mirror of
https://github.com/solidtime-io/solidtime.git
synced 2026-08-18 13:12:16 +01:00
Compare commits
1 Commits
v0.12.2
...
8325fea8fe
| Author | SHA1 | Date | |
|---|---|---|---|
|
8325fea8fe |
15
SECURITY.md
15
SECURITY.md
@@ -3,18 +3,3 @@
|
|||||||
## Reporting a Vulnerability
|
## Reporting a Vulnerability
|
||||||
|
|
||||||
If you discover a security vulnerability regarding this project, please e-mail me to [security@solidtime.io](mailto:security@solidtime.io)!
|
If you discover a security vulnerability regarding this project, please e-mail me to [security@solidtime.io](mailto:security@solidtime.io)!
|
||||||
|
|
||||||
## Out of scope
|
|
||||||
|
|
||||||
|
|
||||||
Reports we typically won't issue an advisory for:
|
|
||||||
|
|
||||||
* Theoretical findings without a working PoC
|
|
||||||
* Raw scanner output without manual validation
|
|
||||||
* Missing/weak security headers in isolation (CSP, X-Frame-Options, HSTS, etc.)
|
|
||||||
* SPF/DKIM/DMARC on non-mail-sending domains; missing DNSSEC/CAA; TLS cipher preferences
|
|
||||||
* Self-XSS; CSRF on non-state-changing endpoints (logout, theme)
|
|
||||||
* CSV / spreadsheet formula injection in exports — treated as a spreadsheet-application issue
|
|
||||||
* Org owners or admins acting destructively within their own organization
|
|
||||||
* Anything requiring direct DB, shell, or filesystem access on a self-hosted instance
|
|
||||||
* Missing OAuth Scope enforcement (this is not implemented yet, but AI scanners flag it which is why it is included in this list until we actually support it)
|
|
||||||
|
|||||||
@@ -629,9 +629,9 @@ class TimeEntryController extends Controller
|
|||||||
/** @var Member|null $member */
|
/** @var Member|null $member */
|
||||||
$member = $request->has('member_id') ? Member::query()->findOrFail($request->input('member_id')) : null;
|
$member = $request->has('member_id') ? Member::query()->findOrFail($request->input('member_id')) : null;
|
||||||
if ($timeEntry->member->user_id === Auth::id() && ($member === null || $member->user_id === Auth::id())) {
|
if ($timeEntry->member->user_id === Auth::id() && ($member === null || $member->user_id === Auth::id())) {
|
||||||
$this->checkPermission($organization, 'time-entries:update:own', $timeEntry);
|
$this->checkPermission($organization, 'time-entries:update:own');
|
||||||
} else {
|
} else {
|
||||||
$this->checkPermission($organization, 'time-entries:update:all', $timeEntry);
|
$this->checkPermission($organization, 'time-entries:update:all');
|
||||||
}
|
}
|
||||||
|
|
||||||
if ($timeEntry->end !== null && $request->has('end') && $request->input('end') === null) {
|
if ($timeEntry->end !== null && $request->has('end') && $request->input('end') === null) {
|
||||||
|
|||||||
@@ -304,8 +304,28 @@ class JetstreamServiceProvider extends ServiceProvider
|
|||||||
'owner' => [
|
'owner' => [
|
||||||
'id' => $owner->getKey(),
|
'id' => $owner->getKey(),
|
||||||
'name' => $owner->name,
|
'name' => $owner->name,
|
||||||
|
'email' => $owner->email,
|
||||||
'profile_photo_url' => $owner->profile_photo_url,
|
'profile_photo_url' => $owner->profile_photo_url,
|
||||||
],
|
],
|
||||||
|
'users' => $teamModel->users->map(function (User $user): array {
|
||||||
|
return [
|
||||||
|
'id' => $user->getKey(),
|
||||||
|
'name' => $user->name,
|
||||||
|
'email' => $user->email,
|
||||||
|
'profile_photo_url' => $user->profile_photo_url,
|
||||||
|
'membership' => [
|
||||||
|
'id' => $user->membership->id,
|
||||||
|
'role' => $user->membership->role,
|
||||||
|
],
|
||||||
|
];
|
||||||
|
}),
|
||||||
|
'team_invitations' => $teamModel->teamInvitations->map(function (OrganizationInvitation $invitation): array {
|
||||||
|
return [
|
||||||
|
'id' => $invitation->getKey(),
|
||||||
|
'email' => $invitation->email,
|
||||||
|
'role' => $invitation->role,
|
||||||
|
];
|
||||||
|
}),
|
||||||
],
|
],
|
||||||
'currencies' => array_map(function (Currency $currency): string {
|
'currencies' => array_map(function (Currency $currency): string {
|
||||||
return $currency->getName();
|
return $currency->getName();
|
||||||
|
|||||||
2489
package-lock.json
generated
2489
package-lock.json
generated
File diff suppressed because it is too large
Load Diff
24
package.json
24
package.json
@@ -19,26 +19,26 @@
|
|||||||
},
|
},
|
||||||
"devDependencies": {
|
"devDependencies": {
|
||||||
"@eslint/eslintrc": "^3.2.0",
|
"@eslint/eslintrc": "^3.2.0",
|
||||||
"@eslint/js": "^9.19.0",
|
"@eslint/js": "^10.0.1",
|
||||||
"@inertiajs/vue3": "^2.0.0",
|
"@inertiajs/vue3": "^3.0.3",
|
||||||
"@playwright/test": "^1.41.1",
|
"@playwright/test": "^1.41.1",
|
||||||
"@tailwindcss/forms": "^0.5.9",
|
"@tailwindcss/forms": "^0.5.9",
|
||||||
"@tailwindcss/typography": "^0.5.15",
|
"@tailwindcss/typography": "^0.5.15",
|
||||||
"@types/chroma-js": "^3.1.0",
|
"@types/chroma-js": "^3.1.0",
|
||||||
"@types/node": "^22.10.10",
|
"@types/node": "^25.6.0",
|
||||||
"@vitejs/plugin-vue": "^6.0.3",
|
"@vitejs/plugin-vue": "^6.0.3",
|
||||||
"@vue/tsconfig": "^0.8.0",
|
"@vue/tsconfig": "^0.8.0",
|
||||||
"autoprefixer": "^10.4.20",
|
"autoprefixer": "^10.4.20",
|
||||||
"axios": "^1.6.4",
|
"axios": "^1.6.4",
|
||||||
"eslint-plugin-unused-imports": "^4.1.4",
|
"eslint-plugin-unused-imports": "^4.1.4",
|
||||||
"laravel-vite-plugin": "^2.1.0",
|
"laravel-vite-plugin": "^3.0.1",
|
||||||
"openapi-zod-client": "^1.16.2",
|
"openapi-zod-client": "^1.16.2",
|
||||||
"postcss": "^8.4.47",
|
"postcss": "^8.4.47",
|
||||||
"postcss-import": "^15.1.0",
|
"postcss-import": "^16.1.1",
|
||||||
"postcss-nesting": "^12.1.5",
|
"postcss-nesting": "^14.0.0",
|
||||||
"tailwindcss": "^3.4.13",
|
"tailwindcss": "^4.2.2",
|
||||||
"typescript": "^5.7.3",
|
"typescript": "^6.0.3",
|
||||||
"vite": "^7.0.0",
|
"vite": "^8.0.9",
|
||||||
"vite-plugin-checker": "^0.12.0",
|
"vite-plugin-checker": "^0.12.0",
|
||||||
"vue": "^3.5.0",
|
"vue": "^3.5.0",
|
||||||
"vue-tsc": "^3.0.0"
|
"vue-tsc": "^3.0.0"
|
||||||
@@ -51,7 +51,7 @@
|
|||||||
"@tailwindcss/container-queries": "^0.1.1",
|
"@tailwindcss/container-queries": "^0.1.1",
|
||||||
"@tanstack/vue-form": "^1.3.1",
|
"@tanstack/vue-form": "^1.3.1",
|
||||||
"@tanstack/vue-query": "^5.56.2",
|
"@tanstack/vue-query": "^5.56.2",
|
||||||
"@tanstack/vue-query-devtools": "^5.58.0",
|
"@tanstack/vue-query-devtools": "^6.1.18",
|
||||||
"@tanstack/vue-table": "^8.21.2",
|
"@tanstack/vue-table": "^8.21.2",
|
||||||
"@vue/eslint-config-prettier": "^10.2.0",
|
"@vue/eslint-config-prettier": "^10.2.0",
|
||||||
"@vue/eslint-config-typescript": "^14.3.0",
|
"@vue/eslint-config-typescript": "^14.3.0",
|
||||||
@@ -64,12 +64,12 @@
|
|||||||
"dayjs": "^1.11.11",
|
"dayjs": "^1.11.11",
|
||||||
"echarts": "^6.0.0",
|
"echarts": "^6.0.0",
|
||||||
"focus-trap": "^8.0.0",
|
"focus-trap": "^8.0.0",
|
||||||
"lucide-vue-next": "^0.487.0",
|
"lucide-vue-next": "^1.0.0",
|
||||||
"parse-duration": "^2.0.1",
|
"parse-duration": "^2.0.1",
|
||||||
"pinia": "^3.0.0",
|
"pinia": "^3.0.0",
|
||||||
"radix-vue": "^1.9.6",
|
"radix-vue": "^1.9.6",
|
||||||
"reka-ui": "^2.8.2",
|
"reka-ui": "^2.8.2",
|
||||||
"tailwind-merge": "^2.6.0",
|
"tailwind-merge": "^3.5.0",
|
||||||
"tailwindcss-animate": "^1.0.7",
|
"tailwindcss-animate": "^1.0.7",
|
||||||
"vue-echarts": "^8.0.0",
|
"vue-echarts": "^8.0.0",
|
||||||
"zod": "^3.23.8"
|
"zod": "^3.23.8"
|
||||||
|
|||||||
448
resources/js/Pages/Teams/Partials/TeamMemberManager.vue
Normal file
448
resources/js/Pages/Teams/Partials/TeamMemberManager.vue
Normal file
@@ -0,0 +1,448 @@
|
|||||||
|
<script setup lang="ts">
|
||||||
|
import { computed, ref } from 'vue';
|
||||||
|
import { router, useForm, usePage } from '@inertiajs/vue3';
|
||||||
|
import ActionMessage from '@/Components/ActionMessage.vue';
|
||||||
|
import ActionSection from '@/Components/ActionSection.vue';
|
||||||
|
import ConfirmationModal from '@/Components/ConfirmationModal.vue';
|
||||||
|
import DangerButton from '@/packages/ui/src/Buttons/DangerButton.vue';
|
||||||
|
import DialogModal from '@/packages/ui/src/DialogModal.vue';
|
||||||
|
import FormSection from '@/Components/FormSection.vue';
|
||||||
|
import { Field, FieldLabel, FieldError } from '@/packages/ui/src/field';
|
||||||
|
|
||||||
|
import PrimaryButton from '@/packages/ui/src/Buttons/PrimaryButton.vue';
|
||||||
|
import SecondaryButton from '@/packages/ui/src/Buttons/SecondaryButton.vue';
|
||||||
|
import SectionBorder from '@/Components/SectionBorder.vue';
|
||||||
|
import TextInput from '@/packages/ui/src/Input/TextInput.vue';
|
||||||
|
import type { Organization, OrganizationInvitation, User } from '@/types/models';
|
||||||
|
import type { Membership, Permissions, Role } from '@/types/jetstream';
|
||||||
|
import { filterRoles } from '@/utils/roles';
|
||||||
|
|
||||||
|
type UserWithMembership = User & { membership: Membership };
|
||||||
|
|
||||||
|
const props = defineProps<{
|
||||||
|
team: Organization;
|
||||||
|
availableRoles: Role[];
|
||||||
|
userPermissions: Permissions;
|
||||||
|
}>();
|
||||||
|
|
||||||
|
const users = computed(() => {
|
||||||
|
return props.team.users as Array<UserWithMembership>;
|
||||||
|
});
|
||||||
|
|
||||||
|
const page = usePage<{
|
||||||
|
auth: {
|
||||||
|
user: User;
|
||||||
|
};
|
||||||
|
}>();
|
||||||
|
|
||||||
|
const addTeamMemberForm = useForm({
|
||||||
|
email: '',
|
||||||
|
role: null as string | null,
|
||||||
|
});
|
||||||
|
|
||||||
|
const updateRoleForm = useForm({
|
||||||
|
role: null as string | null,
|
||||||
|
});
|
||||||
|
|
||||||
|
const leaveTeamForm = useForm({});
|
||||||
|
const removeTeamMemberForm = useForm({});
|
||||||
|
|
||||||
|
const currentlyManagingRole = ref(false);
|
||||||
|
const managingRoleFor = ref<User | null>(null);
|
||||||
|
const confirmingLeavingTeam = ref(false);
|
||||||
|
const teamMemberBeingRemoved = ref<User | null>(null);
|
||||||
|
|
||||||
|
const addTeamMember = () => {
|
||||||
|
addTeamMemberForm.post(route('team-members.store', props.team.id), {
|
||||||
|
errorBag: 'addTeamMember',
|
||||||
|
preserveScroll: true,
|
||||||
|
onSuccess: () => addTeamMemberForm.reset(),
|
||||||
|
});
|
||||||
|
};
|
||||||
|
|
||||||
|
const cancelTeamInvitation = (invitation: OrganizationInvitation) => {
|
||||||
|
router.delete(route('team-invitations.destroy', invitation.id), {
|
||||||
|
preserveScroll: true,
|
||||||
|
});
|
||||||
|
};
|
||||||
|
|
||||||
|
const manageRole = (teamMember: User & { membership: Membership }) => {
|
||||||
|
managingRoleFor.value = teamMember;
|
||||||
|
updateRoleForm.role = teamMember.membership.role;
|
||||||
|
currentlyManagingRole.value = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
const updateRole = () => {
|
||||||
|
updateRoleForm.put(
|
||||||
|
route('team-members.update', {
|
||||||
|
team: props.team.id,
|
||||||
|
user: managingRoleFor.value?.id,
|
||||||
|
}),
|
||||||
|
{
|
||||||
|
preserveScroll: true,
|
||||||
|
onSuccess: () => (currentlyManagingRole.value = false),
|
||||||
|
}
|
||||||
|
);
|
||||||
|
};
|
||||||
|
|
||||||
|
const confirmLeavingTeam = () => {
|
||||||
|
confirmingLeavingTeam.value = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
const leaveTeam = () => {
|
||||||
|
leaveTeamForm.delete(route('team-members.destroy', [props.team.id, page.props.auth.user.id]));
|
||||||
|
};
|
||||||
|
|
||||||
|
const confirmTeamMemberRemoval = (teamMember: User) => {
|
||||||
|
teamMemberBeingRemoved.value = teamMember;
|
||||||
|
};
|
||||||
|
|
||||||
|
const removeTeamMember = () => {
|
||||||
|
removeTeamMemberForm.delete(
|
||||||
|
route('team-members.destroy', {
|
||||||
|
team: props.team.id,
|
||||||
|
user: teamMemberBeingRemoved.value?.id,
|
||||||
|
}),
|
||||||
|
{
|
||||||
|
errorBag: 'removeTeamMember',
|
||||||
|
preserveScroll: true,
|
||||||
|
preserveState: true,
|
||||||
|
onSuccess: () => (teamMemberBeingRemoved.value = null),
|
||||||
|
}
|
||||||
|
);
|
||||||
|
};
|
||||||
|
|
||||||
|
const displayableRole = (role: string) => {
|
||||||
|
return props.availableRoles.find((r) => r.key === role)?.name;
|
||||||
|
};
|
||||||
|
</script>
|
||||||
|
|
||||||
|
<template>
|
||||||
|
<div>
|
||||||
|
<div v-if="userPermissions.canAddTeamMembers">
|
||||||
|
<SectionBorder />
|
||||||
|
|
||||||
|
<!-- Add Organization Member -->
|
||||||
|
<FormSection @submitted="addTeamMember">
|
||||||
|
<template #title> Add Organization Member</template>
|
||||||
|
|
||||||
|
<template #description>
|
||||||
|
Add a new member to your organization, allowing them to collaborate with you.
|
||||||
|
</template>
|
||||||
|
|
||||||
|
<template #form>
|
||||||
|
<div class="col-span-6">
|
||||||
|
<div class="max-w-xl text-sm text-muted">
|
||||||
|
Please provide the email address of the person you would like to add to
|
||||||
|
this organization.
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<!-- Member Email -->
|
||||||
|
<Field class="col-span-6 sm:col-span-4">
|
||||||
|
<FieldLabel for="email">Email</FieldLabel>
|
||||||
|
<TextInput
|
||||||
|
id="email"
|
||||||
|
v-model="addTeamMemberForm.email"
|
||||||
|
type="email"
|
||||||
|
class="block w-full" />
|
||||||
|
<FieldError v-if="addTeamMemberForm.errors.email">{{
|
||||||
|
addTeamMemberForm.errors.email
|
||||||
|
}}</FieldError>
|
||||||
|
</Field>
|
||||||
|
|
||||||
|
<!-- Role -->
|
||||||
|
<div v-if="availableRoles.length > 0" class="col-span-6 lg:col-span-4">
|
||||||
|
<FieldLabel for="roles">Role</FieldLabel>
|
||||||
|
<FieldError v-if="addTeamMemberForm.errors.role">{{
|
||||||
|
addTeamMemberForm.errors.role
|
||||||
|
}}</FieldError>
|
||||||
|
|
||||||
|
<div
|
||||||
|
class="relative z-0 mt-1 border border-card-border rounded-lg cursor-pointer">
|
||||||
|
<button
|
||||||
|
v-for="(role, i) in filterRoles(availableRoles)"
|
||||||
|
:key="role.key"
|
||||||
|
type="button"
|
||||||
|
class="relative px-4 py-3 inline-flex w-full rounded-lg focus:z-10 focus:outline-none focus:border-indigo-500 focus:ring-2 focus:ring-indigo-500"
|
||||||
|
:class="{
|
||||||
|
'border-t border-card-border focus:border-none rounded-t-none':
|
||||||
|
i > 0,
|
||||||
|
'rounded-b-none': i != Object.keys(availableRoles).length - 1,
|
||||||
|
}"
|
||||||
|
@click="addTeamMemberForm.role = role.key">
|
||||||
|
<div
|
||||||
|
:class="{
|
||||||
|
'opacity-50':
|
||||||
|
addTeamMemberForm.role &&
|
||||||
|
addTeamMemberForm.role != role.key,
|
||||||
|
}">
|
||||||
|
<!-- Role Name -->
|
||||||
|
<div class="flex items-center">
|
||||||
|
<div
|
||||||
|
class="text-sm text-text-primary"
|
||||||
|
:class="{
|
||||||
|
'font-semibold': addTeamMemberForm.role == role.key,
|
||||||
|
}">
|
||||||
|
{{ role.name }}
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<svg
|
||||||
|
v-if="addTeamMemberForm.role == role.key"
|
||||||
|
class="ms-2 h-5 w-5 text-green-400"
|
||||||
|
xmlns="http://www.w3.org/2000/svg"
|
||||||
|
fill="none"
|
||||||
|
viewBox="0 0 24 24"
|
||||||
|
stroke-width="1.5"
|
||||||
|
stroke="currentColor">
|
||||||
|
<path
|
||||||
|
stroke-linecap="round"
|
||||||
|
stroke-linejoin="round"
|
||||||
|
d="M9 12.75L11.25 15 15 9.75M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
|
||||||
|
</svg>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<!-- Role Description -->
|
||||||
|
<div class="mt-2 text-xs text-muted text-start">
|
||||||
|
{{ role.description }}
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</template>
|
||||||
|
|
||||||
|
<template #actions>
|
||||||
|
<ActionMessage :on="addTeamMemberForm.recentlySuccessful" class="me-3">
|
||||||
|
Added.
|
||||||
|
</ActionMessage>
|
||||||
|
|
||||||
|
<PrimaryButton
|
||||||
|
:class="{ 'opacity-25': addTeamMemberForm.processing }"
|
||||||
|
:disabled="addTeamMemberForm.processing">
|
||||||
|
Add
|
||||||
|
</PrimaryButton>
|
||||||
|
</template>
|
||||||
|
</FormSection>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div v-if="team.team_invitations.length > 0 && userPermissions.canAddTeamMembers">
|
||||||
|
<SectionBorder />
|
||||||
|
|
||||||
|
<!-- Organization Member Invitations -->
|
||||||
|
<ActionSection class="mt-10 sm:mt-0">
|
||||||
|
<template #title> Pending Organization Invitations</template>
|
||||||
|
|
||||||
|
<template #description>
|
||||||
|
These people have been invited to your organization and have been sent an
|
||||||
|
invitation email. They may join the organization by accepting the email
|
||||||
|
invitation.
|
||||||
|
</template>
|
||||||
|
|
||||||
|
<!-- Pending Organization Member Invitation List -->
|
||||||
|
<template #content>
|
||||||
|
<div class="space-y-6">
|
||||||
|
<div
|
||||||
|
v-for="invitation in team.team_invitations"
|
||||||
|
:key="invitation.id"
|
||||||
|
class="flex items-center justify-between">
|
||||||
|
<div class="text-muted">
|
||||||
|
{{ invitation.email }}
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="flex items-center">
|
||||||
|
<!-- Cancel Organization Invitation -->
|
||||||
|
<button
|
||||||
|
v-if="userPermissions.canRemoveTeamMembers"
|
||||||
|
class="cursor-pointer ms-6 text-sm text-red-500 focus:outline-none"
|
||||||
|
@click="cancelTeamInvitation(invitation)">
|
||||||
|
Cancel
|
||||||
|
</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</template>
|
||||||
|
</ActionSection>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div v-if="users.length > 0">
|
||||||
|
<SectionBorder />
|
||||||
|
|
||||||
|
<!-- Manage Organization Members -->
|
||||||
|
<ActionSection class="mt-10 sm:mt-0">
|
||||||
|
<template #title> Organization Members</template>
|
||||||
|
|
||||||
|
<template #description>
|
||||||
|
All of the people that are part of this organization.
|
||||||
|
</template>
|
||||||
|
|
||||||
|
<!-- Organization Member List -->
|
||||||
|
<template #content>
|
||||||
|
<div class="space-y-6">
|
||||||
|
<div
|
||||||
|
v-for="user in users"
|
||||||
|
:key="user.id"
|
||||||
|
class="flex items-center justify-between">
|
||||||
|
<div class="flex items-center">
|
||||||
|
<img
|
||||||
|
class="w-8 h-8 rounded-full object-cover"
|
||||||
|
:src="user.profile_photo_url"
|
||||||
|
:alt="user.name" />
|
||||||
|
<div class="ms-4 text-text-primary">
|
||||||
|
{{ user.name }}
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="flex items-center">
|
||||||
|
<!-- Manage Organization Member Role -->
|
||||||
|
<button
|
||||||
|
v-if="
|
||||||
|
userPermissions.canUpdateTeamMembers &&
|
||||||
|
availableRoles.length
|
||||||
|
"
|
||||||
|
class="ms-2 text-sm text-gray-400 underline"
|
||||||
|
@click="manageRole(user)">
|
||||||
|
{{ displayableRole(user.membership.role) }}
|
||||||
|
</button>
|
||||||
|
|
||||||
|
<div
|
||||||
|
v-else-if="availableRoles.length"
|
||||||
|
class="ms-2 text-sm text-gray-400">
|
||||||
|
{{ displayableRole(user.membership.role) }}
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<!-- Leave Organization -->
|
||||||
|
<button
|
||||||
|
v-if="page.props.auth.user.id === user.id"
|
||||||
|
class="cursor-pointer ms-6 text-sm text-red-500"
|
||||||
|
@click="confirmLeavingTeam">
|
||||||
|
Leave
|
||||||
|
</button>
|
||||||
|
|
||||||
|
<!-- Remove Organization Member -->
|
||||||
|
<button
|
||||||
|
v-else-if="userPermissions.canRemoveTeamMembers"
|
||||||
|
class="cursor-pointer ms-6 text-sm text-red-500"
|
||||||
|
@click="confirmTeamMemberRemoval(user)">
|
||||||
|
Remove
|
||||||
|
</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</template>
|
||||||
|
</ActionSection>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<!-- Role Management Modal -->
|
||||||
|
<DialogModal :show="currentlyManagingRole" @close="currentlyManagingRole = false">
|
||||||
|
<template #title> Manage Role</template>
|
||||||
|
|
||||||
|
<template #content>
|
||||||
|
<div v-if="managingRoleFor">
|
||||||
|
<div
|
||||||
|
class="relative z-0 mt-1 border border-card-border rounded-lg cursor-pointer">
|
||||||
|
<button
|
||||||
|
v-for="(role, i) in availableRoles"
|
||||||
|
:key="role.key"
|
||||||
|
type="button"
|
||||||
|
class="relative px-4 py-3 inline-flex w-full rounded-lg focus:z-10 focus:outline-none focus:border-indigo-500 focus:ring-2 focus:ring-indigo-500"
|
||||||
|
:class="{
|
||||||
|
'border-t border-card-border focus:border-none rounded-t-none':
|
||||||
|
i > 0,
|
||||||
|
'rounded-b-none': i !== Object.keys(availableRoles).length - 1,
|
||||||
|
}"
|
||||||
|
@click="updateRoleForm.role = role.key">
|
||||||
|
<div
|
||||||
|
:class="{
|
||||||
|
'opacity-50':
|
||||||
|
updateRoleForm.role && updateRoleForm.role !== role.key,
|
||||||
|
}">
|
||||||
|
<!-- Role Name -->
|
||||||
|
<div class="flex items-center">
|
||||||
|
<div
|
||||||
|
class="text-sm text-muted"
|
||||||
|
:class="{
|
||||||
|
'font-semibold': updateRoleForm.role === role.key,
|
||||||
|
}">
|
||||||
|
{{ role.name }}
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<svg
|
||||||
|
v-if="updateRoleForm.role == role.key"
|
||||||
|
class="ms-2 h-5 w-5 text-green-400"
|
||||||
|
xmlns="http://www.w3.org/2000/svg"
|
||||||
|
fill="none"
|
||||||
|
viewBox="0 0 24 24"
|
||||||
|
stroke-width="1.5"
|
||||||
|
stroke="currentColor">
|
||||||
|
<path
|
||||||
|
stroke-linecap="round"
|
||||||
|
stroke-linejoin="round"
|
||||||
|
d="M9 12.75L11.25 15 15 9.75M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
|
||||||
|
</svg>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<!-- Role Description -->
|
||||||
|
<div class="mt-2 text-xs text-muted">
|
||||||
|
{{ role.description }}
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</template>
|
||||||
|
|
||||||
|
<template #footer>
|
||||||
|
<SecondaryButton @click="currentlyManagingRole = false"> Cancel </SecondaryButton>
|
||||||
|
|
||||||
|
<PrimaryButton
|
||||||
|
class="ms-3"
|
||||||
|
:class="{ 'opacity-25': updateRoleForm.processing }"
|
||||||
|
:disabled="updateRoleForm.processing"
|
||||||
|
@click="updateRole">
|
||||||
|
Save
|
||||||
|
</PrimaryButton>
|
||||||
|
</template>
|
||||||
|
</DialogModal>
|
||||||
|
|
||||||
|
<!-- Leave Organization Confirmation Modal -->
|
||||||
|
<ConfirmationModal :show="confirmingLeavingTeam" @close="confirmingLeavingTeam = false">
|
||||||
|
<template #title> Leave Organization</template>
|
||||||
|
|
||||||
|
<template #content> Are you sure you would like to leave this organization? </template>
|
||||||
|
|
||||||
|
<template #footer>
|
||||||
|
<SecondaryButton @click="confirmingLeavingTeam = false"> Cancel </SecondaryButton>
|
||||||
|
|
||||||
|
<DangerButton
|
||||||
|
class="ms-3"
|
||||||
|
:class="{ 'opacity-25': leaveTeamForm.processing }"
|
||||||
|
:disabled="leaveTeamForm.processing"
|
||||||
|
@click="leaveTeam">
|
||||||
|
Leave
|
||||||
|
</DangerButton>
|
||||||
|
</template>
|
||||||
|
</ConfirmationModal>
|
||||||
|
|
||||||
|
<!-- Remove Organization Member Confirmation Modal -->
|
||||||
|
<ConfirmationModal :show="!!teamMemberBeingRemoved" @close="teamMemberBeingRemoved = null">
|
||||||
|
<template #title> Remove Organization Member</template>
|
||||||
|
|
||||||
|
<template #content>
|
||||||
|
Are you sure you would like to remove this person from the organization?
|
||||||
|
</template>
|
||||||
|
|
||||||
|
<template #footer>
|
||||||
|
<SecondaryButton @click="teamMemberBeingRemoved = null"> Cancel </SecondaryButton>
|
||||||
|
|
||||||
|
<DangerButton
|
||||||
|
class="ms-3"
|
||||||
|
:class="{ 'opacity-25': removeTeamMemberForm.processing }"
|
||||||
|
:disabled="removeTeamMemberForm.processing"
|
||||||
|
@click="removeTeamMember">
|
||||||
|
Remove
|
||||||
|
</DangerButton>
|
||||||
|
</template>
|
||||||
|
</ConfirmationModal>
|
||||||
|
</div>
|
||||||
|
</template>
|
||||||
@@ -51,6 +51,9 @@ const updateTeamName = () => {
|
|||||||
<div class="text-text-primary">
|
<div class="text-text-primary">
|
||||||
{{ team.owner.name }}
|
{{ team.owner.name }}
|
||||||
</div>
|
</div>
|
||||||
|
<div class="text-text-secondary text-sm">
|
||||||
|
{{ team.owner.email }}
|
||||||
|
</div>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
|
|||||||
@@ -35,8 +35,7 @@ watch(open, (isOpen) => {
|
|||||||
sortedItems.value = [...props.items].sort((a, b) => {
|
sortedItems.value = [...props.items].sort((a, b) => {
|
||||||
const aSelected = model.value.includes(props.getKeyFromItem(a)) ? 0 : 1;
|
const aSelected = model.value.includes(props.getKeyFromItem(a)) ? 0 : 1;
|
||||||
const bSelected = model.value.includes(props.getKeyFromItem(b)) ? 0 : 1;
|
const bSelected = model.value.includes(props.getKeyFromItem(b)) ? 0 : 1;
|
||||||
if (aSelected !== bSelected) return aSelected - bSelected;
|
return aSelected - bSelected;
|
||||||
return props.getNameForItem(a).localeCompare(props.getNameForItem(b));
|
|
||||||
});
|
});
|
||||||
}
|
}
|
||||||
});
|
});
|
||||||
|
|||||||
@@ -20,8 +20,7 @@ const selectedTimeEntries = defineModel<TimeEntry[]>('selected', {
|
|||||||
default: [],
|
default: [],
|
||||||
});
|
});
|
||||||
|
|
||||||
const props = withDefaults(
|
const props = defineProps<{
|
||||||
defineProps<{
|
|
||||||
timeEntries: TimeEntry[];
|
timeEntries: TimeEntry[];
|
||||||
projects: Project[];
|
projects: Project[];
|
||||||
tasks: Task[];
|
tasks: Task[];
|
||||||
@@ -38,12 +37,8 @@ const props = withDefaults(
|
|||||||
organizationBillableRate: number | null;
|
organizationBillableRate: number | null;
|
||||||
enableEstimatedTime: boolean;
|
enableEstimatedTime: boolean;
|
||||||
canCreateProject: boolean;
|
canCreateProject: boolean;
|
||||||
groupSimilarTimeEntries?: boolean;
|
groupSimilarTimeEntries: boolean;
|
||||||
}>(),
|
}>();
|
||||||
{
|
|
||||||
groupSimilarTimeEntries: true,
|
|
||||||
}
|
|
||||||
);
|
|
||||||
|
|
||||||
const groupedTimeEntries = computed(() => {
|
const groupedTimeEntries = computed(() => {
|
||||||
const groupedEntriesByDay: Record<string, TimeEntry[]> = {};
|
const groupedEntriesByDay: Record<string, TimeEntry[]> = {};
|
||||||
|
|||||||
4
resources/js/types/models.d.ts
vendored
4
resources/js/types/models.d.ts
vendored
@@ -22,7 +22,9 @@ export interface Organization {
|
|||||||
currency: string;
|
currency: string;
|
||||||
created_at: string | null;
|
created_at: string | null;
|
||||||
updated_at: string | null;
|
updated_at: string | null;
|
||||||
owner: Pick<User, 'id' | 'name' | 'profile_photo_url'>;
|
owner: User;
|
||||||
|
users: User[];
|
||||||
|
team_invitations: OrganizationInvitation[];
|
||||||
}
|
}
|
||||||
export interface OrganizationInvitation {
|
export interface OrganizationInvitation {
|
||||||
id: string;
|
id: string;
|
||||||
|
|||||||
@@ -29,7 +29,9 @@ export interface Organization {
|
|||||||
created_at: string | null;
|
created_at: string | null;
|
||||||
updated_at: string | null;
|
updated_at: string | null;
|
||||||
// relations
|
// relations
|
||||||
owner: Pick<User, 'id' | 'name' | 'profile_photo_url'>;
|
owner: User;
|
||||||
|
users: User[];
|
||||||
|
team_invitations: OrganizationInvitation[];
|
||||||
}
|
}
|
||||||
|
|
||||||
export interface OrganizationInvitation {
|
export interface OrganizationInvitation {
|
||||||
|
|||||||
@@ -2490,47 +2490,6 @@ class TimeEntryEndpointTest extends ApiEndpointTestAbstract
|
|||||||
$response->assertForbidden();
|
$response->assertForbidden();
|
||||||
}
|
}
|
||||||
|
|
||||||
public function test_update_endpoint_fails_if_time_entry_belongs_to_different_organization_than_url_even_with_update_all_permission(): void
|
|
||||||
{
|
|
||||||
// Arrange
|
|
||||||
// Attacker: has `time-entries:update:all` in their own organization (orgA).
|
|
||||||
$data = $this->createUserWithPermission([
|
|
||||||
'time-entries:update:all',
|
|
||||||
'projects:view:all',
|
|
||||||
]);
|
|
||||||
$attackerProject = Project::factory()->forOrganization($data->organization)->create();
|
|
||||||
|
|
||||||
// Victim: entirely separate organization (orgB). Attacker has NO membership in orgB.
|
|
||||||
$victimOrgData = $this->createUserWithPermission([], true);
|
|
||||||
$victimTimeEntry = TimeEntry::factory()
|
|
||||||
->forOrganization($victimOrgData->organization)
|
|
||||||
->forMember($victimOrgData->ownerMember)
|
|
||||||
->create([
|
|
||||||
'description' => 'victim-original',
|
|
||||||
'project_id' => null,
|
|
||||||
'task_id' => null,
|
|
||||||
]);
|
|
||||||
|
|
||||||
Passport::actingAs($data->user);
|
|
||||||
|
|
||||||
// Act: PUT to /organizations/{orgA}/time-entries/{victim_uuid} — URL org is attacker's
|
|
||||||
// own org, but the route-bound time entry belongs to orgB.
|
|
||||||
$response = $this->putJson(route('api.v1.time-entries.update', [$data->organization->getKey(), $victimTimeEntry->getKey()]), [
|
|
||||||
'description' => 'attacker-overwrite',
|
|
||||||
'project_id' => $attackerProject->getKey(),
|
|
||||||
]);
|
|
||||||
|
|
||||||
// Assert: must be rejected. Before the fix this returned 200 and rewrote the
|
|
||||||
// victim row with attacker's project_id while keeping organization_id = orgB.
|
|
||||||
$response->assertForbidden();
|
|
||||||
$this->assertDatabaseHas(TimeEntry::class, [
|
|
||||||
'id' => $victimTimeEntry->getKey(),
|
|
||||||
'organization_id' => $victimOrgData->organization->getKey(),
|
|
||||||
'description' => 'victim-original',
|
|
||||||
'project_id' => null,
|
|
||||||
]);
|
|
||||||
}
|
|
||||||
|
|
||||||
public function test_update_endpoint_fails_if_user_has_no_permission_to_update_time_entries_for_other_users_in_organization(): void
|
public function test_update_endpoint_fails_if_user_has_no_permission_to_update_time_entries_for_other_users_in_organization(): void
|
||||||
{
|
{
|
||||||
// Arrange
|
// Arrange
|
||||||
|
|||||||
@@ -1,45 +0,0 @@
|
|||||||
<?php
|
|
||||||
|
|
||||||
declare(strict_types=1);
|
|
||||||
|
|
||||||
namespace Tests\Unit\Endpoint\Web;
|
|
||||||
|
|
||||||
use App\Models\OrganizationInvitation;
|
|
||||||
use App\Providers\JetstreamServiceProvider;
|
|
||||||
use Inertia\Testing\AssertableInertia as Assert;
|
|
||||||
use Laravel\Jetstream\Jetstream;
|
|
||||||
use PHPUnit\Framework\Attributes\CoversClass;
|
|
||||||
|
|
||||||
#[CoversClass(JetstreamServiceProvider::class)]
|
|
||||||
class TeamShowEndpointTest extends EndpointTestAbstract
|
|
||||||
{
|
|
||||||
protected function setUp(): void
|
|
||||||
{
|
|
||||||
Jetstream::$inertiaManager = null;
|
|
||||||
parent::setUp();
|
|
||||||
}
|
|
||||||
|
|
||||||
public function test_team_show_does_not_expose_member_roster_invitations_or_owner_email(): void
|
|
||||||
{
|
|
||||||
// Arrange
|
|
||||||
$data = $this->createUserWithPermission([]);
|
|
||||||
OrganizationInvitation::factory()->forOrganization($data->organization)->create([
|
|
||||||
'email' => 'pending@example.com',
|
|
||||||
]);
|
|
||||||
$this->actingAs($data->user);
|
|
||||||
|
|
||||||
// Act
|
|
||||||
$response = $this->get('/teams/'.$data->organization->getKey());
|
|
||||||
|
|
||||||
// Assert
|
|
||||||
$response->assertOk();
|
|
||||||
$response->assertInertia(fn (Assert $page) => $page
|
|
||||||
->missing('team.users')
|
|
||||||
->missing('team.team_invitations')
|
|
||||||
->missing('team.owner.email')
|
|
||||||
->has('team.owner.id')
|
|
||||||
->has('team.owner.name')
|
|
||||||
->has('team.owner.profile_photo_url')
|
|
||||||
);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
Reference in New Issue
Block a user