeaturedPlugins', request: $this->adminRequest()); + $island->call('create')->set('packageSearch', 'package-01')->assertSee('vendor/package-01')->call('selectPackage', 2) + ->fill(['title' => 'Our pick', 'description' => 'Editorial description', 'logo' => 'javascript:alert(1)'])->call('save')->assertHasErrors(['logo']); + $island->set('logo', '/img/pick.svg')->call('save')->assertSee('Featured plugin saved.'); + $entry = $table->find()->where(['package' => 'vendor/package-01'])->firstOrFail(); + $this->assertSame('Our pick', $entry->title); + $island->call('edit', $entry->id)->set('enabled', false)->call('save'); + $this->assertFalse($table->get($entry->id)->enabled); + $island->call('confirmRemoval', $entry->id)->assertSee('Confirm removal')->call('remove'); + $this->assertFalse($table->exists(['id' => $entry->id])); + } + + /** + * Existing featured packages cannot be added twice. + */ + public function testDuplicateFeaturedEntry(): void + { + $this->testIsland('Admin.FeaturedPlugins', request: $this->adminRequest())->call('create')->call('selectPackage', 1)->call('save')->assertHasErrors(['package']); + } + + /** + * Associated catalogue counts sort numerically through the native paginator. + */ + public function testFeaturedCountSorting(): void + { + $island = $this->testIsland('Admin.FeaturedPlugins', request: $this->adminRequest()); + $island->fill(['paging.sort' => 'stars', 'paging.direction' => 'asc']); + preg_match_all('/data-featured-id="(\d+)"/', $island->result()->html, $matches); + $this->assertSame(['3', '1', '2'], $matches[1]); + $island->fill(['paging.sort' => 'downloads', 'paging.direction' => 'desc']); + preg_match_all('/data-featured-id="(\d+)"/', $island->result()->html, $matches); + $this->assertSame(['3', '2', '1'], $matches[1]); + } + + /** + * Curation remains editable after catalogue deletion. + */ + public function testUnavailableEntry(): void + { + $table = $this->fetchTable(FeaturedPluginsTable::class); + $entry = $table->saveOrFail($table->newEntity(['package' => 'missing/package', 'enabled' => true])); + $this->testIsland('Admin.FeaturedPlugins', request: $this->adminRequest())->set('status', 'unavailable') + ->assertSee('missing/package')->assertDontSee('markstory/asset_compress')->call('edit', $entry->id)->set('enabled', false)->call('save'); + $this->assertFalse($table->get($entry->id)->enabled); + } +} diff --git a/resources/css/style.css b/resources/css/style.css index 8a70f338..582d73e6 100644 --- a/resources/css/style.css +++ b/resources/css/style.css @@ -1,4 +1,5 @@ @import "tailwindcss"; +@source "../../plugins/Admin/templates"; @source not "../../wireframes-plugins.html"; @plugin "daisyui/index.js" { themes: cakephp --default, cakephp-dark; diff --git a/resources/js/app.js b/resources/js/app.js index b6b2043b..a13096fa 100644 --- a/resources/js/app.js +++ b/resources/js/app.js @@ -1,6 +1,15 @@ import 'vite/modulepreload-polyfill' const register = (Alpine) => { + Alpine.data('adminNavigation', () => ({ open: false })) + + Alpine.data('adminDialog', () => ({ + init() { + // Keep the server-rendered open attribute across morphs and enter the native modal layer. + this.$el.removeAttribute('open') + this.$el.showModal() + }, + })) Alpine.store('theme', { dark: document.documentElement.dataset.theme === 'cakephp-dark', apply(event) { diff --git a/src/Application.php b/src/Application.php index 2a1bd3ca..630ee6e2 100644 --- a/src/Application.php +++ b/src/Application.php @@ -20,8 +20,11 @@ use App\Command\SyncPackagesCommand; use App\Event\AfterGithubIdentify; use App\Http\RateLimit\AtomicFixedWindowRateLimiter; +use App\Middleware\AdminAccessMiddleware; +use App\Middleware\RefreshIdentityMiddleware; use App\Middleware\ThemeCookieMiddleware; use App\Model\Table\PackagesTable; +use App\Policy\RequestPolicy; use App\Service\AwesomeListImporter; use App\Service\AwesomeListParser; use App\Service\PackagistImporter; @@ -29,6 +32,11 @@ use Authentication\AuthenticationServiceInterface; use Authentication\AuthenticationServiceProviderInterface; use Authentication\Middleware\AuthenticationMiddleware; +use Authorization\AuthorizationService; +use Authorization\AuthorizationServiceInterface; +use Authorization\AuthorizationServiceProviderInterface; +use Authorization\Middleware\AuthorizationMiddleware; +use Authorization\Policy\MapResolver; use Cake\Core\Configure; use Cake\Core\ContainerInterface; use Cake\Datasource\FactoryLocator; @@ -42,6 +50,7 @@ use Cake\Http\Middleware\CsrfProtectionMiddleware; use Cake\Http\Middleware\RateLimitMiddleware; use Cake\Http\MiddlewareQueue; +use Cake\Http\ServerRequest; use Cake\ORM\Locator\TableLocator; use Cake\Routing\Middleware\AssetMiddleware; use Cake\Routing\Middleware\RoutingMiddleware; @@ -55,7 +64,7 @@ * This defines the bootstrapping logic and middleware layers you * want to use in your application. */ -class Application extends BaseApplication implements AuthenticationServiceProviderInterface +class Application extends BaseApplication implements AuthenticationServiceProviderInterface, AuthorizationServiceProviderInterface { /** * Load all the application configuration and bootstrap logic. @@ -115,8 +124,11 @@ public function middleware(MiddlewareQueue $middlewareQueue): MiddlewareQueue ->add($csrf) ->add(new ThemeCookieMiddleware()) + ->add(new RefreshIdentityMiddleware()) ->add(new SocialAuthMiddleware([ + 'finder' => 'active', + 'loginUrl' => '/', // SocialConnect Auth service's providers config. https://github.com/SocialConnect/auth/blob/master/README.md 'serviceConfig' => [ 'provider' => [ @@ -138,7 +150,9 @@ public function middleware(MiddlewareQueue $middlewareQueue): MiddlewareQueue ], ])) - ->add(new AuthenticationMiddleware($this)); + ->add(new AuthenticationMiddleware($this)) + ->add(new AuthorizationMiddleware($this)) + ->add(new AdminAccessMiddleware()); $requestProtection = (array)Configure::read('PublicRequestProtection', []); $trustedProxyIps = (array)($requestProtection['trustedProxyIps'] ?? []); @@ -241,4 +255,15 @@ public function getAuthenticationService(ServerRequestInterface $request): Authe return $service; } + + /** + * Share request policies between admin routes and island updates. + */ + public function getAuthorizationService(ServerRequestInterface $request): AuthorizationServiceInterface + { + $resolver = new MapResolver(); + $resolver->map(ServerRequest::class, RequestPolicy::class); + + return new AuthorizationService($resolver); + } } diff --git a/src/Command/CleanCommand.php b/src/Command/CleanCommand.php index bee50c2e..aca5d610 100644 --- a/src/Command/CleanCommand.php +++ b/src/Command/CleanCommand.php @@ -3,6 +3,7 @@ namespace App\Command; +use App\Model\Table\PackagesTable; use Cake\Cache\Cache; use Cake\Command\Command; use Cake\Console\Arguments; @@ -58,7 +59,7 @@ public function execute(Arguments $args, ConsoleIo $io): void return; } - $packagesTable = $this->fetchTable('Packages'); + $packagesTable = $this->fetchTable(PackagesTable::class); $allPackages = $packagesTable->find()->all(); foreach ($allPackages as $package) { diff --git a/src/Command/UsersCommand.php b/src/Command/UsersCommand.php new file mode 100644 index 00000000..ea190c06 --- /dev/null +++ b/src/Command/UsersCommand.php @@ -0,0 +1,62 @@ +setDescription('View or change a GitHub user role and suspension status.') + ->addArgument('username', ['required' => true, 'help' => 'Existing GitHub username.']) + ->addOption('role', ['choices' => array_column(UserRole::cases(), 'value'), 'help' => 'Set the account role.']) + ->addOption('active', ['choices' => ['yes', 'no'], 'help' => 'Reactivate (yes) or suspend (no).']); + } + + /** + * Explicit options are idempotent; without options, prompt with current values. + */ + public function execute(Arguments $args, ConsoleIo $io): int + { + $users = $this->fetchTable(UsersTable::class); + $user = $users->find()->where(['username' => $args->getArgument('username')])->first(); + if ($user === null) { + $io->err('User not found. Sign in with GitHub first.'); + + return self::CODE_ERROR; + } + $io->out(sprintf('%s: %s, %s', $user->username, $user->role->value, UserStatus::fromActive($user->is_active)->value)); + $role = $args->getOption('role'); + $active = $args->getOption('active'); + if ($role === null && $active === null) { + $role = $io->askChoice('Role', array_column(UserRole::cases(), 'value'), $user->role->value); + $active = $io->askChoice('Active', ['yes', 'no'], $user->is_active ? 'yes' : 'no'); + } + try { + $user = new UserAccessService($users)->update((int)$user->id, $role !== null ? UserRole::from($role) : $user->role, $active === null ? $user->is_active : $active === 'yes'); + } catch (DomainException $exception) { + $io->err($exception->getMessage()); + + return self::CODE_ERROR; + } + $io->out(sprintf('Saved %s: %s, %s', $user->username, $user->role->value, UserStatus::fromActive($user->is_active)->value)); + + return self::CODE_SUCCESS; + } +} diff --git a/src/Island/FeaturedPluginsIsland.php b/src/Island/FeaturedPluginsIsland.php index d44fd21f..7a78e6ec 100644 --- a/src/Island/FeaturedPluginsIsland.php +++ b/src/Island/FeaturedPluginsIsland.php @@ -3,8 +3,8 @@ namespace App\Island; +use App\Model\Table\FeaturedPluginsTable; use App\Model\Table\PackagesTable; -use Cake\Core\Configure; use Interact\Attribute\State; use Interact\Island; @@ -59,10 +59,15 @@ public function viewData(): array /** * Read featured metadata keyed by package name. * - * @return array + * @return array */ protected function featured(): array { - return (array)Configure::read('Packages.featured', []); + $metadata = []; + foreach ($this->fetchTable(FeaturedPluginsTable::class)->find()->where(['enabled' => true])->all() as $entry) { + $metadata[$entry->package] = ['logo' => $entry->logo, 'title' => $entry->title, 'description' => $entry->description]; + } + + return $metadata; } } diff --git a/src/Middleware/AdminAccessMiddleware.php b/src/Middleware/AdminAccessMiddleware.php new file mode 100644 index 00000000..5de8a7ca --- /dev/null +++ b/src/Middleware/AdminAccessMiddleware.php @@ -0,0 +1,37 @@ +getAttribute('identity'); + if (!$request->getAttribute('authorization')->can($identity, 'access', $request)) { + if ($identity === null) { + if (in_array($request->getMethod(), ['GET', 'HEAD'], true)) { + return new Response()->withLocation('/?redirect=' . rawurlencode($request->getRequestTarget())); + } + throw new UnauthorizedException('Sign in to continue.'); + } + throw new ForbiddenException('Administrator access is required.'); + } + + return $handler->handle($request); + } +} diff --git a/src/Middleware/RefreshIdentityMiddleware.php b/src/Middleware/RefreshIdentityMiddleware.php new file mode 100644 index 00000000..58a16ef3 --- /dev/null +++ b/src/Middleware/RefreshIdentityMiddleware.php @@ -0,0 +1,39 @@ +getAttribute('session'); + $id = $session->read('Auth.id'); + if ($id !== null) { + $user = $this->fetchTable(UsersTable::class)->find()->where(['id' => $id, 'is_active' => true])->first(); + if ($user === null) { + $session->delete('Auth'); + $session->renew(); + } else { + $session->write('Auth', $user); + } + } + + return $handler->handle($request); + } +} diff --git a/src/Model/Entity/FeaturedPlugin.php b/src/Model/Entity/FeaturedPlugin.php new file mode 100644 index 00000000..749f77f3 --- /dev/null +++ b/src/Model/Entity/FeaturedPlugin.php @@ -0,0 +1,26 @@ + true, + 'enabled' => true, + 'logo' => true, + 'title' => true, + 'description' => true, + ]; +} diff --git a/src/Model/Entity/User.php b/src/Model/Entity/User.php index 902ac4ee..51dc620a 100644 --- a/src/Model/Entity/User.php +++ b/src/Model/Entity/User.php @@ -15,6 +15,8 @@ * @property string $email * @property string $username * @property bool $is_cakephp_dev + * @property \App\Model\Enum\UserRole $role + * @property bool $is_active * @property \Cake\I18n\DateTime $created * @property \Cake\I18n\DateTime|null $modified * @@ -35,6 +37,8 @@ class User extends Entity protected array $_accessible = [ '*' => true, 'id' => false, + 'role' => false, + 'is_active' => false, ]; public const FIELD_ID = 'id'; diff --git a/src/Model/Enum/FeaturedPluginStatus.php b/src/Model/Enum/FeaturedPluginStatus.php new file mode 100644 index 00000000..e2587627 --- /dev/null +++ b/src/Model/Enum/FeaturedPluginStatus.php @@ -0,0 +1,24 @@ + + * @method \App\Model\Entity\FeaturedPlugin get(mixed $primaryKey, array|string $finder = 'all', \Psr\SimpleCache\CacheInterface|string|null $cache = null, \Closure|string|null $cacheKey = null, mixed ...$args) + * @method \App\Model\Entity\FeaturedPlugin newEmptyEntity() + * @method \App\Model\Entity\FeaturedPlugin newEntity(array $data, array $options = []) + * @method \App\Model\Entity\FeaturedPlugin patchEntity(\Cake\Datasource\EntityInterface $entity, array $data, array $options = []) + * @method \Cake\ORM\Query\SelectQuery<\App\Model\Entity\FeaturedPlugin> find(string $type = 'all', mixed ...$args) + */ +class FeaturedPluginsTable extends Table +{ + /** + * Match by canonical name even if catalogue IDs change after a clean sync. + * + * @param array $config Table configuration. + */ + public function initialize(array $config): void + { + parent::initialize($config); + $this->setDisplayField('package'); + $this->addBehavior('Timestamp'); + $this->belongsTo('CataloguePackages', ['className' => 'Packages', 'foreignKey' => 'package', 'bindingKey' => 'package', 'propertyName' => 'catalogue_package']); + } + + /** + * Logos are browser-loaded images; never fetch or interpret editorial HTML. + */ + public function validationDefault(Validator $validator): Validator + { + return $validator + ->scalar('package')->maxLength('package', 191)->requirePresence('package', 'create')->notEmptyString('package') + ->boolean('enabled')->notEmptyString('enabled') + ->scalar('title')->maxLength('title', 255)->allowEmptyString('title') + ->scalar('description')->maxLength('description', 2000)->allowEmptyString('description') + ->scalar('logo')->maxLength('logo', 2048)->allowEmptyString('logo') + ->add('logo', 'imageLocation', [ + 'rule' => static fn(string $value): bool => (str_starts_with($value, 'https://') && filter_var($value, FILTER_VALIDATE_URL) !== false) + || (bool)preg_match('#^/img/[a-zA-Z0-9_./-]+$#D', $value) && !str_contains($value, '..'), + 'message' => 'Use an HTTPS URL or a local /img/ path.', + ]); + } + + /** + * The unique index also protects concurrent additions. + */ + public function buildRules(RulesChecker $rules): RulesChecker + { + $rules->add($rules->isUnique(['package']), ['errorField' => 'package']); + + return $rules; + } +} diff --git a/src/Model/Table/UsersTable.php b/src/Model/Table/UsersTable.php index db0ff308..35361917 100644 --- a/src/Model/Table/UsersTable.php +++ b/src/Model/Table/UsersTable.php @@ -4,8 +4,12 @@ namespace App\Model\Table; use ADmad\SocialAuth\Model\Entity\SocialProfile; +use App\Model\Enum\UserRole; +use Cake\Database\Type\EnumType; use Cake\Datasource\EntityInterface; +use Cake\Http\Exception\ForbiddenException; use Cake\Http\Session; +use Cake\ORM\Query\SelectQuery; use Cake\ORM\RulesChecker; use Cake\ORM\Table; use Cake\Validation\Validator; @@ -46,6 +50,7 @@ public function initialize(array $config): void $this->setTable('users'); $this->setDisplayField('first_name'); $this->setPrimaryKey('id'); + $this->getSchema()->setColumnType('role', EnumType::from(UserRole::class)); $this->addBehavior('Timestamp'); } @@ -58,6 +63,8 @@ public function initialize(array $config): void */ public function validationDefault(Validator $validator): Validator { + $validator->enum('role', UserRole::class)->notEmptyString('role'); + $validator->boolean('is_active')->notEmptyString('is_active'); $validator ->scalar('first_name') ->maxLength('first_name', 255) @@ -97,6 +104,17 @@ public function buildRules(RulesChecker $rules): RulesChecker return $rules; } + /** + * Exclude suspended users when resolving a linked GitHub profile. + * + * @param \Cake\ORM\Query\SelectQuery $query User query. + * @return \Cake\ORM\Query\SelectQuery + */ + public function findActive(SelectQuery $query): SelectQuery + { + return $query->where(['Users.is_active' => true]); + } + /** * @param \Cake\Datasource\EntityInterface $profile The data from github * @param \Cake\Http\Session $session The current session @@ -121,6 +139,8 @@ public function getUser(EntityInterface $profile, Session $session): mixed if (!$user) { // Create new user account $user = $this->newEntity([]); + } elseif (!$user->is_active) { + throw new ForbiddenException('This account is suspended.'); } $user = $this->patchEntity($user, [ diff --git a/src/Policy/RequestPolicy.php b/src/Policy/RequestPolicy.php new file mode 100644 index 00000000..34b8a548 --- /dev/null +++ b/src/Policy/RequestPolicy.php @@ -0,0 +1,35 @@ +getParam('plugin') !== 'Admin') { + return true; + } + + return $identity !== null && $this->fetchTable(UsersTable::class)->exists([ + 'id' => $identity['id'], + 'role' => UserRole::Admin, + 'is_active' => true, + ]); + } +} diff --git a/src/Service/UserAccessService.php b/src/Service/UserAccessService.php new file mode 100644 index 00000000..e9f46dfb --- /dev/null +++ b/src/Service/UserAccessService.php @@ -0,0 +1,60 @@ +users->getConnection()->transactional(function () use ($id, $role, $active, $actorId): User { + // SQLite serializes writers; on MariaDB lock the same rows in ID order. + $query = $this->users->find()->orderByAsc('Users.id'); + if ($this->users->getConnection()->getDriver() instanceof Sqlite) { + $this->users->updateAll(['id' => $id], ['id' => $id]); + } else { + $query->epilog('FOR UPDATE'); + } + $accounts = $query->all()->indexBy('id')->toArray(); + $user = $accounts[$id] ?? null; + if (!$user instanceof User) { + throw new DomainException('User not found.'); + } + if ($actorId !== null) { + $actor = $accounts[$actorId] ?? null; + if (!$actor instanceof User || $actor->role !== UserRole::Admin || !$actor->is_active) { + throw new DomainException('Administrator access is required.'); + } + if ($actorId === $id && ($role !== UserRole::Admin || !$active)) { + throw new DomainException('You cannot demote or suspend your own account.'); + } + } + $otherAdmins = array_filter($accounts, static fn(User $account): bool => $account->id !== $id && $account->role === UserRole::Admin && $account->is_active); + if ($user->role === UserRole::Admin && $user->is_active && ($role !== UserRole::Admin || !$active) && $otherAdmins === []) { + throw new DomainException('At least one active administrator must remain.'); + } + $user->set('role', $role)->set('is_active', $active); + + return $this->users->saveOrFail($user); + }); + } +} diff --git a/templates/element/navbar.php b/templates/element/navbar.php index a1133ece..164e632a 100644 --- a/templates/element/navbar.php +++ b/templates/element/navbar.php @@ -3,6 +3,8 @@ * @var \App\View\AppView $this * @var bool|null $minimal */ +use App\Model\Enum\UserRole; + $minimal = $minimal ?? false; $requirements = $this->getRequest()->getPath() === '/requirements'; $loggedIn = !$minimal && $this->Identity->isLoggedIn(); @@ -40,6 +42,9 @@ User->displayName()) ?> @User->username()) ?>

+ Identity->get('role') === UserRole::Admin && $this->Identity->get('is_active')) : ?> + Html->link(__('Admin'), ['_name' => 'admin:home'], ['class' => 'nav-link']) ?> + Html->link(__('Sign out'), ['controller' => 'Users', 'action' => 'logout'], ['class' => 'nav-link']) ?> @@ -68,6 +73,9 @@

User->displayName()) ?>

+ Identity->get('role') === UserRole::Admin && $this->Identity->get('is_active')) : ?> + Html->link(__('Admin'), ['_name' => 'admin:home'], ['class' => 'nav-link']) ?> + Html->link(__('Sign out'), ['controller' => 'Users', 'action' => 'logout'], ['class' => 'nav-link']) ?> Form->postLink(__('Sign in with GitHub'), $loginUrl, ['class' => 'action-link btn btn-outline']) ?> diff --git a/templates/island/featured_plugins.php b/templates/island/featured_plugins.php index f2b15533..cb11bbf4 100644 --- a/templates/island/featured_plugins.php +++ b/templates/island/featured_plugins.php @@ -2,7 +2,7 @@ /** * @var \App\View\IslandTemplateView $this * @var list<\App\Model\Entity\Package> $featuredPackages - * @var array $featuredMetadata + * @var array $featuredMetadata */ ?>
@@ -32,12 +32,12 @@
-

+

package]['title'] ?? ($name ?: $vendor)) ?>

element('Packages/awesome_badge', compact('package')) ?>
-

description ?: __('No description available.')) ?>

+

package]['description'] ?? ($package->description ?: __('No description available.'))) ?>

diff --git a/tests/Fixture/FeaturedPluginsFixture.php b/tests/Fixture/FeaturedPluginsFixture.php new file mode 100644 index 00000000..53ce71d9 --- /dev/null +++ b/tests/Fixture/FeaturedPluginsFixture.php @@ -0,0 +1,22 @@ +records = [ + ['id' => 1, 'package' => 'markstory/asset_compress', 'enabled' => true, 'logo' => null, 'created' => '2026-01-01 00:00:00'], + ['id' => 2, 'package' => 'cakedc/users', 'enabled' => true, 'logo' => null, 'created' => '2026-01-01 00:00:00'], + ['id' => 3, 'package' => 'dereuromark/cakephp-tools', 'enabled' => true, 'logo' => null, 'created' => '2026-01-01 00:00:00'], + ]; + parent::init(); + } +} diff --git a/tests/Fixture/UsersFixture.php b/tests/Fixture/UsersFixture.php new file mode 100644 index 00000000..853ff1a5 --- /dev/null +++ b/tests/Fixture/UsersFixture.php @@ -0,0 +1,22 @@ +records = [ + ['id' => 1, 'username' => 'admin', 'email' => 'admin@example.com', 'first_name' => 'Site', 'last_name' => 'Admin', 'role' => 'admin', 'is_active' => true, 'created' => '2026-01-01 00:00:00'], + ['id' => 2, 'username' => 'member', 'email' => 'member@example.com', 'first_name' => 'Normal', 'last_name' => 'Member', 'role' => 'user', 'is_active' => true, 'created' => '2026-01-02 00:00:00'], + ['id' => 3, 'username' => 'suspended', 'email' => 'suspended@example.com', 'role' => 'user', 'is_active' => false, 'created' => '2026-01-03 00:00:00'], + ]; + parent::init(); + } +} diff --git a/tests/TestCase/Command/UsersCommandTest.php b/tests/TestCase/Command/UsersCommandTest.php new file mode 100644 index 00000000..f5752ead --- /dev/null +++ b/tests/TestCase/Command/UsersCommandTest.php @@ -0,0 +1,57 @@ +exec('users member --role admin --active yes'); + $this->assertExitSuccess(); + $this->assertOutputContains('Saved member: admin, active'); + $this->assertSame(UserRole::Admin, $this->fetchTable(UsersTable::class)->get(2)->role); + } + + /** + * With no flags, prompt for both fields using current defaults. + */ + public function testInteractiveReactivation(): void + { + $this->exec('users suspended', ['user', 'yes']); + $this->assertExitSuccess(); + $this->assertTrue($this->fetchTable(UsersTable::class)->get(3)->is_active); + } + + /** + * Unknown accounts cannot be implicitly created by the command. + */ + public function testUnknownUser(): void + { + $this->exec('users nobody --role admin'); + $this->assertExitError(); + $this->assertErrorContains('User not found'); + } + + /** + * Console and HTTP share the last-admin invariant. + */ + public function testLastAdmin(): void + { + $this->exec('users admin --active no'); + $this->assertExitError(); + $this->assertTrue($this->fetchTable(UsersTable::class)->get(1)->is_active); + } +} diff --git a/tests/TestCase/Controller/PackagesControllerTest.php b/tests/TestCase/Controller/PackagesControllerTest.php index 878c05de..df33d2f7 100644 --- a/tests/TestCase/Controller/PackagesControllerTest.php +++ b/tests/TestCase/Controller/PackagesControllerTest.php @@ -3,7 +3,6 @@ namespace App\Test\TestCase\Controller; -use Cake\Core\Configure; use Cake\TestSuite\IntegrationTestTrait; use Cake\TestSuite\TestCase; use Override; @@ -24,7 +23,7 @@ class PackagesControllerTest extends TestCase */ #[Override] protected array $fixtures = [ - 'app.Packages', + 'app.FeaturedPlugins', 'app.Packages', 'plugin.Tags.Tags', 'plugin.Tags.Tagged', ]; @@ -35,7 +34,6 @@ class PackagesControllerTest extends TestCase protected function setUp(): void { parent::setUp(); - Configure::write('Packages.featured', ['markstory/asset_compress' => ['logo' => null]]); } /** diff --git a/tests/TestCase/Island/CatalogueIslandTest.php b/tests/TestCase/Island/CatalogueIslandTest.php index 343d178e..244c9c61 100644 --- a/tests/TestCase/Island/CatalogueIslandTest.php +++ b/tests/TestCase/Island/CatalogueIslandTest.php @@ -4,12 +4,13 @@ namespace App\Test\TestCase\Island; use Cake\Cache\Cache; -use Cake\Core\Configure; use Cake\Http\Exception\BadRequestException; use Cake\Http\ServerRequest; use Cake\TestSuite\TestCase; use Interact\TestSuite\IslandTestTrait; use Override; +use Tags\Model\Table\TaggedTable; +use Tags\Model\Table\TagsTable; /** * Exercises catalogue selections through real signed island updates. @@ -22,7 +23,7 @@ class CatalogueIslandTest extends TestCase * @var list */ #[Override] - protected array $fixtures = ['app.Packages', 'app.Categories', 'app.CategoriesPackages', 'plugin.Tags.Tags', 'plugin.Tags.Tagged']; + protected array $fixtures = ['app.FeaturedPlugins', 'app.Packages', 'app.Categories', 'app.CategoriesPackages', 'plugin.Tags.Tags', 'plugin.Tags.Tagged']; /** * Category and membership changes are live, reloadable and reset pagination. @@ -62,7 +63,6 @@ public function testUnknownCategoryIsCleared(): void protected function setUp(): void { parent::setUp(); - Configure::write('Packages.featured', ['markstory/asset_compress' => ['logo' => null]]); Cache::delete('package_filter_tags_v1'); } @@ -159,9 +159,9 @@ public function testClearFiltersRetainsSort(): void */ public function testDetailVersionRetainsOtherSelections(): void { - $tags = $this->fetchTable('Tags.Tags'); + $tags = $this->fetchTable(TagsTable::class); $tag = $tags->saveOrFail($tags->newEntity(['slug' => 'cakephp-4-4', 'label' => 'CakePHP: 4.4'])); - $tagged = $this->fetchTable('Tags.Tagged'); + $tagged = $this->fetchTable(TaggedTable::class); $tagged->saveOrFail($tagged->newEntity(['tag_id' => $tag->id, 'fk_id' => 1, 'fk_model' => 'Packages'])); $this->testIsland('Catalogue') ->fill(['search' => 'asset', 'paging.sort' => 'downloads']) diff --git a/tests/TestCase/Island/FeaturedPluginsIslandTest.php b/tests/TestCase/Island/FeaturedPluginsIslandTest.php index 0f1a41ca..b718b778 100644 --- a/tests/TestCase/Island/FeaturedPluginsIslandTest.php +++ b/tests/TestCase/Island/FeaturedPluginsIslandTest.php @@ -3,66 +3,60 @@ namespace App\Test\TestCase\Island; -use Cake\Core\Configure; +use App\Model\Table\FeaturedPluginsTable; +use App\Model\Table\PackagesTable; use Cake\TestSuite\TestCase; use Interact\TestSuite\IslandTestTrait; -use Override; -/** - * Exercises the featured selection independently of catalogue pagination. - */ class FeaturedPluginsIslandTest extends TestCase { use IslandTestTrait; - /** - * @var list - */ - #[Override] - protected array $fixtures = ['app.Packages', 'plugin.Tags.Tags', 'plugin.Tags.Tagged']; + protected array $fixtures = ['app.FeaturedPlugins', 'app.Packages', 'plugin.Tags.Tags', 'plugin.Tags.Tagged']; /** - * Refreshing preserves the shuffled order and honors removed configuration entries. + * Keep mount order while honoring current enabled state on every update. */ public function testSelectionOrderSurvivesRefresh(): void { - Configure::write('Packages.featured', [ - 'markstory/asset_compress' => ['logo' => 'https://example.com/asset-compress.svg'], - 'cakedc/users' => ['logo' => null], - ]); $island = $this->testIsland('FeaturedPlugins'); $order = $island->result()->state['order']; - $island->sync()->assertSet('order', $order) - ->assertSee('markstory/asset_compress')->assertSee('cakedc/users') - ->assertSee('https://example.com/asset-compress.svg'); - - Configure::write('Packages.featured', ['cakedc/users' => ['logo' => null]]); - $island->sync()->assertSee('cakedc/users')->assertDontSee('markstory/asset_compress'); + $this->fetchTable(FeaturedPluginsTable::class)->updateAll(['enabled' => false], ['id' => 1]); + $island->sync()->assertSet('order', $order)->assertDontSee('markstory/asset_compress')->assertSee('cakedc/users'); } /** - * Empty or missing configured packages leave no featured entries behind. + * Empty and unavailable selections hide the featured region. */ public function testMissingSelectionHasNoFeaturedEntries(): void { - Configure::write('Packages.featured', []); + $table = $this->fetchTable(FeaturedPluginsTable::class); + $table->deleteAll([]); $this->testIsland('FeaturedPlugins')->assertDontSee('data-featured-plugins'); - Configure::write('Packages.featured', ['missing/package' => ['logo' => null]]); + $table->saveOrFail($table->newEntity(['package' => 'missing/package', 'enabled' => true])); $this->testIsland('FeaturedPlugins')->assertDontSee('data-featured-plugins'); } /** - * The static recommendation section contains at most three configured packages. + * The random pool is bounded to three available, distinct packages. */ public function testSelectionIsBoundedToThreePackages(): void { - Configure::write('Packages.featured', [ - 'markstory/asset_compress' => ['logo' => null], - 'cakedc/users' => ['logo' => null], - 'dereuromark/cakephp-tools' => ['logo' => null], - 'vendor/package-01' => ['logo' => null], - ]); + $table = $this->fetchTable(FeaturedPluginsTable::class); + $table->saveOrFail($table->newEntity(['package' => 'vendor/package-01', 'enabled' => true])); $island = $this->testIsland('FeaturedPlugins'); $this->assertSame(3, substr_count($island->result()->html, 'data-plugin-tone=')); } + + /** + * Editorial values are escaped and never change imported package metadata. + */ + public function testEditorialOverrides(): void + { + $this->fetchTable(FeaturedPluginsTable::class)->updateAll([ + 'title' => 'Curated title', 'description' => '', 'logo' => '/img/custom.svg', + ], ['id' => 1]); + $this->testIsland('FeaturedPlugins')->assertSee('Curated title')->assertSee('')->assertSee('/img/custom.svg'); + $this->assertSame('Featured package used to verify the homepage slider.', $this->fetchTable(PackagesTable::class)->get(1)->description); + } } diff --git a/tests/TestCase/Model/Table/UsersTableTest.php b/tests/TestCase/Model/Table/UsersTableTest.php new file mode 100644 index 00000000..c9471734 --- /dev/null +++ b/tests/TestCase/Model/Table/UsersTableTest.php @@ -0,0 +1,62 @@ +fetchTable(UsersTable::class); + $user = $users->newEntity(['email' => 'new@example.com', 'username' => 'new', 'role' => 'admin', 'is_active' => false]); + $user = $users->get($users->saveOrFail($user)->id); + $this->assertSame(UserRole::User, $user->role); + $this->assertTrue($user->is_active); + $users->getUser(new SocialProfile(['email' => 'admin@example.com', 'username' => 'admin']), new Session()); + $this->assertSame(UserRole::Admin, $users->get(1)->role); + } + + /** + * An unlinked GitHub identity matching a suspended email is rejected. + */ + public function testSuspendedEmailCannotSignIn(): void + { + $this->expectException(ForbiddenException::class); + $this->fetchTable(UsersTable::class)->getUser(new SocialProfile(['email' => 'suspended@example.com', 'username' => 'suspended']), new Session()); + } + + /** + * The finder used by SocialAuth excludes linked suspended accounts. + */ + public function testActiveFinder(): void + { + $this->assertSame([1, 2], $this->fetchTable(UsersTable::class)->find('active')->orderByAsc('id')->all()->extract('id')->toList()); + } + + /** + * ORM hydration, persistence and validation use the same backed enum. + */ + public function testRoleEnumMapping(): void + { + $users = $this->fetchTable(UsersTable::class); + $user = $users->get(2); + $this->assertSame(UserRole::User, $user->role); + $user->set('role', UserRole::Admin); + $users->saveOrFail($user); + $this->assertTrue($users->exists(['id' => 2, 'role' => UserRole::Admin])); + $this->assertSame(UserRole::Admin, $users->get(2)->role); + $this->assertArrayHasKey('role', $users->getValidator()->validate(['role' => 'owner'], false)); + } +} diff --git a/tests/TestCase/Service/UserAccessServiceTest.php b/tests/TestCase/Service/UserAccessServiceTest.php new file mode 100644 index 00000000..0e3b0bc9 --- /dev/null +++ b/tests/TestCase/Service/UserAccessServiceTest.php @@ -0,0 +1,56 @@ +fetchTable(UsersTable::class); + $service = new UserAccessService($users); + $user = $service->update(2, UserRole::Admin, true, 1); + $this->assertSame(UserRole::Admin, $user->role); + $this->assertFalse($service->update(2, UserRole::User, false, 1)->is_active); + $this->assertTrue($service->update(2, UserRole::User, true)->is_active); + } + + /** + * The console cannot remove the final active administrator. + */ + public function testProtectsLastAdmin(): void + { + $this->expectExceptionMessage('At least one active administrator'); + new UserAccessService($this->fetchTable(UsersTable::class))->update(1, UserRole::User, true); + } + + /** + * Even with another admin available, self-suspension is rejected in HTTP. + */ + public function testProtectsSelf(): void + { + $service = new UserAccessService($this->fetchTable(UsersTable::class)); + $service->update(2, UserRole::Admin, true); + $this->expectExceptionMessage('your own account'); + $service->update(1, UserRole::User, false, 1); + } + + /** + * Revalidate the actor inside the transaction, not only on page access. + */ + public function testRejectsNonAdminActor(): void + { + $this->expectExceptionMessage('Administrator access is required'); + new UserAccessService($this->fetchTable(UsersTable::class))->update(3, UserRole::Admin, true, 2); + } +} diff --git a/tests/browser/admin-state.php b/tests/browser/admin-state.php new file mode 100644 index 00000000..39b0a812 --- /dev/null +++ b/tests/browser/admin-state.php @@ -0,0 +1,44 @@ + Connection::class, 'driver' => Sqlite::class, 'database' => $database]); +$connection = new PDO('sqlite:' . $database); +$mode = $argv[1] ?? 'reset'; +if ($mode === 'reset') { + foreach (['users' => new UsersFixture(), 'featured_plugins' => new FeaturedPluginsFixture()] as $table => $fixture) { + $connection->exec('DELETE FROM ' . $table); + foreach ($fixture->records as $record) { + $columns = implode(', ', array_keys($record)); + $parameters = implode(', ', array_fill(0, count($record), '?')); + $connection->prepare("INSERT INTO $table ($columns) VALUES ($parameters)")->execute(array_values($record)); + } + } + exit; +} +if ($mode === 'revoke') { + $connection->exec("UPDATE users SET role = 'user' WHERE id = 1"); + exit; +} +if (!in_array($mode, ['1', '2', '3'], true)) { + throw new RuntimeException('Unknown browser fixture identity.'); +} +session_save_path(dirname(__DIR__, 2) . '/tmp/browser-sessions'); +session_id(bin2hex(random_bytes(16))); +session_start(); +$_SESSION = ['Auth' => ['id' => (int)$mode]]; +$cookie = ['name' => session_name(), 'value' => session_id()]; +session_write_close(); +echo json_encode($cookie, JSON_THROW_ON_ERROR); diff --git a/tests/browser/admin.spec.js b/tests/browser/admin.spec.js new file mode 100644 index 00000000..53e5b0f9 --- /dev/null +++ b/tests/browser/admin.spec.js @@ -0,0 +1,155 @@ +import { test, expect } from '@playwright/test' +import { execFileSync } from 'node:child_process' + +const fixtures = mode => execFileSync('php', ['tests/browser/admin-state.php', mode], { encoding: 'utf8' }) +const signIn = async (context, id = '1') => { + const cookie = JSON.parse(fixtures(id)) + await context.addCookies([{ ...cookie, domain: '127.0.0.1', path: '/' }]) +} + +test.beforeEach(() => fixtures('reset')) +test.afterEach(() => fixtures('reset')) + +test('existing login is reused and ordinary users cannot access admin', async ({ page, context }) => { + await page.goto('/admin/users') + await expect(page).toHaveURL(/\/?redirect=%2Fadmin%2Fusers/) + await expect(page.getByText('Sign in', { exact: true })).toBeVisible() + await signIn(context, '2') + const response = await page.goto('/admin/users') + expect(response.status()).toBe(403) +}) + +test('admin manages roles and suspension through the standard Interact endpoint', async ({ page, context }) => { + await signIn(context) + await page.goto('/admin/users') + await expect(page.getByRole('navigation', { name: 'Admin navigation' })).toBeVisible() + await page.screenshot({ path: 'tmp/admin-users-desktop.png', fullPage: true, animations: 'disabled' }) + await page.getByRole('searchbox', { name: 'Search users' }).fill('member') + const row = page.locator('[data-user-id="2"]') + await expect(row).toBeVisible() + await expect(page.locator('[data-user-id="3"]')).toHaveCount(0) + await row.getByRole('button', { name: 'Manage access' }).click() + const dialog = page.getByRole('dialog') + await expect(dialog).toBeVisible() + await dialog.getByLabel('Role', { exact: true }).selectOption('admin') + await dialog.getByLabel('Account active').uncheck() + await dialog.getByRole('button', { name: 'Review change' }).click() + const update = page.waitForResponse(response => response.url().endsWith('/_interact/update') && response.request().method() === 'POST') + await dialog.getByRole('button', { name: 'Confirm change' }).click() + expect((await update).status()).toBe(200) + await expect(dialog).toHaveCount(0) + await expect(row).toContainText('Admin') + await expect(row).toContainText('Suspended') + await row.getByRole('button', { name: 'Manage access' }).click() + await dialog.getByLabel('Account active').check() + await dialog.getByRole('button', { name: 'Review change' }).click() + await dialog.getByRole('button', { name: 'Confirm change' }).click() + await expect(row).toContainText('Active') +}) + +test('featured editorial changes, preview and removal reach public cards', async ({ page, context }) => { + await signIn(context) + await page.goto('/admin/featured-plugins') + const row = page.locator('[data-featured-id="1"]') + await expect(page.getByRole('columnheader', { name: 'GitHub stars', exact: true })).toBeVisible() + await expect(row.getByRole('cell', { name: '450', exact: true })).toBeVisible() + await expect(row.getByRole('cell', { name: '5,000', exact: true })).toBeVisible() + await row.getByRole('button', { name: 'Edit', exact: true }).click() + const dialog = page.getByRole('dialog') + const preview = dialog.getByRole('region', { name: 'Card preview' }) + await dialog.getByLabel('Title override').fill('Community favourite') + await expect(preview).toContainText('Community favourite') + await dialog.getByLabel('Description override').fill('A curated description.') + await expect(preview).toContainText('A curated description.') + await dialog.getByLabel('Logo URL or path').fill('/img/cake.logo.svg') + await expect(preview.locator('img')).toHaveAttribute('src', /^\/img\/cake\.logo\.svg(?:\?\d+)?$/) + await expect(dialog.getByRole('button', { name: 'Preview', exact: true })).toHaveCount(0) + await expect(row).not.toContainText('Community favourite') + await expect(dialog.locator('section + .modal-action').getByRole('button', { name: 'Save featured plugin' })).toHaveCount(1) + await page.screenshot({ path: 'tmp/admin-featured-editor.png', fullPage: true, animations: 'disabled' }) + await dialog.getByRole('button', { name: 'Save featured plugin' }).click() + await expect(dialog).toHaveCount(0) + await page.goto('/') + await expect(page.locator('[data-featured-plugins]')).toContainText('Community favourite') + await expect(page.locator('[data-featured-plugins]')).toContainText('A curated description.') + await page.goto('/admin/featured-plugins') + await row.getByRole('button', { name: 'Remove', exact: true }).click() + await dialog.getByRole('button', { name: 'Confirm removal' }).click() + await expect(row).toHaveCount(0) +}) + +test('admin updates reject access revoked after mounting', async ({ page, context }) => { + await signIn(context) + await page.goto('/admin/featured-plugins') + fixtures('revoke') + const response = page.waitForResponse(response => response.url().endsWith('/_interact/update')) + await page.getByRole('button', { name: 'Add featured plugin' }).click() + expect((await response).status()).toBe(403) + await expect(page.getByRole('dialog')).toHaveCount(0) +}) + +test('admin adds an existing catalogue plugin and disables its feature', async ({ page, context }) => { + await signIn(context) + await page.goto('/admin/featured-plugins') + await page.getByRole('button', { name: 'Add featured plugin' }).click() + const dialog = page.getByRole('dialog') + await dialog.getByLabel('Find a catalogue plugin').fill('package-01') + await dialog.getByRole('button', { name: 'vendor/package-01', exact: true }).click() + await dialog.getByRole('button', { name: 'Save featured plugin' }).click() + const row = page.locator('tbody tr').filter({ hasText: 'vendor/package-01' }) + await expect(row).toContainText('Enabled') + await row.getByRole('button', { name: 'Edit', exact: true }).click() + await dialog.getByLabel('Enabled', { exact: true }).uncheck() + await dialog.getByRole('button', { name: 'Save featured plugin' }).click() + await page.getByRole('combobox', { name: 'Filter by status' }).selectOption('disabled') + await expect(page.locator('tbody tr')).toHaveCount(1) + await expect(row).toContainText('Disabled') +}) + +test('featured columns sort in place and retain filters', async ({ page, context }) => { + await signIn(context) + await page.goto('/admin/featured-plugins') + await page.evaluate(() => { window.adminSortMarker = 'retained' }) + const ids = () => page.locator('tbody tr').evaluateAll(rows => rows.map(row => row.dataset.featuredId)) + await page.getByRole('link', { name: /^GitHub stars/ }).click() + await expect(page).toHaveURL(/sort=stars/) + await expect.poll(ids).toEqual(['3', '1', '2']) + await page.getByRole('link', { name: /^GitHub stars/ }).click() + await expect(page).toHaveURL(/direction=desc/) + await expect.poll(ids).toEqual(['2', '1', '3']) + await page.getByRole('link', { name: /^Downloads/ }).click() + await expect(page).toHaveURL(/sort=downloads/) + await expect.poll(ids).toEqual(['1', '2', '3']) + for (const [label, key] of [['Plugin', 'package'], ['Featured title', 'title'], ['Status', 'enabled']]) { + await page.getByRole('columnheader').getByRole('link', { name: new RegExp(`^${label}`) }).click() + if (key === 'package') { + await expect(page).not.toHaveURL(/sort=/) + await expect.poll(ids).toEqual(['2', '3', '1']) + } else { + await expect(page).toHaveURL(new RegExp(`sort=${key}`)) + } + } + await page.getByRole('combobox', { name: 'Filter by status' }).selectOption('enabled') + await page.getByRole('link', { name: /^Downloads/ }).click() + await expect(page).toHaveURL(/status=enabled/) + await expect(page).toHaveURL(/sort=downloads/) + expect(await page.evaluate(() => window.adminSortMarker)).toBe('retained') +}) + +test('mobile sidebar and theme preference work across admin and frontend', async ({ page, context }) => { + await signIn(context) + await page.setViewportSize({ width: 390, height: 844 }) + await page.goto('/admin/users') + const toggle = page.getByRole('button', { name: 'Open navigation' }) + await toggle.focus() + await page.keyboard.press('Enter') + await expect(toggle).toHaveAttribute('aria-expanded', 'true') + await expect(page.getByRole('navigation', { name: 'Admin navigation' })).toBeVisible() + await page.screenshot({ path: 'tmp/admin-mobile-navigation.png', fullPage: true, animations: 'disabled' }) + await page.getByRole('link', { name: 'Featured plugins', exact: true }).click() + await expect(page.getByRole('heading', { name: 'Featured plugins', exact: true })).toBeVisible() + await page.getByRole('button', { name: 'Toggle theme' }).click() + await expect(page.locator('html')).toHaveAttribute('data-theme', 'cakephp-dark') + await page.goto('/') + await expect(page.locator('html')).toHaveAttribute('data-theme', 'cakephp-dark') +}) diff --git a/tests/browser/setup.php b/tests/browser/setup.php index e78cb1af..d77e2d21 100644 --- a/tests/browser/setup.php +++ b/tests/browser/setup.php @@ -4,7 +4,9 @@ use App\Application; use App\Test\Fixture\CategoriesFixture; use App\Test\Fixture\CategoriesPackagesFixture; +use App\Test\Fixture\FeaturedPluginsFixture; use App\Test\Fixture\PackagesFixture; +use App\Test\Fixture\UsersFixture; use Cake\Cache\Cache; use Cake\Database\Connection; use Cake\Database\Driver\Sqlite; @@ -26,6 +28,13 @@ ConnectionManager::alias('default', 'test'); // Only catalogue and tag tables are needed; OAuth itself is not exercised here. new Migrator()->runMany([['connection' => 'default'], ['connection' => 'default', 'plugin' => 'Tags']]); +$connection->delete('featured_plugins', []); +foreach (new FeaturedPluginsFixture()->records as $record) { + $connection->insert('featured_plugins', $record); +} +foreach (new UsersFixture()->records as $record) { + $connection->insert('users', $record); +} $fixture = new PackagesFixture(); foreach ($fixture->records as $record) { $connection->insert('packages', $record); @@ -45,3 +54,6 @@ } } Cache::clearAll(); +if (!is_dir(TMP . 'browser-sessions')) { + mkdir(TMP . 'browser-sessions', 0700, true); +} From 234c2d38e2074c629b894ed17538212688b95fce Mon Sep 17 00:00:00 2001 From: Jasper Smet Date: Fri, 13 Nov 2026 11:32:47 +0100 Subject: [PATCH 2/6] Satisfy Rector checks for admin backend --- src/Model/Entity/FeaturedPlugin.php | 2 ++ src/Policy/RequestPolicy.php | 2 +- tests/TestCase/Command/UsersCommandTest.php | 2 ++ tests/TestCase/Island/FeaturedPluginsIslandTest.php | 2 ++ tests/TestCase/Model/Table/UsersTableTest.php | 2 ++ tests/TestCase/Service/UserAccessServiceTest.php | 2 ++ 6 files changed, 11 insertions(+), 1 deletion(-) diff --git a/src/Model/Entity/FeaturedPlugin.php b/src/Model/Entity/FeaturedPlugin.php index 749f77f3..f08411b8 100644 --- a/src/Model/Entity/FeaturedPlugin.php +++ b/src/Model/Entity/FeaturedPlugin.php @@ -4,6 +4,7 @@ namespace App\Model\Entity; use Cake\ORM\Entity; +use Override; /** * @property int $id @@ -16,6 +17,7 @@ */ class FeaturedPlugin extends Entity { + #[Override] protected array $_accessible = [ 'package' => true, 'enabled' => true, diff --git a/src/Policy/RequestPolicy.php b/src/Policy/RequestPolicy.php index 34b8a548..a21ce08a 100644 --- a/src/Policy/RequestPolicy.php +++ b/src/Policy/RequestPolicy.php @@ -26,7 +26,7 @@ public function canAccess(?IdentityInterface $identity, ServerRequest $request): return true; } - return $identity !== null && $this->fetchTable(UsersTable::class)->exists([ + return $identity instanceof IdentityInterface && $this->fetchTable(UsersTable::class)->exists([ 'id' => $identity['id'], 'role' => UserRole::Admin, 'is_active' => true, diff --git a/tests/TestCase/Command/UsersCommandTest.php b/tests/TestCase/Command/UsersCommandTest.php index f5752ead..fb4a0561 100644 --- a/tests/TestCase/Command/UsersCommandTest.php +++ b/tests/TestCase/Command/UsersCommandTest.php @@ -7,11 +7,13 @@ use App\Model\Table\UsersTable; use Cake\Console\TestSuite\ConsoleIntegrationTestTrait; use Cake\TestSuite\TestCase; +use Override; class UsersCommandTest extends TestCase { use ConsoleIntegrationTestTrait; + #[Override] protected array $fixtures = ['app.Users']; /** diff --git a/tests/TestCase/Island/FeaturedPluginsIslandTest.php b/tests/TestCase/Island/FeaturedPluginsIslandTest.php index b718b778..f71384bd 100644 --- a/tests/TestCase/Island/FeaturedPluginsIslandTest.php +++ b/tests/TestCase/Island/FeaturedPluginsIslandTest.php @@ -7,11 +7,13 @@ use App\Model\Table\PackagesTable; use Cake\TestSuite\TestCase; use Interact\TestSuite\IslandTestTrait; +use Override; class FeaturedPluginsIslandTest extends TestCase { use IslandTestTrait; + #[Override] protected array $fixtures = ['app.FeaturedPlugins', 'app.Packages', 'plugin.Tags.Tags', 'plugin.Tags.Tagged']; /** diff --git a/tests/TestCase/Model/Table/UsersTableTest.php b/tests/TestCase/Model/Table/UsersTableTest.php index c9471734..6b49aa58 100644 --- a/tests/TestCase/Model/Table/UsersTableTest.php +++ b/tests/TestCase/Model/Table/UsersTableTest.php @@ -9,9 +9,11 @@ use Cake\Http\Exception\ForbiddenException; use Cake\Http\Session; use Cake\TestSuite\TestCase; +use Override; class UsersTableTest extends TestCase { + #[Override] protected array $fixtures = ['app.Users']; /** diff --git a/tests/TestCase/Service/UserAccessServiceTest.php b/tests/TestCase/Service/UserAccessServiceTest.php index 0e3b0bc9..cc7abf07 100644 --- a/tests/TestCase/Service/UserAccessServiceTest.php +++ b/tests/TestCase/Service/UserAccessServiceTest.php @@ -7,9 +7,11 @@ use App\Model\Table\UsersTable; use App\Service\UserAccessService; use Cake\TestSuite\TestCase; +use Override; class UserAccessServiceTest extends TestCase { + #[Override] protected array $fixtures = ['app.Users']; /** From 806f01a4fbcf17f9f41fc10ea8aa424540adc508 Mon Sep 17 00:00:00 2001 From: Jasper Smet Date: Fri, 13 Nov 2026 11:55:25 +0100 Subject: [PATCH 3/6] Separate featured plugin editor and improve admin navigation --- README.md | 7 + plugins/Admin/config/form-templates.php | 19 +++ plugins/Admin/src/AdminPlugin.php | 15 +- .../src/Island/FeaturedPluginEditorIsland.php | 129 ++++++++++++++++++ .../src/Island/FeaturedPluginsIsland.php | 117 ++++------------ plugins/Admin/src/Island/UsersIsland.php | 21 ++- .../island/featured_plugin_editor.php | 106 ++++++++++++++ .../templates/island/featured_plugins.php | 72 ++-------- plugins/Admin/templates/island/users.php | 78 +++++++---- plugins/Admin/templates/layout/admin.php | 42 +++++- .../TestCase/Island/AdminIslandsTest.php | 80 +++++++++-- src/Model/Entity/FeaturedPlugin.php | 34 +++++ src/Model/Table/FeaturedPluginsTable.php | 58 +++++++- src/Model/Table/PackagesTable.php | 13 ++ .../Island/FeaturedPluginsIslandTest.php | 4 +- .../Model/Table/FeaturedPluginsTableTest.php | 110 +++++++++++++++ .../Model/Table/PackagesTableTest.php | 13 ++ tests/browser/admin.spec.js | 59 +++++++- 18 files changed, 773 insertions(+), 204 deletions(-) create mode 100644 plugins/Admin/config/form-templates.php create mode 100644 plugins/Admin/src/Island/FeaturedPluginEditorIsland.php create mode 100644 plugins/Admin/templates/island/featured_plugin_editor.php create mode 100644 tests/TestCase/Model/Table/FeaturedPluginsTableTest.php diff --git a/README.md b/README.md index 01ab04d6..7f4015f1 100644 --- a/README.md +++ b/README.md @@ -104,6 +104,7 @@ The console command receives its importers through CakePHP's container. The local `Admin` plugin provides `/admin/users` and `/admin/featured-plugins`. It reuses GitHub sign-in, the public theme preference, and Interact's standard update endpoint. Every admin island checks current authorization on every request. +Sidebar links use Interact navigation, including the return to the public site. The plugin owns the admin interface; shared models, migrations, and access services remain in the application. @@ -141,6 +142,12 @@ overrides use imported package values. Logos accept HTTPS URLs or local `/img/` paths; missing or broken logos use a name-based emblem. All featured table data columns support sorting, including catalogue stars and downloads. Sorting and filters update through Interact without a page reload. +The listing owns filters, pagination, and removal. A separate keyed editor island +owns the package picker, draft, live preview, and saving. Preview requests update +only that editor; a successful save dispatches an event to refresh the listing. +Shared model finders, validation, and rules handle catalogue selection and overrides. +The editor uses FormHelper with an entity context and Interact's whole-form draft +binding; title, description, and logo controls opt into live preview updates. The migration preserves the previous configured selections once. Configuration then lives exclusively in the database. Package synchronization and cleanup leave diff --git a/plugins/Admin/config/form-templates.php b/plugins/Admin/config/form-templates.php new file mode 100644 index 00000000..5b98292e --- /dev/null +++ b/plugins/Admin/config/form-templates.php @@ -0,0 +1,19 @@ + '{{text}}', + 'checkbox' => '', + 'checkboxWrapper' => '
{{label}}
', + 'error' => '
{{content}}
', + 'input' => '', + 'inputContainer' => '
{{content}}
', + 'inputContainerError' => '
{{content}}{{error}}
', + 'label' => '', + 'nestingLabel' => '{{hidden}}{{input}}{{text}}', + 'select' => '', + 'textarea' => '', +]; diff --git a/plugins/Admin/src/AdminPlugin.php b/plugins/Admin/src/AdminPlugin.php index 78f86bab..3902a5b1 100644 --- a/plugins/Admin/src/AdminPlugin.php +++ b/plugins/Admin/src/AdminPlugin.php @@ -17,9 +17,18 @@ class AdminPlugin extends BasePlugin public function routes(RouteBuilder $routes): void { $routes->plugin('Admin', ['path' => '/admin'], function (RouteBuilder $builder): void { - $builder->get('/', ['controller' => 'Users', 'action' => 'home'], 'admin:home'); - $builder->get('/users', ['controller' => 'Users', 'action' => 'index'], 'admin:users'); - $builder->get('/featured-plugins', ['controller' => 'FeaturedPlugins', 'action' => 'index'], 'admin:featured'); + $builder->get('/', [ + 'controller' => 'Users', + 'action' => 'home', + ], 'admin:home'); + $builder->get('/users', [ + 'controller' => 'Users', + 'action' => 'index', + ], 'admin:users'); + $builder->get('/featured-plugins', [ + 'controller' => 'FeaturedPlugins', + 'action' => 'index', + ], 'admin:featured'); }); } } diff --git a/plugins/Admin/src/Island/FeaturedPluginEditorIsland.php b/plugins/Admin/src/Island/FeaturedPluginEditorIsland.php new file mode 100644 index 00000000..ca7d5729 --- /dev/null +++ b/plugins/Admin/src/Island/FeaturedPluginEditorIsland.php @@ -0,0 +1,129 @@ + + */ + #[State(writable: true)] + public array $draft = [ + 'enabled' => true, + 'logo' => '', + 'title' => '', + 'description' => '', + ]; + + protected ?FeaturedPlugin $entry = null; + + /** + * Initialize the draft after authorization; later requests preserve edits. + */ + public function mount(): void + { + if ($this->entryId === null) { + return; + } + $entry = $this->fetchTable(FeaturedPluginsTable::class)->get($this->entryId); + $this->package = $entry->package; + $this->draft = [ + 'enabled' => $entry->enabled, + 'logo' => $entry->logo ?? '', + 'title' => $entry->title ?? '', + 'description' => $entry->description ?? '', + ]; + } + + /** + * Only new entries can select a different canonical catalogue package. + */ + #[Action] + public function selectPackage(int $id): void + { + if ($this->entryId !== null) { + throw new BadRequestException('Existing featured entries cannot change package.'); + } + $this->package = $this->fetchTable(PackagesTable::class)->get($id)->package; + $this->packageSearch = ''; + } + + /** + * Delegate normalization, validation and creation rules to the model. + */ + #[Action] + public function save(): void + { + $table = $this->fetchTable(FeaturedPluginsTable::class); + $entry = $this->entryId !== null ? $table->get($this->entryId) : $table->newEmptyEntity(); + $this->entry = $table->patchEntity($entry, [ + ...$this->draft, + 'package' => $this->package, + ], [ + 'fields' => ['package', 'enabled', 'logo', 'title', 'description'], + ]); + if (!$table->save($this->entry)) { + $this->setErrors($this->entry->getErrors() ?: ['_form' => ['Unable to save this featured plugin.']]); + + return; + } + $this->dispatch('featured-plugin-saved'); + } + + /** + * Close the parent-owned modal without persisting the draft. + */ + #[Action(render: false)] + public function cancel(): void + { + $this->dispatch('featured-plugin-editor-closed'); + } + + /** + * Preview updates never execute the featured listing query. + * + * @return array + */ + public function viewData(): array + { + if (mb_strlen($this->packageSearch) > 100) { + throw new BadRequestException('Package search is too long.'); + } + $packages = $this->fetchTable(PackagesTable::class); + $table = $this->fetchTable(FeaturedPluginsTable::class); + + return [ + 'entry' => $this->entry ?? $table->newEntity([ + ...$this->draft, + 'package' => $this->package, + ], [ + 'fields' => ['package', 'enabled', 'logo', 'title', 'description'], + ]), + 'matches' => $this->entryId === null && $this->package === '' + ? $packages->find('featuredCandidates', search: $this->packageSearch)->limit(10)->all() + : [], + 'previewPackage' => $this->package !== '' ? $packages->find()->where(['package' => $this->package])->first() : null, + ]; + } +} diff --git a/plugins/Admin/src/Island/FeaturedPluginsIsland.php b/plugins/Admin/src/Island/FeaturedPluginsIsland.php index 248af3be..60c6e76b 100644 --- a/plugins/Admin/src/Island/FeaturedPluginsIsland.php +++ b/plugins/Admin/src/Island/FeaturedPluginsIsland.php @@ -5,7 +5,6 @@ use App\Model\Enum\FeaturedPluginStatus; use App\Model\Table\FeaturedPluginsTable; -use App\Model\Table\PackagesTable; use Cake\Http\Exception\BadRequestException; use Interact\Attribute\Action; use Interact\Attribute\Pagination; @@ -24,7 +23,10 @@ class FeaturedPluginsIsland extends AdminIsland #[Pagination( settings: [ 'limit' => 20, - 'order' => ['FeaturedPlugins.package' => 'asc', 'FeaturedPlugins.id' => 'asc'], + 'order' => [ + 'FeaturedPlugins.package' => 'asc', + 'FeaturedPlugins.id' => 'asc', + ], 'sortableFields' => [ 'package' => 'FeaturedPlugins.package', 'title' => 'FeaturedPlugins.title', @@ -33,8 +35,15 @@ class FeaturedPluginsIsland extends AdminIsland 'enabled' => 'FeaturedPlugins.enabled', ], ], - url: ['page' => 'page', 'sort' => 'sort', 'direction' => 'direction'], - defaults: ['sort' => 'package', 'direction' => 'asc'], + url: [ + 'page' => 'page', + 'sort' => 'sort', + 'direction' => 'direction', + ], + defaults: [ + 'sort' => 'package', + 'direction' => 'asc', + ], )] public PaginationState $paging; @@ -44,24 +53,6 @@ class FeaturedPluginsIsland extends AdminIsland #[State] public ?int $editingId = null; - #[State(writable: true)] - public string $packageSearch = ''; - - #[State] - public string $package = ''; - - #[State(writable: true)] - public bool $enabled = true; - - #[State(writable: true)] - public string $logo = ''; - - #[State(writable: true)] - public string $title = ''; - - #[State(writable: true)] - public string $description = ''; - #[State] public ?int $removingId = null; @@ -79,75 +70,34 @@ public function updated(UpdatedPaths $paths): void } /** - * Start an empty editorial draft. + * Mount a fresh child editor for a new feature. */ #[Action] public function create(): void { $this->editing = true; - $this->editingId = null; - $this->packageSearch = $this->package = $this->logo = $this->title = $this->description = $this->message = ''; - $this->enabled = true; - } - - /** - * Only existing catalogue entries may be selected for a new feature. - */ - #[Action] - public function selectPackage(int $id): void - { - if ($this->editingId !== null || !$this->editing) { - throw new BadRequestException('Start a new featured entry first.'); - } - $this->package = $this->fetchTable(PackagesTable::class)->get($id)->package; - $this->packageSearch = ''; + $this->editingId = $this->removingId = null; + $this->message = ''; } /** - * Load an existing entry, including entries missing from the catalogue. + * Key the editor by record so each entry receives a fresh draft. */ #[Action] public function edit(int $id): void { - $entry = $this->fetchTable(FeaturedPluginsTable::class)->get($id); $this->editing = true; $this->editingId = $id; - $this->package = $entry->package; - $this->enabled = $entry->enabled; - $this->logo = $entry->logo ?? ''; - $this->title = $entry->title ?? ''; - $this->description = $entry->description ?? ''; - $this->packageSearch = $this->message = ''; + $this->removingId = null; + $this->message = ''; } /** - * Validate and save plain-text overrides without changing imported metadata. + * Refresh the list only after a successful editor save. */ - #[Action] - public function save(): void + #[Action(on: 'featured-plugin-saved')] + public function saved(): void { - if (!$this->editing) { - throw new BadRequestException('Open the featured editor first.'); - } - $table = $this->fetchTable(FeaturedPluginsTable::class); - if ($this->editingId === null && !$this->fetchTable(PackagesTable::class)->exists(['package' => $this->package])) { - $this->setErrors(['package' => ['Choose an existing plugin.']]); - - return; - } - $entry = $this->editingId !== null ? $table->get($this->editingId) : $table->newEmptyEntity(); - $entry = $table->patchEntity($entry, [ - 'package' => $this->package, - 'enabled' => $this->enabled, - 'logo' => trim($this->logo) === '' ? null : trim($this->logo), - 'title' => trim($this->title) === '' ? null : trim($this->title), - 'description' => trim($this->description) === '' ? null : trim($this->description), - ]); - if (!$table->save($entry)) { - $this->setErrors($entry->getErrors() ?: ['_form' => ['Unable to save this featured plugin.']]); - - return; - } $this->cancel(); $this->message = 'Featured plugin saved.'; } @@ -155,7 +105,7 @@ public function save(): void /** * Discard the draft and any removal confirmation. */ - #[Action] + #[Action(on: 'featured-plugin-editor-closed')] public function cancel(): void { $this->editing = false; @@ -195,31 +145,14 @@ public function remove(): void public function viewData(): array { $status = FeaturedPluginStatus::tryFrom($this->status); - if (mb_strlen($this->search) > 100 || mb_strlen($this->packageSearch) > 100 || ($this->status !== '' && $status === null)) { + if (mb_strlen($this->search) > 100 || ($this->status !== '' && $status === null)) { throw new BadRequestException('Invalid featured plugin filters.'); } $table = $this->fetchTable(FeaturedPluginsTable::class); - $query = $table->find()->contain(['CataloguePackages']); - if (trim($this->search) !== '') { - $query->where(['FeaturedPlugins.package LIKE' => '%' . trim($this->search) . '%']); - } - if ($status === FeaturedPluginStatus::Unavailable) { - $query->where(['CataloguePackages.id IS' => null]); - } elseif ($status !== null) { - $query->where(['FeaturedPlugins.enabled' => $status === FeaturedPluginStatus::Enabled]); - } - $packages = $this->fetchTable(PackagesTable::class); - $matches = []; - if ($this->editing && $this->editingId === null && $this->package === '') { - $matches = $packages->find()->select(['id', 'package'])->where(['package LIKE' => '%' . trim($this->packageSearch) . '%']) - ->orderByAsc('package')->limit(10)->all(); - } + $query = $table->find('adminListing', search: $this->search, status: $status); return [ 'entries' => $this->paginate($query), - 'matches' => $matches, - 'previewLogo' => $this->logo !== '' && $table->getValidator()->validate(['logo' => $this->logo], false) === [] ? $this->logo : null, - 'previewPackage' => $this->editing && $this->package !== '' ? $packages->find()->where(['package' => $this->package])->first() : null, 'removingEntry' => $this->removingId !== null ? $table->get($this->removingId) : null, ]; } diff --git a/plugins/Admin/src/Island/UsersIsland.php b/plugins/Admin/src/Island/UsersIsland.php index d0e9ea90..f06ed060 100644 --- a/plugins/Admin/src/Island/UsersIsland.php +++ b/plugins/Admin/src/Island/UsersIsland.php @@ -26,7 +26,17 @@ class UsersIsland extends AdminIsland #[State(writable: true, url: true)] public string $status = ''; - #[Pagination(settings: ['limit' => 20, 'order' => ['Users.username' => 'asc']], url: ['page' => 'page'])] + #[Pagination( + settings: [ + 'limit' => 20, + 'order' => [ + 'Users.username' => 'asc', + ], + ], + url: [ + 'page' => 'page', + ], + )] public PaginationState $paging; #[State] @@ -137,7 +147,14 @@ public function viewData(): array $query = $table->find(); if (trim($this->search) !== '') { $search = '%' . trim($this->search) . '%'; - $query->where(['OR' => ['Users.username LIKE' => $search, 'Users.email LIKE' => $search, 'Users.first_name LIKE' => $search, 'Users.last_name LIKE' => $search]]); + $query->where([ + 'OR' => [ + 'Users.username LIKE' => $search, + 'Users.email LIKE' => $search, + 'Users.first_name LIKE' => $search, + 'Users.last_name LIKE' => $search, + ], + ]); } if ($roleFilter !== null) { $query->where(['Users.role' => $roleFilter]); diff --git a/plugins/Admin/templates/island/featured_plugin_editor.php b/plugins/Admin/templates/island/featured_plugin_editor.php new file mode 100644 index 00000000..e42100ed --- /dev/null +++ b/plugins/Admin/templates/island/featured_plugin_editor.php @@ -0,0 +1,106 @@ + $matches + * @var \App\Model\Entity\Package|null $previewPackage + * @var int|null $entryId + * @var string $package + * @var string $packageSearch + * @var array> $errors + */ +$this->Form->templater()->load('Admin.form-templates'); +?> +
+ +
+

+ element('Admin.feedback', [ + 'message' => '', + 'errors' => $errors, + ]) ?> + + Form->control('packageSearch', [ + 'id' => 'package-search', + 'type' => 'search', + 'class' => 'input w-full', + 'label' => __('Find a catalogue plugin'), + 'value' => $packageSearch, + 'maxlength' => 100, + 'x-interact:model.live' => 'packageSearch', + 'placeholder' => 'vendor/plugin', + 'autofocus' => true, + ]) ?> +
    + +
    • + +
+
+ +

+ Form->create($entry, [ + 'url' => false, + 'x-interact:model' => 'draft', + 'x-interact:submit' => '$server.call("save")', + ]) ?> +
+ Form->control('enabled', [ + 'type' => 'checkbox', + 'class' => 'toggle toggle-primary', + 'label' => [ + 'text' => __('Enabled'), + 'class' => 'label', + ], + 'hiddenField' => false, + ]) ?> + Form->control('title', [ + 'id' => 'featured-title', + 'class' => 'input w-full', + 'label' => __('Title override'), + 'maxlength' => 255, + 'x-interact:model.live' => '', + 'placeholder' => __('Use the plugin name'), + ]) ?> + Form->control('description', [ + 'id' => 'featured-description', + 'type' => 'textarea', + 'class' => 'textarea w-full', + 'label' => __('Description override'), + 'rows' => 3, + 'maxlength' => 2000, + 'x-interact:model.live' => '', + 'placeholder' => __('Use the imported description'), + ]) ?> + Form->control('logo', [ + 'id' => 'featured-logo', + 'class' => 'input w-full', + 'label' => __('Logo URL or path'), + 'maxlength' => 2048, + 'x-interact:model.live' => '', + 'placeholder' => 'https://… or /img/…', + ]) ?> +

+
+
+

+ element('Packages/plugin-avatar', [ + 'packageName' => $package, + 'logo' => $entry->logo, + 'plugin' => false, + ]) ?> +

title ?? substr($package, (int)strpos($package, '/') + 1)) ?>

+

description ?? $previewPackage->description ?? __('Plugin unavailable in the catalogue.')) ?>

+
+
+ + Form->button(__('Save featured plugin'), [ + 'class' => 'btn btn-primary', + ':disabled' => '$server.pending()', + ]) ?> +
+ Form->end() ?> + +
+ +
diff --git a/plugins/Admin/templates/island/featured_plugins.php b/plugins/Admin/templates/island/featured_plugins.php index 19f14f9c..b8887f61 100644 --- a/plugins/Admin/templates/island/featured_plugins.php +++ b/plugins/Admin/templates/island/featured_plugins.php @@ -2,25 +2,17 @@ /** * @var \App\View\IslandTemplateView $this * @var \Cake\Datasource\Paging\PaginatedInterface $entries - * @var iterable<\App\Model\Entity\Package> $matches - * @var \App\Model\Entity\Package|null $previewPackage * @var \App\Model\Entity\FeaturedPlugin|null $removingEntry * @var string $search * @var string $status * @var bool $editing * @var int|null $editingId - * @var string $package - * @var string $packageSearch - * @var bool $enabled - * @var string $logo - * @var string|null $previewLogo - * @var string $title - * @var string $description * @var string $message * @var array> $errors */ use App\Model\Enum\FeaturedPluginStatus; +$this->Form->templater()->load('Admin.form-templates'); ?>
@@ -31,13 +23,20 @@
- + Form->select('status', $this->Form->enumOptions(FeaturedPluginStatus::class), [ + 'class' => 'select w-auto', + 'aria-label' => __('Filter by status'), + 'empty' => __('All statuses'), + 'value' => $status, + 'x-interact:model.live' => 'status', + ]) ?>
@@ -76,48 +75,7 @@ element('Admin.paging') ?> - -
-

- element('Admin.feedback', ['message' => '', 'errors' => $errors]) ?> - - - -
    - -
    • - -
-
- -

- Form->create(null, ['url' => false, 'x-interact:submit' => '$server.call("save")']) ?> -
- - - - - - - -

-
-
-

- element('Packages/plugin-avatar', ['packageName' => $package, 'logo' => $previewLogo, 'plugin' => false]) ?> -

-

description ?? __('Plugin unavailable in the catalogue.'))) ?>

-
-
- - -
- Form->end() ?> - -
- + Interact->render('Admin.FeaturedPluginEditor', ['entryId' => $editingId], key: 'featured-editor-' . ($editingId ?? 'new')) ?> diff --git a/plugins/Admin/templates/island/users.php b/plugins/Admin/templates/island/users.php index cc285833..a6359336 100644 --- a/plugins/Admin/templates/island/users.php +++ b/plugins/Admin/templates/island/users.php @@ -16,6 +16,7 @@ use App\Model\Enum\UserRole; use App\Model\Enum\UserStatus; +$this->Form->templater()->load('Admin.form-templates'); ?>

@@ -24,18 +25,27 @@
- - + Form->select('roleFilter', $this->Form->enumOptions(UserRole::class), [ + 'class' => 'select w-auto', + 'aria-label' => __('Filter by role'), + 'empty' => __('All roles'), + 'value' => $roleFilter, + 'x-interact:model.live' => 'roleFilter', + ]) ?> + Form->select('status', $this->Form->enumOptions(UserStatus::class), [ + 'class' => 'select w-auto', + 'aria-label' => __('Filter by status'), + 'empty' => __('All statuses'), + 'value' => $status, + 'x-interact:model.live' => 'status', + ]) ?>
@@ -72,7 +82,10 @@

username)) ?>

- element('Admin.feedback', ['message' => '', 'errors' => $errors]) ?> + element('Admin.feedback', [ + 'message' => '', + 'errors' => $errors, + ]) ?>

label() ?? $role), h(UserStatus::fromActive($active)->label())) ?>

@@ -80,21 +93,38 @@
- Form->create(null, ['url' => false, 'x-interact:submit' => '$server.call("confirm")']) ?> -
- - - + Form->create(null, [ + 'url' => false, + 'x-interact:submit' => '$server.call("confirm")', + ]) ?> +
+ Form->control('role', [ + 'id' => 'user-role', + 'type' => 'select', + 'class' => 'select w-full', + 'label' => __('Role'), + 'options' => $this->Form->enumOptions(UserRole::class), + 'value' => $role, + 'x-interact:model' => 'role', + ]) ?> + Form->control('active', [ + 'type' => 'checkbox', + 'class' => 'toggle toggle-primary', + 'label' => [ + 'text' => __('Account active'), + 'class' => 'label', + ], + 'checked' => $active, + 'hiddenField' => false, + 'x-interact:model' => 'active', + ]) ?>
- + Form->button(__('Review change'), [ + 'class' => 'btn btn-primary', + ':disabled' => '$server.pending()', + ]) ?>
Form->end() ?> diff --git a/plugins/Admin/templates/layout/admin.php b/plugins/Admin/templates/layout/admin.php index 783abff6..6a1f75fa 100644 --- a/plugins/Admin/templates/layout/admin.php +++ b/plugins/Admin/templates/layout/admin.php @@ -4,6 +4,10 @@ */ $theme = $this->getRequest()->getCookie('theme') === 'cakephp-dark' ? 'cakephp-dark' : 'cakephp'; $controller = $this->getRequest()->getParam('controller'); +$navigation = [ + 'Users' => ['admin:users', __('Users')], + 'FeaturedPlugins' => ['admin:featured', __('Featured plugins')], +]; ?> @@ -13,8 +17,22 @@ <?= h($this->fetch('title')) ?> · CakePHP Plugins Admin Html->meta('icon') ?> - Vite->css(['files' => ['resources/css/style.css'], 'block' => false, 'attributes' => ['x-interact:asset' => 'reload', 'timestamp' => false]]) ?> - Vite->script(['files' => ['resources/js/app.js'], 'block' => false, 'attributes' => ['x-interact:asset' => 'reload', 'timestamp' => false]]) ?> + Vite->css([ + 'files' => ['resources/css/style.css'], + 'block' => false, + 'attributes' => [ + 'x-interact:asset' => 'reload', + 'timestamp' => false, + ], + ]) ?> + Vite->script([ + 'files' => ['resources/js/app.js'], + 'block' => false, + 'attributes' => [ + 'x-interact:asset' => 'reload', + 'timestamp' => false, + ], + ]) ?> fetch('script') ?> @@ -31,7 +49,14 @@
Interact->render('ThemeToggle', key: 'admin-theme') ?> - Html->link(__('Sign out'), ['plugin' => false, 'prefix' => false, 'controller' => 'Users', 'action' => 'logout'], ['class' => 'btn btn-ghost btn-sm']) ?> + Html->link(__('Sign out'), [ + 'plugin' => false, + 'prefix' => false, + 'controller' => 'Users', + 'action' => 'logout', + ], [ + 'class' => 'btn btn-ghost btn-sm', + ]) ?>
@@ -42,17 +67,20 @@
diff --git a/plugins/Admin/tests/TestCase/Island/AdminIslandsTest.php b/plugins/Admin/tests/TestCase/Island/AdminIslandsTest.php index 1b787b86..18cb81de 100644 --- a/plugins/Admin/tests/TestCase/Island/AdminIslandsTest.php +++ b/plugins/Admin/tests/TestCase/Island/AdminIslandsTest.php @@ -6,6 +6,7 @@ use App\Application; use App\Model\Enum\UserRole; use App\Model\Table\FeaturedPluginsTable; +use App\Model\Table\PackagesTable; use App\Model\Table\UsersTable; use Authentication\Identity; use Authorization\Exception\ForbiddenException; @@ -39,7 +40,10 @@ public function testUserManagement(): void { $island = $this->testIsland('Admin.Users', request: $this->adminRequest()); $island->set('search', 'member')->assertSee('member@example.com')->assertDontSee('suspended@example.com') - ->call('edit', 2)->fill(['role' => 'admin', 'active' => false])->call('confirm')->assertSet('confirming', true) + ->call('edit', 2)->fill([ + 'role' => 'admin', + 'active' => false, + ])->call('confirm')->assertSet('confirming', true) ->call('save')->assertSee('User access updated.'); $user = $this->fetchTable(UsersTable::class)->get(2); $this->assertSame(UserRole::Admin, $user->role); @@ -77,6 +81,17 @@ public function testRevokedSnapshotDenied(): void $island->call('create'); } + /** + * The independently mounted editor checks access on its own updates too. + */ + public function testRevokedEditorSnapshotDenied(): void + { + $island = $this->testIsland('Admin.FeaturedPluginEditor', ['entryId' => 1], request: $this->adminRequest()); + $this->fetchTable(UsersTable::class)->updateAll(['role' => 'user'], ['id' => 1]); + $this->expectException(ForbiddenException::class); + $island->set('draft.title', 'Unauthorized change')->call('save'); + } + /** * Guessing a plugin island name never grants access to guests. */ @@ -92,14 +107,21 @@ public function testGuestCannotMount(): void public function testFeaturedManagement(): void { $table = $this->fetchTable(FeaturedPluginsTable::class); - $island = $this->testIsland('Admin.FeaturedPlugins', request: $this->adminRequest()); - $island->call('create')->set('packageSearch', 'package-01')->assertSee('vendor/package-01')->call('selectPackage', 2) - ->fill(['title' => 'Our pick', 'description' => 'Editorial description', 'logo' => 'javascript:alert(1)'])->call('save')->assertHasErrors(['logo']); - $island->set('logo', '/img/pick.svg')->call('save')->assertSee('Featured plugin saved.'); + $request = $this->adminRequest(); + $editor = $this->testIsland('Admin.FeaturedPluginEditor', request: $request); + $editor->set('packageSearch', 'package-01')->assertSee('vendor/package-01')->call('selectPackage', 2) + ->fill([ + 'draft.title' => 'Our pick', + 'draft.description' => 'Editorial description', + 'draft.logo' => 'javascript:alert(1)', + ])->call('save')->assertHasErrors(['logo']); + $editor->set('draft.logo', '/img/pick.svg')->call('save')->assertDispatched('featured-plugin-saved'); $entry = $table->find()->where(['package' => 'vendor/package-01'])->firstOrFail(); $this->assertSame('Our pick', $entry->title); - $island->call('edit', $entry->id)->set('enabled', false)->call('save'); + $this->testIsland('Admin.FeaturedPluginEditor', ['entryId' => $entry->id], request: $request) + ->set('draft.enabled', false)->call('save')->assertDispatched('featured-plugin-saved'); $this->assertFalse($table->get($entry->id)->enabled); + $island = $this->testIsland('Admin.FeaturedPlugins', request: $request); $island->call('confirmRemoval', $entry->id)->assertSee('Confirm removal')->call('remove'); $this->assertFalse($table->exists(['id' => $entry->id])); } @@ -109,7 +131,30 @@ public function testFeaturedManagement(): void */ public function testDuplicateFeaturedEntry(): void { - $this->testIsland('Admin.FeaturedPlugins', request: $this->adminRequest())->call('create')->call('selectPackage', 1)->call('save')->assertHasErrors(['package']); + $this->testIsland('Admin.FeaturedPluginEditor', request: $this->adminRequest()) + ->call('selectPackage', 1)->call('save')->assertHasErrors(['package']); + } + + /** + * Whole-form drafts still use ORM validation and cannot change the selection. + */ + public function testFeaturedDraftValidationAndFieldRestrictions(): void + { + $editor = $this->testIsland('Admin.FeaturedPluginEditor', ['entryId' => 1], request: $this->adminRequest()); + $editor->fill([ + 'draft.logo' => ['invalid'], + 'draft.title' => ['invalid'], + ])->call('save')->assertHasErrors(['logo', 'title']); + $editor->fill([ + 'draft.logo' => '', + 'draft.title' => 'Editorial title', + 'draft.package' => 'cakedc/users', + 'draft.id' => 2, + ])->call('save')->assertDispatched('featured-plugin-saved'); + $table = $this->fetchTable(FeaturedPluginsTable::class); + $this->assertSame('markstory/asset_compress', $table->get(1)->package); + $this->assertSame('Editorial title', $table->get(1)->title); + $this->assertNull($table->get(2)->title); } /** @@ -118,10 +163,16 @@ public function testDuplicateFeaturedEntry(): void public function testFeaturedCountSorting(): void { $island = $this->testIsland('Admin.FeaturedPlugins', request: $this->adminRequest()); - $island->fill(['paging.sort' => 'stars', 'paging.direction' => 'asc']); + $island->fill([ + 'paging.sort' => 'stars', + 'paging.direction' => 'asc', + ]); preg_match_all('/data-featured-id="(\d+)"/', $island->result()->html, $matches); $this->assertSame(['3', '1', '2'], $matches[1]); - $island->fill(['paging.sort' => 'downloads', 'paging.direction' => 'desc']); + $island->fill([ + 'paging.sort' => 'downloads', + 'paging.direction' => 'desc', + ]); preg_match_all('/data-featured-id="(\d+)"/', $island->result()->html, $matches); $this->assertSame(['3', '2', '1'], $matches[1]); } @@ -132,9 +183,12 @@ public function testFeaturedCountSorting(): void public function testUnavailableEntry(): void { $table = $this->fetchTable(FeaturedPluginsTable::class); - $entry = $table->saveOrFail($table->newEntity(['package' => 'missing/package', 'enabled' => true])); - $this->testIsland('Admin.FeaturedPlugins', request: $this->adminRequest())->set('status', 'unavailable') - ->assertSee('missing/package')->assertDontSee('markstory/asset_compress')->call('edit', $entry->id)->set('enabled', false)->call('save'); - $this->assertFalse($table->get($entry->id)->enabled); + $request = $this->adminRequest(); + $this->fetchTable(PackagesTable::class)->deleteAll(['package' => 'markstory/asset_compress']); + $this->testIsland('Admin.FeaturedPlugins', request: $request)->set('status', 'unavailable') + ->assertSee('markstory/asset_compress')->assertDontSee('cakedc/users'); + $this->testIsland('Admin.FeaturedPluginEditor', ['entryId' => 1], request: $request) + ->set('draft.enabled', false)->call('save')->assertDispatched('featured-plugin-saved'); + $this->assertFalse($table->get(1)->enabled); } } diff --git a/src/Model/Entity/FeaturedPlugin.php b/src/Model/Entity/FeaturedPlugin.php index f08411b8..5343126f 100644 --- a/src/Model/Entity/FeaturedPlugin.php +++ b/src/Model/Entity/FeaturedPlugin.php @@ -25,4 +25,38 @@ class FeaturedPlugin extends Entity 'title' => true, 'description' => true, ]; + + /** + * Persist an omitted logo as null, consistently for every ORM caller. + */ + protected function _setLogo(?string $value): ?string + { + return $this->normalizeOverride($value); + } + + /** + * Blank editorial titles fall back to the catalogue name. + */ + protected function _setTitle(?string $value): ?string + { + return $this->normalizeOverride($value); + } + + /** + * Blank editorial descriptions fall back to imported metadata. + */ + protected function _setDescription(?string $value): ?string + { + return $this->normalizeOverride($value); + } + + /** + * Preserve nonempty values, including the string "0". + */ + private function normalizeOverride(?string $value): ?string + { + $value = $value !== null ? trim($value) : ''; + + return $value === '' ? null : $value; + } } diff --git a/src/Model/Table/FeaturedPluginsTable.php b/src/Model/Table/FeaturedPluginsTable.php index cf25e85f..ec18b6be 100644 --- a/src/Model/Table/FeaturedPluginsTable.php +++ b/src/Model/Table/FeaturedPluginsTable.php @@ -3,6 +3,10 @@ namespace App\Model\Table; +use App\Model\Enum\FeaturedPluginStatus; +use ArrayObject; +use Cake\Event\EventInterface; +use Cake\ORM\Query\SelectQuery; use Cake\ORM\RulesChecker; use Cake\ORM\Table; use Cake\Validation\Validator; @@ -29,7 +33,12 @@ public function initialize(array $config): void parent::initialize($config); $this->setDisplayField('package'); $this->addBehavior('Timestamp'); - $this->belongsTo('CataloguePackages', ['className' => 'Packages', 'foreignKey' => 'package', 'bindingKey' => 'package', 'propertyName' => 'catalogue_package']); + $this->belongsTo('CataloguePackages', [ + 'className' => PackagesTable::class, + 'foreignKey' => 'package', + 'bindingKey' => 'package', + 'propertyName' => 'catalogue_package', + ]); } /** @@ -44,19 +53,62 @@ public function validationDefault(Validator $validator): Validator ->scalar('description')->maxLength('description', 2000)->allowEmptyString('description') ->scalar('logo')->maxLength('logo', 2048)->allowEmptyString('logo') ->add('logo', 'imageLocation', [ - 'rule' => static fn(string $value): bool => (str_starts_with($value, 'https://') && filter_var($value, FILTER_VALIDATE_URL) !== false) - || (bool)preg_match('#^/img/[a-zA-Z0-9_./-]+$#D', $value) && !str_contains($value, '..'), + 'rule' => static fn(mixed $value): bool => is_string($value) && ( + (str_starts_with($value, 'https://') && filter_var($value, FILTER_VALIDATE_URL) !== false) + || (bool)preg_match('#^/img/[a-zA-Z0-9_./-]+$#D', $value) && !str_contains($value, '..') + ), 'message' => 'Use an HTTPS URL or a local /img/ path.', ]); } + /** + * Validate the same trimmed override values that entity setters persist. + * + * @param \Cake\Event\EventInterface $event Marshal event. + * @param \ArrayObject $data Input fields. + * @param \ArrayObject $options Marshal options. + */ + public function beforeMarshal(EventInterface $event, ArrayObject $data, ArrayObject $options): void + { + foreach (['logo', 'title', 'description'] as $field) { + if (isset($data[$field]) && is_string($data[$field])) { + $data[$field] = trim($data[$field]); + } + } + } + /** * The unique index also protects concurrent additions. */ public function buildRules(RulesChecker $rules): RulesChecker { $rules->add($rules->isUnique(['package']), ['errorField' => 'package']); + $rules->addCreate($rules->existsIn(['package'], 'CataloguePackages'), 'cataloguePackage', [ + 'errorField' => 'package', + 'message' => 'Choose an existing plugin.', + ]); return $rules; } + + /** + * Build the management listing with catalogue counts and availability. + * + * @param \Cake\ORM\Query\SelectQuery<\App\Model\Entity\FeaturedPlugin> $query Featured entry query. + * @return \Cake\ORM\Query\SelectQuery<\App\Model\Entity\FeaturedPlugin> + */ + public function findAdminListing(SelectQuery $query, string $search = '', ?FeaturedPluginStatus $status = null): SelectQuery + { + $query->contain(['CataloguePackages']); + if (trim($search) !== '') { + $query->where(['FeaturedPlugins.package LIKE' => '%' . trim($search) . '%']); + } + if ($status === FeaturedPluginStatus::Unavailable) { + $query->where(['CataloguePackages.id IS' => null]); + } elseif ($status instanceof FeaturedPluginStatus) { + $query->where(['FeaturedPlugins.enabled' => $status === FeaturedPluginStatus::Enabled]); + } + + return $query; + } } diff --git a/src/Model/Table/PackagesTable.php b/src/Model/Table/PackagesTable.php index 54b3475d..77924cdc 100644 --- a/src/Model/Table/PackagesTable.php +++ b/src/Model/Table/PackagesTable.php @@ -144,6 +144,19 @@ public function findFeatured(SelectQuery $query, array $names): SelectQuery ->contain(['Categories', 'Tags' => static fn(SelectQuery $tags) => $tags->orderByDesc('Tags.label')]); } + /** + * Search canonical package names for the featured editor's picker. + * + * @param \Cake\ORM\Query\SelectQuery<\App\Model\Entity\Package> $query Package query. + * @return \Cake\ORM\Query\SelectQuery<\App\Model\Entity\Package> + */ + public function findFeaturedCandidates(SelectQuery $query, string $search = ''): SelectQuery + { + return $query->select(['id', 'package']) + ->where(['package LIKE' => '%' . trim($search) . '%']) + ->orderByAsc('package'); + } + /** * @return array Imported categories and their directory-wide package counts. */ diff --git a/tests/TestCase/Island/FeaturedPluginsIslandTest.php b/tests/TestCase/Island/FeaturedPluginsIslandTest.php index f71384bd..610a02d4 100644 --- a/tests/TestCase/Island/FeaturedPluginsIslandTest.php +++ b/tests/TestCase/Island/FeaturedPluginsIslandTest.php @@ -33,9 +33,9 @@ public function testSelectionOrderSurvivesRefresh(): void public function testMissingSelectionHasNoFeaturedEntries(): void { $table = $this->fetchTable(FeaturedPluginsTable::class); - $table->deleteAll([]); + $this->fetchTable(PackagesTable::class)->deleteAll([]); $this->testIsland('FeaturedPlugins')->assertDontSee('data-featured-plugins'); - $table->saveOrFail($table->newEntity(['package' => 'missing/package', 'enabled' => true])); + $table->deleteAll([]); $this->testIsland('FeaturedPlugins')->assertDontSee('data-featured-plugins'); } diff --git a/tests/TestCase/Model/Table/FeaturedPluginsTableTest.php b/tests/TestCase/Model/Table/FeaturedPluginsTableTest.php new file mode 100644 index 00000000..3d963426 --- /dev/null +++ b/tests/TestCase/Model/Table/FeaturedPluginsTableTest.php @@ -0,0 +1,110 @@ +fetchTable(FeaturedPluginsTable::class); + foreach (['missing/package', 'markstory/asset_compress'] as $package) { + $entry = $table->newEntity([ + 'package' => $package, + 'enabled' => true, + ]); + $this->assertFalse($table->save($entry)); + $this->assertNotEmpty($entry->getError('package')); + } + $entry = $table->newEntity([ + 'package' => 'vendor/package-01', + 'enabled' => true, + ]); + $this->assertNotFalse($table->save($entry)); + } + + /** + * Catalogue deletion does not prevent later editorial changes. + */ + public function testUnavailableEntriesRemainEditable(): void + { + $this->fetchTable(PackagesTable::class)->deleteAll(['package' => 'markstory/asset_compress']); + $table = $this->fetchTable(FeaturedPluginsTable::class); + $entry = $table->patchEntity($table->get(1), [ + 'enabled' => false, + 'title' => 'Still curated', + ]); + $table->saveOrFail($entry); + $this->assertFalse($table->get(1)->enabled); + $this->assertSame('Still curated', $table->get(1)->title); + } + + /** + * Model normalization preserves the old editor's trimming and null fallbacks. + */ + public function testOverridesAreNormalizedBeforeValidationAndPersistence(): void + { + $table = $this->fetchTable(FeaturedPluginsTable::class); + $entry = $table->patchEntity($table->get(1), [ + 'logo' => ' /img/pick.svg ', + 'title' => ' Our pick ', + 'description' => ' ', + ]); + $table->saveOrFail($entry); + $entry = $table->get(1); + $this->assertSame('/img/pick.svg', $entry->logo); + $this->assertSame('Our pick', $entry->title); + $this->assertNull($entry->description); + $table->saveOrFail($table->patchEntity($entry, [ + 'logo' => ' ', + 'title' => ' ', + 'description' => '0', + ])); + $entry = $table->get(1); + $this->assertNull($entry->logo); + $this->assertNull($entry->title); + $this->assertSame('0', $entry->description); + } + + /** + * An unfinished or unsafe logo uses the fallback instead of an image URL. + */ + public function testInvalidLogosAreExcludedFromPreviewEntities(): void + { + $table = $this->fetchTable(FeaturedPluginsTable::class); + $this->assertSame('/img/pick.svg', $table->newEntity(['logo' => ' /img/pick.svg '])->logo); + $this->assertSame('https://example.com/logo.svg', $table->newEntity(['logo' => 'https://example.com/logo.svg'])->logo); + foreach (['', ' ', 'https://', 'javascript:alert(1)', '/img/../private.svg'] as $logo) { + $this->assertNull($table->newEntity(['logo' => $logo])->logo); + } + } + + /** + * Listing filters share one query with the catalogue association. + */ + public function testAdminListingFilters(): void + { + $table = $this->fetchTable(FeaturedPluginsTable::class); + $table->updateAll(['enabled' => false], ['id' => 2]); + $this->fetchTable(PackagesTable::class)->deleteAll(['package' => 'markstory/asset_compress']); + $this->assertSame(2, $table->find('adminListing', status: FeaturedPluginStatus::Enabled)->count()); + $this->assertSame(1, $table->find('adminListing', status: FeaturedPluginStatus::Disabled)->count()); + $missing = $table->find('adminListing', status: FeaturedPluginStatus::Unavailable)->firstOrFail(); + $this->assertSame(1, $missing->id); + $this->assertNull($missing->catalogue_package); + $this->assertSame(1, $table->find('adminListing', search: ' cakedc ')->count()); + $this->assertSame(0, $table->find('adminListing', search: 'cakedc', status: FeaturedPluginStatus::Enabled)->count()); + } +} diff --git a/tests/TestCase/Model/Table/PackagesTableTest.php b/tests/TestCase/Model/Table/PackagesTableTest.php index 90ef05e4..2dd75ff5 100644 --- a/tests/TestCase/Model/Table/PackagesTableTest.php +++ b/tests/TestCase/Model/Table/PackagesTableTest.php @@ -68,4 +68,17 @@ public function testCatalogueContainsEveryPackage(): void $this->assertSame(26, $packages->find('catalogue', filters: [])->count()); $this->assertSame(0, $packages->find('catalogue', filters: ['search' => 'no-matching-plugin'])->count()); } + + /** + * The editorial picker searches canonical names in a stable order. + */ + public function testFeaturedCandidates(): void + { + $results = $this->fetchTable(PackagesTable::class)->find('featuredCandidates', search: ' package-0 ')->all(); + $this->assertSame([ + 'vendor/package-01', 'vendor/package-02', 'vendor/package-03', + 'vendor/package-04', 'vendor/package-05', 'vendor/package-06', + 'vendor/package-07', 'vendor/package-08', 'vendor/package-09', + ], $results->extract('package')->toList()); + } } diff --git a/tests/browser/admin.spec.js b/tests/browser/admin.spec.js index 53e5b0f9..a508bf6f 100644 --- a/tests/browser/admin.spec.js +++ b/tests/browser/admin.spec.js @@ -54,8 +54,16 @@ test('featured editorial changes, preview and removal reach public cards', async await expect(page.getByRole('columnheader', { name: 'GitHub stars', exact: true })).toBeVisible() await expect(row.getByRole('cell', { name: '450', exact: true })).toBeVisible() await expect(row.getByRole('cell', { name: '5,000', exact: true })).toBeVisible() + const listingId = await row.evaluate(element => element.closest('[data-interact-id]').dataset.interactId) await row.getByRole('button', { name: 'Edit', exact: true }).click() const dialog = page.getByRole('dialog') + const editorId = await dialog.evaluate(element => element.closest('[data-interact-id]').dataset.interactId) + expect(editorId).not.toBe(listingId) + const previewResponses = [] + const trackPreview = response => { + if (response.url().endsWith('/_interact/update')) previewResponses.push(response.json()) + } + page.on('response', trackPreview) const preview = dialog.getByRole('region', { name: 'Card preview' }) await dialog.getByLabel('Title override').fill('Community favourite') await expect(preview).toContainText('Community favourite') @@ -63,12 +71,17 @@ test('featured editorial changes, preview and removal reach public cards', async await expect(preview).toContainText('A curated description.') await dialog.getByLabel('Logo URL or path').fill('/img/cake.logo.svg') await expect(preview.locator('img')).toHaveAttribute('src', /^\/img\/cake\.logo\.svg(?:\?\d+)?$/) + page.off('response', trackPreview) + const previewUpdates = await Promise.all(previewResponses) + expect(previewUpdates.length).toBeGreaterThanOrEqual(3) + expect(previewUpdates.every(update => update.id === editorId)).toBe(true) await expect(dialog.getByRole('button', { name: 'Preview', exact: true })).toHaveCount(0) await expect(row).not.toContainText('Community favourite') await expect(dialog.locator('section + .modal-action').getByRole('button', { name: 'Save featured plugin' })).toHaveCount(1) await page.screenshot({ path: 'tmp/admin-featured-editor.png', fullPage: true, animations: 'disabled' }) await dialog.getByRole('button', { name: 'Save featured plugin' }).click() await expect(dialog).toHaveCount(0) + await expect(row).toContainText('Community favourite') await page.goto('/') await expect(page.locator('[data-featured-plugins]')).toContainText('Community favourite') await expect(page.locator('[data-featured-plugins]')).toContainText('A curated description.') @@ -78,6 +91,29 @@ test('featured editorial changes, preview and removal reach public cards', async await expect(row).toHaveCount(0) }) +test('cancel discards the editor draft and saving retains listing filters and sort', async ({ page, context }) => { + await signIn(context) + await page.goto('/admin/featured-plugins?search=markstory&status=enabled&sort=stars&direction=desc') + const row = page.locator('[data-featured-id="1"]') + const dialog = page.getByRole('dialog') + await row.getByRole('button', { name: 'Edit', exact: true }).click() + await dialog.getByLabel('Title override').fill('Discard this draft') + await expect(dialog.getByRole('region', { name: 'Card preview' })).toContainText('Discard this draft') + await dialog.getByRole('button', { name: 'Cancel', exact: true }).click() + await expect(dialog).toHaveCount(0) + await row.getByRole('button', { name: 'Edit', exact: true }).click() + await expect(dialog.getByLabel('Title override')).toHaveValue('') + await dialog.getByLabel('Title override').fill('Saved title') + await dialog.getByRole('button', { name: 'Save featured plugin' }).click() + await expect(dialog).toHaveCount(0) + await expect(row).toContainText('Saved title') + await expect(page).toHaveURL(/search=markstory/) + await expect(page).toHaveURL(/status=enabled/) + await expect(page).toHaveURL(/sort=stars/) + await expect(page).toHaveURL(/direction=desc/) + await expect(page.locator('tbody tr')).toHaveCount(1) +}) + test('admin updates reject access revoked after mounting', async ({ page, context }) => { await signIn(context) await page.goto('/admin/featured-plugins') @@ -137,9 +173,12 @@ test('featured columns sort in place and retain filters', async ({ page, context }) test('mobile sidebar and theme preference work across admin and frontend', async ({ page, context }) => { + const browserErrors = [] + page.on('pageerror', error => browserErrors.push(error.message)) await signIn(context) await page.setViewportSize({ width: 390, height: 844 }) await page.goto('/admin/users') + await page.evaluate(() => { window.adminNavigationMarker = 'retained' }) const toggle = page.getByRole('button', { name: 'Open navigation' }) await toggle.focus() await page.keyboard.press('Enter') @@ -148,8 +187,26 @@ test('mobile sidebar and theme preference work across admin and frontend', async await page.screenshot({ path: 'tmp/admin-mobile-navigation.png', fullPage: true, animations: 'disabled' }) await page.getByRole('link', { name: 'Featured plugins', exact: true }).click() await expect(page.getByRole('heading', { name: 'Featured plugins', exact: true })).toBeVisible() + await expect(toggle).toHaveAttribute('aria-expanded', 'false') + await toggle.click() + await expect(page.getByRole('link', { name: 'Featured plugins', exact: true })).toHaveAttribute('aria-current', 'page') + await page.getByRole('link', { name: 'Users', exact: true }).click() + await expect(page.getByRole('heading', { name: 'Users', exact: true })).toBeVisible() + await expect(toggle).toHaveAttribute('aria-expanded', 'false') await page.getByRole('button', { name: 'Toggle theme' }).click() await expect(page.locator('html')).toHaveAttribute('data-theme', 'cakephp-dark') - await page.goto('/') + await toggle.click() + await page.getByRole('link', { name: 'View site' }).click() + await expect(page).toHaveURL('/') await expect(page.locator('html')).toHaveAttribute('data-theme', 'cakephp-dark') + expect(await page.evaluate(() => window.adminNavigationMarker)).toBe('retained') + await page.goBack() + await expect(page.getByRole('heading', { name: 'Users', exact: true })).toBeVisible() + await expect(toggle).toHaveAttribute('aria-expanded', 'false') + await toggle.click() + await expect(page.getByRole('link', { name: 'Users', exact: true })).toHaveAttribute('aria-current', 'page') + await page.getByRole('link', { name: 'CakePHP Plugins', exact: true }).click() + await expect(page).toHaveURL('/') + expect(await page.evaluate(() => window.adminNavigationMarker)).toBe('retained') + expect(browserErrors).toEqual([]) }) From a77ea28249cf1ea5ff5f36bf13edb7cb64555cf6 Mon Sep 17 00:00:00 2001 From: Jasper Smet Date: Fri, 13 Nov 2026 12:06:57 +0100 Subject: [PATCH 4/6] Use native CakePHP session and request authorization --- README.md | 4 ++ .../Controller/AdminControllerTest.php | 59 +++++++++++++++++-- .../TestCase/Island/AdminIslandsTest.php | 3 +- src/Application.php | 34 ++++++++--- src/Middleware/AdminAccessMiddleware.php | 37 ------------ src/Middleware/RefreshIdentityMiddleware.php | 39 ------------ src/Policy/RequestPolicy.php | 6 +- tests/browser/admin-state.php | 6 +- tests/browser/admin.spec.js | 28 ++++++--- 9 files changed, 115 insertions(+), 101 deletions(-) delete mode 100644 src/Middleware/AdminAccessMiddleware.php delete mode 100644 src/Middleware/RefreshIdentityMiddleware.php diff --git a/README.md b/README.md index 7f4015f1..8558ff48 100644 --- a/README.md +++ b/README.md @@ -105,6 +105,10 @@ The local `Admin` plugin provides `/admin/users` and `/admin/featured-plugins`. It reuses GitHub sign-in, the public theme preference, and Interact's standard update endpoint. Every admin island checks current authorization on every request. Sidebar links use Interact navigation, including the return to the public site. +CakePHP's request authorization middleware protects admin pages. Authentication's +`PrimaryKeySession` reloads active users on each request; SocialAuth stores only +their ID in `AuthId`. Existing full-identity sessions require signing in again +after deploying this change. The plugin owns the admin interface; shared models, migrations, and access services remain in the application. diff --git a/plugins/Admin/tests/TestCase/Controller/AdminControllerTest.php b/plugins/Admin/tests/TestCase/Controller/AdminControllerTest.php index 31b592bd..b42c8be6 100644 --- a/plugins/Admin/tests/TestCase/Controller/AdminControllerTest.php +++ b/plugins/Admin/tests/TestCase/Controller/AdminControllerTest.php @@ -3,6 +3,8 @@ namespace Admin\Test\TestCase\Controller; +use App\Model\Enum\UserRole; +use App\Model\Table\UsersTable; use Cake\TestSuite\IntegrationTestTrait; use Cake\TestSuite\TestCase; @@ -26,7 +28,7 @@ public function testGuestRedirect(): void */ public function testUserForbidden(): void { - $this->session(['Auth' => ['id' => 2]]); + $this->session(['AuthId' => 2]); $this->get('/admin/users'); $this->assertResponseCode(403); } @@ -36,7 +38,7 @@ public function testUserForbidden(): void */ public function testAdminPages(): void { - $this->session(['Auth' => ['id' => 1]]); + $this->session(['AuthId' => 1]); $this->get('/admin/users'); $this->assertResponseOk(); $this->assertResponseContains('Admin navigation'); @@ -48,24 +50,69 @@ public function testAdminPages(): void } /** - * A previously privileged session is refreshed before policy evaluation. + * ID-only authentication reloads role and active status on each request. */ public function testStaleRoleAndSuspension(): void { - $this->session(['Auth' => ['id' => 2, 'role' => 'admin', 'is_active' => true]]); + $this->session(['AuthId' => 1]); + $this->get('/admin/users'); + $this->assertResponseOk(); + $table = $this->fetchTable(UsersTable::class); + $table->updateAll(['role' => UserRole::User], ['id' => 1]); $this->get('/admin/users'); $this->assertResponseCode(403); - $this->session(['Auth' => ['id' => 3, 'role' => 'admin', 'is_active' => true]]); + $table->updateAll([ + 'role' => UserRole::Admin, + 'is_active' => false, + ], ['id' => 1]); $this->get('/admin/users'); $this->assertRedirect('/?redirect=%2Fadmin%2Fusers'); } + /** + * Full-identity sessions from the old authenticator are never interpreted as IDs. + */ + public function testLegacySessionRequiresSignIn(): void + { + $this->session([ + 'Auth' => [ + 'id' => 1, + 'role' => 'admin', + 'is_active' => true, + ], + ]); + $this->get('/admin/users'); + $this->assertRedirect('/?redirect=%2Fadmin%2Fusers'); + } + + /** + * Deleted accounts cannot continue using an existing authenticated session. + */ + public function testDeletedUserCannotAccessAdmin(): void + { + $this->session(['AuthId' => 1]); + $this->fetchTable(UsersTable::class)->deleteAll(['id' => 1]); + $this->get('/admin/users'); + $this->assertRedirect('/?redirect=%2Fadmin%2Fusers'); + } + + /** + * The existing logout action clears the native ID-only session. + */ + public function testLogoutClearsIdentity(): void + { + $this->session(['AuthId' => 1]); + $this->get('/users/logout'); + $this->assertRedirect('/'); + $this->assertSession(null, 'AuthId'); + } + /** * Even authenticated admin updates require CSRF. */ public function testCsrf(): void { - $this->session(['Auth' => ['id' => 1]]); + $this->session(['AuthId' => 1]); $this->post('/_interact/update', []); $this->assertResponseCode(403); } diff --git a/plugins/Admin/tests/TestCase/Island/AdminIslandsTest.php b/plugins/Admin/tests/TestCase/Island/AdminIslandsTest.php index 18cb81de..9deb5f29 100644 --- a/plugins/Admin/tests/TestCase/Island/AdminIslandsTest.php +++ b/plugins/Admin/tests/TestCase/Island/AdminIslandsTest.php @@ -10,6 +10,7 @@ use App\Model\Table\UsersTable; use Authentication\Identity; use Authorization\Exception\ForbiddenException; +use Authorization\Exception\MissingIdentityException; use Authorization\Identity as AuthorizedIdentity; use Cake\Http\ServerRequest; use Cake\TestSuite\TestCase; @@ -97,7 +98,7 @@ public function testRevokedEditorSnapshotDenied(): void */ public function testGuestCannotMount(): void { - $this->expectException(ForbiddenException::class); + $this->expectException(MissingIdentityException::class); $this->testIsland('Admin.Users', request: $this->adminRequest(null)); } diff --git a/src/Application.php b/src/Application.php index 630ee6e2..103a7f8a 100644 --- a/src/Application.php +++ b/src/Application.php @@ -20,10 +20,9 @@ use App\Command\SyncPackagesCommand; use App\Event\AfterGithubIdentify; use App\Http\RateLimit\AtomicFixedWindowRateLimiter; -use App\Middleware\AdminAccessMiddleware; -use App\Middleware\RefreshIdentityMiddleware; use App\Middleware\ThemeCookieMiddleware; use App\Model\Table\PackagesTable; +use App\Model\Table\UsersTable; use App\Policy\RequestPolicy; use App\Service\AwesomeListImporter; use App\Service\AwesomeListParser; @@ -35,7 +34,9 @@ use Authorization\AuthorizationService; use Authorization\AuthorizationServiceInterface; use Authorization\AuthorizationServiceProviderInterface; +use Authorization\Exception\MissingIdentityException; use Authorization\Middleware\AuthorizationMiddleware; +use Authorization\Middleware\RequestAuthorizationMiddleware; use Authorization\Policy\MapResolver; use Cake\Core\Configure; use Cake\Core\ContainerInterface; @@ -124,11 +125,12 @@ public function middleware(MiddlewareQueue $middlewareQueue): MiddlewareQueue ->add($csrf) ->add(new ThemeCookieMiddleware()) - ->add(new RefreshIdentityMiddleware()) ->add(new SocialAuthMiddleware([ 'finder' => 'active', 'loginUrl' => '/', + 'userId' => true, + 'sessionKey' => 'AuthId', // SocialConnect Auth service's providers config. https://github.com/SocialConnect/auth/blob/master/README.md 'serviceConfig' => [ 'provider' => [ @@ -152,7 +154,14 @@ public function middleware(MiddlewareQueue $middlewareQueue): MiddlewareQueue ->add(new AuthenticationMiddleware($this)) ->add(new AuthorizationMiddleware($this)) - ->add(new AdminAccessMiddleware()); + ->add(new RequestAuthorizationMiddleware([ + 'unauthorizedHandler' => [ + 'className' => 'Authorization.Redirect', + 'exceptions' => [MissingIdentityException::class], + 'url' => '/', + 'queryParam' => 'redirect', + ], + ])); $requestProtection = (array)Configure::read('PublicRequestProtection', []); $trustedProxyIps = (array)($requestProtection['trustedProxyIps'] ?? []); @@ -249,9 +258,20 @@ public function getAuthenticationService(ServerRequestInterface $request): Authe 'queryParam' => 'redirect', ]); - // Load the authenticators. Session should be first. - // Session just uses session data directly as identity, no identifier needed. - $service->loadAuthenticator('Authentication.Session'); + // Resolve current access on each request; legacy full-identity sessions are ignored. + $service->loadAuthenticator('Authentication.PrimaryKeySession', [ + 'sessionKey' => 'AuthId', + 'identifier' => [ + 'className' => 'Authentication.Token', + 'tokenField' => 'id', + 'dataField' => 'key', + 'resolver' => [ + 'className' => 'Authentication.Orm', + 'userModel' => UsersTable::class, + 'finder' => 'active', + ], + ], + ]); return $service; } diff --git a/src/Middleware/AdminAccessMiddleware.php b/src/Middleware/AdminAccessMiddleware.php deleted file mode 100644 index 5de8a7ca..00000000 --- a/src/Middleware/AdminAccessMiddleware.php +++ /dev/null @@ -1,37 +0,0 @@ -getAttribute('identity'); - if (!$request->getAttribute('authorization')->can($identity, 'access', $request)) { - if ($identity === null) { - if (in_array($request->getMethod(), ['GET', 'HEAD'], true)) { - return new Response()->withLocation('/?redirect=' . rawurlencode($request->getRequestTarget())); - } - throw new UnauthorizedException('Sign in to continue.'); - } - throw new ForbiddenException('Administrator access is required.'); - } - - return $handler->handle($request); - } -} diff --git a/src/Middleware/RefreshIdentityMiddleware.php b/src/Middleware/RefreshIdentityMiddleware.php deleted file mode 100644 index 58a16ef3..00000000 --- a/src/Middleware/RefreshIdentityMiddleware.php +++ /dev/null @@ -1,39 +0,0 @@ -getAttribute('session'); - $id = $session->read('Auth.id'); - if ($id !== null) { - $user = $this->fetchTable(UsersTable::class)->find()->where(['id' => $id, 'is_active' => true])->first(); - if ($user === null) { - $session->delete('Auth'); - $session->renew(); - } else { - $session->write('Auth', $user); - } - } - - return $handler->handle($request); - } -} diff --git a/src/Policy/RequestPolicy.php b/src/Policy/RequestPolicy.php index a21ce08a..d251804f 100644 --- a/src/Policy/RequestPolicy.php +++ b/src/Policy/RequestPolicy.php @@ -5,6 +5,7 @@ use App\Model\Enum\UserRole; use App\Model\Table\UsersTable; +use Authorization\Exception\MissingIdentityException; use Authorization\IdentityInterface; use Authorization\Policy\RequestPolicyInterface; use Cake\Http\ServerRequest; @@ -25,8 +26,11 @@ public function canAccess(?IdentityInterface $identity, ServerRequest $request): if ($request->getParam('plugin') !== 'Admin') { return true; } + if (!$identity instanceof IdentityInterface) { + throw new MissingIdentityException(['identity']); + } - return $identity instanceof IdentityInterface && $this->fetchTable(UsersTable::class)->exists([ + return $this->fetchTable(UsersTable::class)->exists([ 'id' => $identity['id'], 'role' => UserRole::Admin, 'is_active' => true, diff --git a/tests/browser/admin-state.php b/tests/browser/admin-state.php index 39b0a812..da3da7d1 100644 --- a/tests/browser/admin-state.php +++ b/tests/browser/admin-state.php @@ -32,13 +32,17 @@ $connection->exec("UPDATE users SET role = 'user' WHERE id = 1"); exit; } +if ($mode === 'suspend') { + $connection->exec('UPDATE users SET is_active = 0 WHERE id = 1'); + exit; +} if (!in_array($mode, ['1', '2', '3'], true)) { throw new RuntimeException('Unknown browser fixture identity.'); } session_save_path(dirname(__DIR__, 2) . '/tmp/browser-sessions'); session_id(bin2hex(random_bytes(16))); session_start(); -$_SESSION = ['Auth' => ['id' => (int)$mode]]; +$_SESSION = ['AuthId' => (int)$mode]; $cookie = ['name' => session_name(), 'value' => session_id()]; session_write_close(); echo json_encode($cookie, JSON_THROW_ON_ERROR); diff --git a/tests/browser/admin.spec.js b/tests/browser/admin.spec.js index a508bf6f..ee789132 100644 --- a/tests/browser/admin.spec.js +++ b/tests/browser/admin.spec.js @@ -45,6 +45,10 @@ test('admin manages roles and suspension through the standard Interact endpoint' await dialog.getByRole('button', { name: 'Review change' }).click() await dialog.getByRole('button', { name: 'Confirm change' }).click() await expect(row).toContainText('Active') + await page.getByRole('link', { name: 'Sign out' }).click() + await expect(page).toHaveURL('/') + await page.goto('/admin/users') + await expect(page).toHaveURL(/\/?redirect=%2Fadmin%2Fusers/) }) test('featured editorial changes, preview and removal reach public cards', async ({ page, context }) => { @@ -114,15 +118,21 @@ test('cancel discards the editor draft and saving retains listing filters and so await expect(page.locator('tbody tr')).toHaveCount(1) }) -test('admin updates reject access revoked after mounting', async ({ page, context }) => { - await signIn(context) - await page.goto('/admin/featured-plugins') - fixtures('revoke') - const response = page.waitForResponse(response => response.url().endsWith('/_interact/update')) - await page.getByRole('button', { name: 'Add featured plugin' }).click() - expect((await response).status()).toBe(403) - await expect(page.getByRole('dialog')).toHaveCount(0) -}) +for (const mode of ['revoke', 'suspend']) { + test(`admin updates reject ${mode} after mounting without a login redirect`, async ({ page, context }) => { + await signIn(context) + await page.goto('/admin/featured-plugins') + fixtures(mode) + const pending = page.waitForResponse(response => response.url().endsWith('/_interact/update')) + await page.getByRole('button', { name: 'Add featured plugin' }).click() + const response = await pending + expect(response.status()).toBe(403) + expect(response.headers()['content-type']).toContain('application/json') + expect((await response.json()).error.code).toBe('forbidden') + await expect(page).toHaveURL('/admin/featured-plugins') + await expect(page.getByRole('dialog')).toHaveCount(0) + }) +} test('admin adds an existing catalogue plugin and disables its feature', async ({ page, context }) => { await signIn(context) From 988ab99cfb89c9e6540ce990e232e2a9a11af0a0 Mon Sep 17 00:00:00 2001 From: Jasper Smet Date: Fri, 13 Nov 2026 12:11:10 +0100 Subject: [PATCH 5/6] Authorize admin access from the refreshed identity --- README.md | 58 +------------------ plugins/Admin/src/Island/AdminIsland.php | 2 +- .../TestCase/Island/AdminIslandsTest.php | 18 +++--- src/Policy/RequestPolicy.php | 12 +--- 4 files changed, 15 insertions(+), 75 deletions(-) diff --git a/README.md b/README.md index 8558ff48..d77ccbdf 100644 --- a/README.md +++ b/README.md @@ -101,68 +101,14 @@ The console command receives its importers through CakePHP's container. ## Administration -The local `Admin` plugin provides `/admin/users` and `/admin/featured-plugins`. -It reuses GitHub sign-in, the public theme preference, and Interact's standard -update endpoint. Every admin island checks current authorization on every request. -Sidebar links use Interact navigation, including the return to the public site. -CakePHP's request authorization middleware protects admin pages. Authentication's -`PrimaryKeySession` reloads active users on each request; SocialAuth stores only -their ID in `AuthId`. Existing full-identity sessions require signing in again -after deploying this change. -The plugin owns the admin interface; shared models, migrations, and access services -remain in the application. - -Apply the application migrations, sign in with GitHub once, then promote that -existing account from the console: +Sign in with GitHub, then grant your account admin access: ```bash ddev exec bin/cake migrations migrate ddev exec bin/cake users your-github-username --role admin --active yes ``` -New and existing accounts default to active users. The `users` command without -flags prompts for role and active status. Explicit flags also support suspension -and reactivation: - -```bash -ddev exec bin/cake users some-user --active no -ddev exec bin/cake users some-user --active yes -ddev exec bin/cake users some-user --role user -``` - -Admins can search/filter users and change their role or suspend/reactivate access. -The interface prevents self-demotion and self-suspension, and both the console and -interface preserve the last active admin. Role/status changes take effect on the -next request in existing sessions. Suspended accounts may still browse anonymously. -Roles use CakePHP's ORM-backed `UserRole` enum. Status labels and filter options -come from shared enums; active/enabled flags remain booleans. - -### Featured plugins - -Manage featured selections in the admin interface. Entries have an enabled flag, -optional logo, and optional plain-text title/description overrides. The homepage -randomly displays up to three enabled entries that exist in the catalogue. Blank -overrides use imported package values. Logos accept HTTPS URLs or local `/img/` -paths; missing or broken logos use a name-based emblem. -All featured table data columns support sorting, including catalogue stars and -downloads. Sorting and filters update through Interact without a page reload. -The listing owns filters, pagination, and removal. A separate keyed editor island -owns the package picker, draft, live preview, and saving. Preview requests update -only that editor; a successful save dispatches an event to refresh the listing. -Shared model finders, validation, and rules handle catalogue selection and overrides. -The editor uses FormHelper with an entity context and Interact's whole-form draft -binding; title, description, and logo controls opt into live preview updates. - -The migration preserves the previous configured selections once. Configuration -then lives exclusively in the database. Package synchronization and cleanup leave -editorial settings intact; missing packages are marked unavailable in admin. - -### Admin browser tests - -The Playwright suite includes admin access, user management, featured-card editing, -theme, and mobile navigation checks. Test identities are created by a CLI-only -fixture helper against `tmp/browser.sqlite`, with sessions in `tmp/browser-sessions`. -No application login bypass is installed. +Manage users at `/admin/users` and featured plugins at `/admin/featured-plugins`. ## Get social auth working diff --git a/plugins/Admin/src/Island/AdminIsland.php b/plugins/Admin/src/Island/AdminIsland.php index 2f3fa9d7..bbe50dcd 100644 --- a/plugins/Admin/src/Island/AdminIsland.php +++ b/plugins/Admin/src/Island/AdminIsland.php @@ -15,7 +15,7 @@ abstract class AdminIsland extends Island use AuthorizationTrait; /** - * Recheck current database access on every mount and update. + * Authorize the current request identity on every mount and update. */ public function authorize(IslandContext $context): void { diff --git a/plugins/Admin/tests/TestCase/Island/AdminIslandsTest.php b/plugins/Admin/tests/TestCase/Island/AdminIslandsTest.php index 9deb5f29..d65857a5 100644 --- a/plugins/Admin/tests/TestCase/Island/AdminIslandsTest.php +++ b/plugins/Admin/tests/TestCase/Island/AdminIslandsTest.php @@ -23,12 +23,12 @@ class AdminIslandsTest extends TestCase protected array $fixtures = ['app.Users', 'app.FeaturedPlugins', 'app.Packages']; /** - * Supply the same native service and decorated identity as HTTP middleware. + * Supply a fresh identity, preserving the session when deriving an update request. */ - protected function adminRequest(?int $id = 1): ServerRequest + protected function adminRequest(?int $id = 1, ?ServerRequest $request = null): ServerRequest { - $request = new ServerRequest(['url' => '/admin/users']); - $authorization = new Application(CONFIG)->getAuthorizationService($request); + $request ??= new ServerRequest(['url' => '/admin/users']); + $authorization = $request->getAttribute('authorization') ?? new Application(CONFIG)->getAuthorizationService($request); $identity = $id !== null ? new AuthorizedIdentity($authorization, new Identity($this->fetchTable(UsersTable::class)->get($id))) : null; return $request->withAttribute('authorization', $authorization)->withAttribute('identity', $identity); @@ -76,10 +76,11 @@ public function testInvalidRoleRejected(): void */ public function testRevokedSnapshotDenied(): void { - $island = $this->testIsland('Admin.FeaturedPlugins', request: $this->adminRequest()); + $request = $this->adminRequest(); + $island = $this->testIsland('Admin.FeaturedPlugins', request: $request); $this->fetchTable(UsersTable::class)->updateAll(['role' => 'user'], ['id' => 1]); $this->expectException(ForbiddenException::class); - $island->call('create'); + $island->withRequest($this->adminRequest(request: $request))->call('create'); } /** @@ -87,10 +88,11 @@ public function testRevokedSnapshotDenied(): void */ public function testRevokedEditorSnapshotDenied(): void { - $island = $this->testIsland('Admin.FeaturedPluginEditor', ['entryId' => 1], request: $this->adminRequest()); + $request = $this->adminRequest(); + $island = $this->testIsland('Admin.FeaturedPluginEditor', ['entryId' => 1], request: $request); $this->fetchTable(UsersTable::class)->updateAll(['role' => 'user'], ['id' => 1]); $this->expectException(ForbiddenException::class); - $island->set('draft.title', 'Unauthorized change')->call('save'); + $island->withRequest($this->adminRequest(request: $request))->set('draft.title', 'Unauthorized change')->call('save'); } /** diff --git a/src/Policy/RequestPolicy.php b/src/Policy/RequestPolicy.php index d251804f..a4eda7cf 100644 --- a/src/Policy/RequestPolicy.php +++ b/src/Policy/RequestPolicy.php @@ -4,22 +4,18 @@ namespace App\Policy; use App\Model\Enum\UserRole; -use App\Model\Table\UsersTable; use Authorization\Exception\MissingIdentityException; use Authorization\IdentityInterface; use Authorization\Policy\RequestPolicyInterface; use Cake\Http\ServerRequest; -use Cake\ORM\Locator\LocatorAwareTrait; /** * Public routes keep their existing authentication requirements. */ class RequestPolicy implements RequestPolicyInterface { - use LocatorAwareTrait; - /** - * Administrative routes require an active administrator. + * Use the current identity refreshed by PrimaryKeySession for admin access. */ public function canAccess(?IdentityInterface $identity, ServerRequest $request): bool { @@ -30,10 +26,6 @@ public function canAccess(?IdentityInterface $identity, ServerRequest $request): throw new MissingIdentityException(['identity']); } - return $this->fetchTable(UsersTable::class)->exists([ - 'id' => $identity['id'], - 'role' => UserRole::Admin, - 'is_active' => true, - ]); + return $identity['role'] === UserRole::Admin && $identity['is_active'] === true; } } From 32c5b86a80b15767fd4aaf8597d36d71f06e3451 Mon Sep 17 00:00:00 2001 From: Jasper Smet Date: Fri, 13 Nov 2026 12:14:17 +0100 Subject: [PATCH 6/6] Remove unused entity field constants --- src/Model/Entity/Package.php | 28 ---------------------------- src/Model/Entity/User.php | 18 ------------------ 2 files changed, 46 deletions(-) diff --git a/src/Model/Entity/Package.php b/src/Model/Entity/Package.php index ed16aaaa..e2a4a8d8 100644 --- a/src/Model/Entity/Package.php +++ b/src/Model/Entity/Package.php @@ -125,32 +125,4 @@ protected function groupVersionTags(array $tags, string $prefix): array return $groups; } - - public const FIELD_ID = 'id'; - - public const FIELD_PACKAGE = 'package'; - - public const FIELD_DESCRIPTION = 'description'; - - public const FIELD_REPO_URL = 'repo_url'; - - public const FIELD_DOWNLOADS = 'downloads'; - - public const FIELD_STARS = 'stars'; - - public const FIELD_LATEST_STABLE_VERSION = 'latest_stable_version'; - - public const FIELD_LATEST_STABLE_RELEASE_DATE = 'latest_stable_release_date'; - - public const FIELD_CAKE_PHP_TAGS = 'cake_php_tags'; - - public const FIELD_CAKE_PHP_TAG_GROUPS = 'cake_php_tag_groups'; - - public const FIELD_PHP_TAGS = 'php_tags'; - - public const FIELD_PHP_TAG_GROUPS = 'php_tag_groups'; - - public const FIELD_TAGGED = 'tagged'; - - public const FIELD_TAGS = 'tags'; } diff --git a/src/Model/Entity/User.php b/src/Model/Entity/User.php index 51dc620a..d5249025 100644 --- a/src/Model/Entity/User.php +++ b/src/Model/Entity/User.php @@ -40,22 +40,4 @@ class User extends Entity 'role' => false, 'is_active' => false, ]; - - public const FIELD_ID = 'id'; - - public const FIELD_FIRST_NAME = 'first_name'; - - public const FIELD_LAST_NAME = 'last_name'; - - public const FIELD_EMAIL = 'email'; - - public const FIELD_USERNAME = 'username'; - - public const FIELD_CREATED = 'created'; - - public const FIELD_MODIFIED = 'modified'; - - public const FIELD_SOCIAL_PROFILE = 'social_profile'; - - public const FIELD_IS_CAKEPHP_DEV = 'is_cakephp_dev'; }