Complete TP7 TP8 authentication authorization and classic CSS

mini-crm/app/Http/Controllers/AuthController.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\View\View;
+
+class AuthController extends Controller
+{
+    /**
+     * TP7 : affiche le formulaire de connexion.
+     */
+    public function create(): View
+    {
+        return view('auth.login');
+    }
+
+    /**
+     * TP7 : valide les identifiants et ouvre une session sécurisée.
+     */
+    public function store(Request $request): RedirectResponse
+    {
+        $credentials = $request->validate([
+            'email' => ['required', 'email'],
+            'password' => ['required', 'string'],
+        ]);
+
+        if (Auth::attempt($credentials)) {
+            $request->session()->regenerate();
+
+            return redirect()->intended(route('dashboard'));
+        }
+
+        return back()
+            ->withErrors(['email' => 'Les identifiants sont incorrects.'])
+            ->onlyInput('email');
+    }
+
+    /**
+     * TP7 : ferme la session et renouvelle le jeton CSRF.
+     */
+    public function destroy(Request $request): RedirectResponse
+    {
+        Auth::logout();
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        return redirect()->route('login');
+    }
+}

mini-crm/app/Http/Controllers/ClientController.php

@@ -2,10 +2,11 @@
 
 namespace App\Http\Controllers;
 
-use App\Models\Client;
 use App\Http\Requests\StoreClientRequest;
 use App\Http\Requests\UpdateClientRequest;
+use App\Models\Client;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Gate;
 
 class ClientController extends Controller
 {
@@ -32,12 +33,15 @@ class ClientController extends Controller
     // TP4 : formulaires et actions du CRUD (créer, voir, modifier, supprimer).
     public function create()
     {
+        Gate::authorize('create', Client::class);
+
         return view('clients.create');
     }
 
     // TP6 : Laravel valide le Form Request avant d'appeler cette méthode.
     public function store(StoreClientRequest $request)
     {
+        Gate::authorize('create', Client::class);
         Client::create($request->validated());
 
         return redirect()->route('clients.index');
@@ -45,16 +49,21 @@ class ClientController extends Controller
 
     public function show(Client $client)
     {
+        Gate::authorize('view', $client);
+
         return view('clients.show', compact('client'));
     }
 
     public function edit(Client $client)
     {
+        Gate::authorize('update', $client);
+
         return view('clients.edit', compact('client'));
     }
 
     public function update(UpdateClientRequest $request, Client $client)
     {
+        Gate::authorize('update', $client);
         $client->update($request->validated());
 
         return redirect()->route('clients.index');
@@ -62,9 +71,10 @@ class ClientController extends Controller
 
     public function destroy(Client $client)
     {
+        // TP8 : la Policy refuse cette action aux comptes non administrateurs.
+        Gate::authorize('delete', $client);
         $client->delete();
 
         return redirect()->route('clients.index');
     }
-
 }

mini-crm/app/Http/Controllers/ProductController.php

@@ -2,10 +2,11 @@
 
 namespace App\Http\Controllers;
 
-use App\Models\Product;
 use App\Http\Requests\StoreProductRequest;
 use App\Http\Requests\UpdateProductRequest;
+use App\Models\Product;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Gate;
 
 class ProductController extends Controller
 {
@@ -31,12 +32,15 @@ class ProductController extends Controller
     // TP4 : les six autres actions complètent le CRUD des produits.
     public function create()
     {
+        Gate::authorize('create', Product::class);
+
         return view('products.create');
     }
 
     // TP6 : seules les données validées par le Form Request sont enregistrées.
     public function store(StoreProductRequest $request)
     {
+        Gate::authorize('create', Product::class);
         Product::create($request->validated());
 
         return redirect()->route('products.index');
@@ -44,16 +48,21 @@ class ProductController extends Controller
 
     public function show(Product $product)
     {
+        Gate::authorize('view', $product);
+
         return view('products.show', compact('product'));
     }
 
     public function edit(Product $product)
     {
+        Gate::authorize('update', $product);
+
         return view('products.edit', compact('product'));
     }
 
     public function update(UpdateProductRequest $request, Product $product)
     {
+        Gate::authorize('update', $product);
         $product->update($request->validated());
 
         return redirect()->route('products.index');
@@ -61,9 +70,10 @@ class ProductController extends Controller
 
     public function destroy(Product $product)
     {
+        // TP8 : la Policy réserve la suppression aux administrateurs.
+        Gate::authorize('delete', $product);
         $product->delete();
 
         return redirect()->route('products.index');
     }
-
 }

mini-crm/app/Models/User.php

@@ -10,7 +10,7 @@ use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
 
-#[Fillable(['name', 'email', 'password'])]
+#[Fillable(['name', 'email', 'password', 'is_admin'])]
 #[Hidden(['password', 'remember_token'])]
 class User extends Authenticatable
 {
@@ -27,6 +27,7 @@ class User extends Authenticatable
         return [
             'email_verified_at' => 'datetime',
             'password' => 'hashed',
+            'is_admin' => 'boolean',
         ];
     }
 }

mini-crm/app/Policies/ClientPolicy.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\Client;
+use App\Models\User;
+
+class ClientPolicy
+{
+    /**
+     * Determine whether the user can view any models.
+     */
+    public function viewAny(User $user): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     */
+    public function view(User $user, Client $client): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can create models.
+     */
+    public function create(User $user): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     */
+    public function update(User $user, Client $client): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     */
+    public function delete(User $user, Client $client): bool
+    {
+        return $user->is_admin;
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     */
+    public function restore(User $user, Client $client): bool
+    {
+        return false;
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     */
+    public function forceDelete(User $user, Client $client): bool
+    {
+        return false;
+    }
+}

mini-crm/app/Policies/ProductPolicy.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\Product;
+use App\Models\User;
+
+class ProductPolicy
+{
+    /**
+     * Determine whether the user can view any models.
+     */
+    public function viewAny(User $user): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     */
+    public function view(User $user, Product $product): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can create models.
+     */
+    public function create(User $user): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     */
+    public function update(User $user, Product $product): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     */
+    public function delete(User $user, Product $product): bool
+    {
+        return $user->is_admin;
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     */
+    public function restore(User $user, Product $product): bool
+    {
+        return false;
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     */
+    public function forceDelete(User $user, Product $product): bool
+    {
+        return false;
+    }
+}

mini-crm/app/Providers/AppServiceProvider.php

@@ -2,6 +2,8 @@
 
 namespace App\Providers;
 
+use App\Models\User;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\ServiceProvider;
 
 class AppServiceProvider extends ServiceProvider
@@ -11,7 +13,8 @@ class AppServiceProvider extends ServiceProvider
      */
     public function register(): void
     {
-        //
+        // TP8 bonus : l'administration est une capacité globale, donc un Gate est adapté.
+        Gate::define('viewAdmin', fn (User $user): bool => $user->is_admin);
     }
 
     /**