adalal/solidtime
1
0
Fork 0
mirror of https://github.com/solidtime-io/solidtime.git synced 2026-08-08 08:12:17 +01:00
Code Issues Packages Projects Releases Wiki Activity

Restrict roles available to invitation and member.update, fixes ST-264

Browse Source
This commit is contained in:
Constantin Graf
2024-06-18 18:48:48 +02:00
committed by Gregor Vostrak
parent 2184b3c835
commit 313cee2db0
6 changed files with 112 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/Http/Controllers/Api/V1/InvitationController.php
View File

@@ -60,7 +60,7 @@ class InvitationController extends Controller
$this->user(),
$organization,
$request->input('email'),
$request->input('role')
$request->getRole()->value
);
return response()->json(null, 204);

2
app/Http/Controllers/Api/V1/MemberController.php
View File

@@ -68,7 +68,7 @@ class MemberController extends Controller
$member->billable_rate = $request->getBillableRate();
}
if ($request->has('role')) {
$member->role = $request->input('role');
$member->role = $request->getRole()->value;
}
$member->save();

9
app/Http/Requests/V1/Invitation/InvitationStoreRequest.php
View File

@@ -30,9 +30,14 @@ class InvitationStoreRequest extends FormRequest
'role' => [
'required',
'string',
// TODO: placeholder role should not be allowed
Rule::enum(Role::class),
Rule::enum(Role::class)
->except([Role::Owner, Role::Placeholder]),
],
];
}
public function getRole(): Role
{
return Role::from($this->input('role'));
}
}

9
app/Http/Requests/V1/Member/MemberUpdateRequest.php
View File

@@ -25,8 +25,8 @@ class MemberUpdateRequest extends FormRequest
return [
'role' => [
'string',
// TODO: placeholder role should not be allowed
Rule::enum(Role::class),
Rule::enum(Role::class)
->except([Role::Owner, Role::Placeholder]),
],
'billable_rate' => [
'nullable',
@@ -52,4 +52,9 @@ class MemberUpdateRequest extends FormRequest
return $this->has('billable_rate_update_time_entries') &&
$this->input('billable_rate_update_time_entries') === 'true';
}
public function getRole(): Role
{
return Role::from($this->input('role'));
}
}