diff --git a/backend/app/Exceptions/NotAuthorizedException.php b/backend/app/Exceptions/NotAuthorizedException.php new file mode 100644 index 0000000..591a45c --- /dev/null +++ b/backend/app/Exceptions/NotAuthorizedException.php @@ -0,0 +1,22 @@ +user = $user; + } + + public function render($request) { + $path = $request->getPathInfo(); + + return response()->json([ + 'error' => 'not_authorized', + 'message' => 'El usuario ' . $this->user->id . ' no tiene permiso para acceder al endpoint ' . $path + ], 401); + } +} diff --git a/backend/app/Http/Controllers/RestaurantesController.php b/backend/app/Http/Controllers/RestaurantesController.php index 43d71bb..0ce3102 100644 --- a/backend/app/Http/Controllers/RestaurantesController.php +++ b/backend/app/Http/Controllers/RestaurantesController.php @@ -19,7 +19,11 @@ class RestaurantesController extends Controller { * Obtiene de forma paginada los restaurantes registrados en el backend */ public function all(Request $request) { - $restaurantes = Restaurante::all(); + if($request->user->isGlobalAdmin()) { + $restaurantes = Restaurante::all(); + } else { + $restaurantes = $request->user->restaurantes; + } $paginate = app(PaginatorService::class)->paginate( perPage: $request->input('per_page', 15), @@ -100,7 +104,6 @@ class RestaurantesController extends Controller { if($restaurant->zonasProduccion()->count() > 0) throw new CantDeleteHasChildException("restaurant", "zona_produccion"); if($restaurant->categorias()->count() > 0) throw new CantDeleteHasChildException("restaurant", "categoria"); - $restaurant->delete(); return response()->json([], 204); } diff --git a/backend/app/Http/Controllers/UsuariosController.php b/backend/app/Http/Controllers/UsuariosController.php index 4f0804b..a2a5ae0 100644 --- a/backend/app/Http/Controllers/UsuariosController.php +++ b/backend/app/Http/Controllers/UsuariosController.php @@ -49,6 +49,13 @@ class UsuariosController extends Controller { return response()->json($usuario); } + /** + * Se obtiene al usuario logeado + */ + public function getMe(Request $request) { + return response()->json($request->user); + } + /** * Crea un nuevo usuario localmente y en auth0 */ diff --git a/backend/app/Http/Middleware/RoleMiddleware.php b/backend/app/Http/Middleware/RoleMiddleware.php new file mode 100644 index 0000000..f8951da --- /dev/null +++ b/backend/app/Http/Middleware/RoleMiddleware.php @@ -0,0 +1,16 @@ +user->hasRole($role)) { + throw new NotAuthorizedException($request->user); + } + + return $next($request); + } +} diff --git a/backend/app/Models/Restaurante.php b/backend/app/Models/Restaurante.php index 2e484ca..9977660 100644 --- a/backend/app/Models/Restaurante.php +++ b/backend/app/Models/Restaurante.php @@ -22,14 +22,22 @@ class Restaurante extends Model { return $restaurante; } - public function usuarios() { - return $this->belongsToMany(Usuario::class, 'usuarios_restaurantes', 'restaurante_id', 'usuario_id'); - } - public function canalesVenta() { return $this->hasMany(CanalVenta::class, 'restaurante_id'); } + public function categorias() { + return $this->hasMany(Categoria::class, 'restaurante_id'); + } + + public function compras() { + return $this->hasMany(Compra::class, 'restaurante_id'); + } + + public function usuarios() { + return $this->belongsToMany(Usuario::class, 'usuarios_restaurantes', 'restaurante_id', 'usuario_id'); + } + public function sectores() { return $this->hasMany(Sector::class, 'restaurante_id'); } @@ -38,10 +46,6 @@ class Restaurante extends Model { return $this->hasMany(ZonaProduccion::class, 'restaurante_id'); } - public function categorias() { - return $this->hasMany(Categoria::class, 'restaurante_id'); - } - public function proveedores() { return $this->hasMany(Proveedor::class, 'restaurante_id'); } @@ -54,7 +58,19 @@ class Restaurante extends Model { return $this->hasMany(Producto::class, 'restaurante_id'); } - public function compras() { - return $this->hasMany(Compra::class, 'restaurante_id'); + public function ventas() { + return $this->hasMany(Venta::class, 'restaurante_id'); + } + + public function boletasElectronicas() { + return $this->hasMany(BoletaElectronica::class, 'restaurante_id'); + } + + public function boletasExentas() { + return $this->hasMany(BoletaExenta::class, 'restaurante_id'); + } + + public function cajas() { + return $this->hasMany(Caja::class, 'restaurante_id'); } } diff --git a/backend/app/Models/Usuario.php b/backend/app/Models/Usuario.php index 804db47..caea07d 100644 --- a/backend/app/Models/Usuario.php +++ b/backend/app/Models/Usuario.php @@ -32,11 +32,15 @@ class Usuario extends Model { } public function isGlobalAdmin() { - return in_array('global_admin', $this->roles); + return $this->hasRole('global_admin'); } public function isAdmin() { - return in_array('admin', $this->roles); + return $this->hasRole('admin'); + } + + public function hasRole($role) { + return in_array($role, $this->roles); } public function restaurantes() { diff --git a/backend/bootstrap/app.php b/backend/bootstrap/app.php index 891d15e..9636337 100644 --- a/backend/bootstrap/app.php +++ b/backend/bootstrap/app.php @@ -76,7 +76,8 @@ $app->configure('logging'); $app->routeMiddleware([ 'auth' => App\Http\Middleware\Auth0Middleware::class, - 'log_endpoint' => App\Http\Middleware\LogEndpointHitMiddleware::class + 'log_endpoint' => App\Http\Middleware\LogEndpointHitMiddleware::class, + 'role' => App\Http\Middleware\RoleMiddleware::class ]); $app->middleware([ diff --git a/backend/routes/web.php b/backend/routes/web.php index ecbdf75..3f4d97d 100644 --- a/backend/routes/web.php +++ b/backend/routes/web.php @@ -9,6 +9,7 @@ $router->get('/', function () use ($router) { $router->group(['prefix' => 'api/v1', 'middleware' => ['auth', 'log_endpoint']], function () use ($router) { $router->group(['prefix' => '/users'], function () use ($router) { $router->get( '/', ['as' => 'users.all', 'uses' => 'UsuariosController@all']); + $router->get( '/me', ['as' => 'users.get_me', 'uses' => 'UsuariosController@getMe']); $router->get( '/{id}', ['as' => 'users.get', 'uses' => 'UsuariosController@get']); $router->post( '/', ['as' => 'users.create', 'uses' => 'UsuariosController@create']); $router->put( '/{id}', ['as' => 'users.update', 'uses' => 'UsuariosController@update']); @@ -21,9 +22,9 @@ $router->group(['prefix' => 'api/v1', 'middleware' => ['auth', 'log_endpoint']], $router->group(['prefix' => '/restaurantes'], function () use ($router) { $router->get( '/', ['as' => 'restaurant.all', 'uses' => 'RestaurantesController@all']); $router->get( '/{id}', ['as' => 'restaurant.get', 'uses' => 'RestaurantesController@get']); - $router->post( '/', ['as' => 'restaurant.create', 'uses' => 'RestaurantesController@create']); - $router->put( '/{id}', ['as' => 'restaurant.update', 'uses' => 'RestaurantesController@update']); - $router->delete('/{id}', ['as' => 'restaurant.delete', 'uses' => 'RestaurantesController@delete']); + $router->post( '/', ['as' => 'restaurant.create', 'uses' => 'RestaurantesController@create', 'middleware' => 'role:global_admin']); + $router->put( '/{id}', ['as' => 'restaurant.update', 'uses' => 'RestaurantesController@update', 'middleware' => 'role:global_admin']); + $router->delete('/{id}', ['as' => 'restaurant.delete', 'uses' => 'RestaurantesController@delete', 'middleware' => 'role:global_admin']); $router->get( '/{restaurante_id}/canales-venta', ['as' => 'canales-venta.all', 'uses' => 'CanalesVentaController@all']); $router->get( '/{restaurante_id}/canales-venta/{id}', ['as' => 'canales-venta.get', 'uses' => 'CanalesVentaController@get']); diff --git a/database/modelo.vpp b/database/modelo.vpp index ddb1d9f..26e2ba9 100644 Binary files a/database/modelo.vpp and b/database/modelo.vpp differ