Pilots cannot use the dashboard or flights without admin rights (#481)

* Use auth middleware instead of specific groups for logged in state

* Auth check for admin access

* Check user admin access for updates

* Formatting

app/Console/Kernel.php

@@ -42,7 +42,6 @@ class Kernel extends ConsoleKernel
      */
     protected function commands(): void
     {
-        require app_path('Http/Routes/console.php');
         $this->load(__DIR__.'/Commands');
         $this->load(__DIR__.'/Cron');
     }

app/Database/seeds/dev/users.yml

@@ -21,10 +21,10 @@ users:
     updated_at: now
   - id: 2
     pilot_id: 2
-    name: Carla Walters
+    name: Test User
-    email: carla.walters68@example.com
+    email: test@phpvms.net
-    password: admin
+    password: test
-    api_key: testuserapikey1
+    api_key: testuserapikey
     airline_id: 1
     rank_id: 1
     home_airport_id: KJFK
@@ -34,7 +34,7 @@ users:
     transfer_time: 360
     created_at: now
     updated_at: now
-    state: 0
+    state: 1
     opt_in: 1
     toc_accepted: 1
   - id: 3

app/Http/Controllers/Auth/RegisterController.php

@@ -17,9 +17,6 @@ use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Log;
 
-/**
- * Class RegisterController
- */
 class RegisterController extends Controller
 {
     use RegistersUsers;
@@ -58,7 +55,7 @@ class RegisterController extends Controller
     /**
      * @throws \Exception
      *
-     * @return \Illuminate\Contracts\View\Factory|\Illuminate\View\View
+     * @return mixed
      */
     public function showRegistrationForm()
     {

app/Http/Kernel.php

@@ -10,7 +10,6 @@ use App\Http\Middleware\RedirectIfAuthenticated;
 use App\Http\Middleware\UpdatePending;
 use App\Http\Middleware\VerifyCsrfToken;
 use Illuminate\Auth\Middleware\Authenticate;
-use Illuminate\Auth\Middleware\AuthenticateWithBasicAuth;
 use Illuminate\Auth\Middleware\Authorize;
 use Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse;
 use Illuminate\Foundation\Http\Kernel as HttpKernel;
@@ -44,14 +43,12 @@ class Kernel extends HttpKernel
             ShareErrorsFromSession::class,
             VerifyCsrfToken::class,
             SubstituteBindings::class,
-            //\Spatie\Pjax\Middleware\FilterIfPjax::class,
         ],
     ];
 
     protected $routeMiddleware = [
         'api.auth'       => ApiAuth::class,
         'auth'           => Authenticate::class,
-        'auth.basic'     => AuthenticateWithBasicAuth::class,
         'bindings'       => SubstituteBindings::class,
         'can'            => Authorize::class,
         'guest'          => RedirectIfAuthenticated::class,

app/Http/Routes/admin.php

@@ -2,101 +2,183 @@
 /**
  * Admin Routes
  */
-Route::group([
+use Illuminate\Support\Facades\Route;
-    'namespace'  => 'Admin', 'prefix' => 'admin', 'as' => 'admin.',
-    'middleware' => ['ability:admin,admin-access'],
-], static function () {
-    // CRUD for airlines
-    Route::resource('airlines', 'AirlinesController');
 
-    // CRUD for roles
+Route::group(
-    Route::resource('roles', 'RolesController');
+    [
+        'namespace'  => 'Admin',
+        'prefix'     => 'admin',
+        'as'         => 'admin.',
+        'middleware' => ['auth', 'ability:admin,admin-access'],
+    ],
+    static function () {
+        // CRUD for airlines
+        Route::resource('airlines', 'AirlinesController');
 
-    Route::get('airports/export', 'AirportController@export')->name('airports.export');
+        // CRUD for roles
-    Route::match(['get', 'post', 'put'], 'airports/fuel', 'AirportController@fuel');
+        Route::resource('roles', 'RolesController');
-    Route::match(['get', 'post'], 'airports/import', 'AirportController@import')->name('airports.import');
-    Route::match(['get', 'post', 'put', 'delete'], 'airports/{id}/expenses', 'AirportController@expenses');
-    Route::resource('airports', 'AirportController');
 
-    // Awards
+        Route::get('airports/export', 'AirportController@export')->name('airports.export');
-    Route::resource('awards', 'AwardController');
+        Route::match(['get', 'post', 'put'], 'airports/fuel', 'AirportController@fuel');
 
-    // aircraft and fare associations
+        Route::match(['get', 'post'], 'airports/import', 'AirportController@import')->name(
-    Route::get('aircraft/export', 'AircraftController@export')->name('aircraft.export');
+            'airports.import'
-    Route::match(['get', 'post'], 'aircraft/import', 'AircraftController@import')->name('aircraft.import');
+        );
-    Route::match(['get', 'post', 'put', 'delete'], 'aircraft/{id}/expenses', 'AircraftController@expenses');
-    Route::resource('aircraft', 'AircraftController');
 
-    // expenses
+        Route::match(
-    Route::get('expenses/export', 'ExpenseController@export')->name('expenses.export');
+            ['get', 'post', 'put', 'delete'],
-    Route::match(['get', 'post'], 'expenses/import', 'ExpenseController@import')->name('expenses.import');
+            'airports/{id}/expenses',
-    Route::resource('expenses', 'ExpenseController');
+            'AirportController@expenses'
+        );
 
-    // fares
+        Route::resource('airports', 'AirportController');
-    Route::get('fares/export', 'FareController@export')->name('fares.export');
-    Route::match(['get', 'post'], 'fares/import', 'FareController@import')->name('fares.import');
-    Route::resource('fares', 'FareController');
 
-    // files
+        // Awards
-    Route::post('files', 'FileController@store')->name('files.store');
+        Route::resource('awards', 'AwardController');
-    Route::delete('files/{id}', 'FileController@destroy')->name('files.delete');
 
-    // finances
+        // aircraft and fare associations
-    Route::resource('finances', 'FinanceController');
+        Route::get('aircraft/export', 'AircraftController@export')->name('aircraft.export');
 
-    // flights and aircraft associations
+        Route::match(['get', 'post'], 'aircraft/import', 'AircraftController@import')->name(
-    Route::get('flights/export', 'FlightController@export')->name('flights.export');
+            'aircraft.import'
-    Route::match(['get', 'post'], 'flights/import', 'FlightController@import')->name('flights.import');
+        );
-    Route::match(['get', 'post', 'put', 'delete'], 'flights/{id}/fares', 'FlightController@fares');
-    Route::match(['get', 'post', 'put', 'delete'], 'flights/{id}/fields', 'FlightController@field_values');
-    Route::match(['get', 'post', 'put', 'delete'], 'flights/{id}/subfleets', 'FlightController@subfleets');
-    Route::resource('flights', 'FlightController');
 
-    Route::resource('flightfields', 'FlightFieldController');
+        Route::match(
+            ['get', 'post', 'put', 'delete'],
+            'aircraft/{id}/expenses',
+            'AircraftController@expenses'
+        );
 
-    // pirep related routes
+        Route::resource('aircraft', 'AircraftController');
-    Route::get('pireps/fares', 'PirepController@fares');
-    Route::get('pireps/pending', 'PirepController@pending');
-    Route::resource('pireps', 'PirepController');
-    Route::match(['get', 'post', 'delete'], 'pireps/{id}/comments', 'PirepController@comments');
-    Route::match(['post', 'put'], 'pireps/{id}/status', 'PirepController@status')->name('pirep.status');
 
-    Route::resource('pirepfields', 'PirepFieldController');
+        // expenses
+        Route::get('expenses/export', 'ExpenseController@export')->name('expenses.export');
 
-    // rankings
+        Route::match(['get', 'post'], 'expenses/import', 'ExpenseController@import')->name(
-    Route::resource('ranks', 'RankController');
+            'expenses.import'
-    Route::match(['get', 'post', 'put', 'delete'], 'ranks/{id}/subfleets', 'RankController@subfleets');
+        );
 
-    // settings
+        Route::resource('expenses', 'ExpenseController');
-    Route::match(['get'], 'settings', 'SettingsController@index');
-    Route::match(['post', 'put'], 'settings', 'SettingsController@update')->name('settings.update');
 
-    // maintenance
+        // fares
-    Route::match(['get'], 'maintenance', 'MaintenanceController@index')->name('maintenance.index');
+        Route::get('fares/export', 'FareController@export')->name('fares.export');
-    Route::match(['post'], 'maintenance', 'MaintenanceController@cache')->name('maintenance.cache');
 
-    // subfleet
+        Route::match(['get', 'post'], 'fares/import', 'FareController@import')->name(
-    Route::get('subfleets/export', 'SubfleetController@export')->name('subfleets.export');
+            'fares.import'
-    Route::match(['get', 'post'], 'subfleets/import', 'SubfleetController@import')->name('subfleets.import');
+        );
-    Route::match(['get', 'post', 'put', 'delete'], 'subfleets/{id}/expenses', 'SubfleetController@expenses');
-    Route::match(['get', 'post', 'put', 'delete'], 'subfleets/{id}/fares', 'SubfleetController@fares');
-    Route::match(['get', 'post', 'put', 'delete'], 'subfleets/{id}/ranks', 'SubfleetController@ranks');
-    Route::resource('subfleets', 'SubfleetController');
 
-    Route::resource('users', 'UserController');
+        Route::resource('fares', 'FareController');
-    Route::get(
-        'users/{id}/regen_apikey',
-        'UserController@regen_apikey'
-    )->name('users.regen_apikey');
 
-    // defaults
+        // files
-    Route::get('', ['uses' => 'DashboardController@index'])->middleware('update_pending');
+        Route::post('files', 'FileController@store')->name('files.store');
-    Route::get('/', ['uses' => 'DashboardController@index'])->middleware('update_pending');
+        Route::delete('files/{id}', 'FileController@destroy')->name('files.delete');
 
-    Route::get('dashboard', ['uses' => 'DashboardController@index', 'name' => 'dashboard']);
+        // finances
-    Route::match(
+        Route::resource('finances', 'FinanceController');
-        ['get', 'post', 'delete'],
+
-        'dashboard/news',
+        // flights and aircraft associations
-        ['uses' => 'DashboardController@news']
+        Route::get('flights/export', 'FlightController@export')->name('flights.export');
-    )->name('dashboard.news');
+
-});
+        Route::match(['get', 'post'], 'flights/import', 'FlightController@import')->name(
+            'flights.import'
+        );
+
+        Route::match(
+            ['get', 'post', 'put', 'delete'],
+            'flights/{id}/fares',
+            'FlightController@fares'
+        );
+
+        Route::match(
+            ['get', 'post', 'put', 'delete'],
+            'flights/{id}/fields',
+            'FlightController@field_values'
+        );
+
+        Route::match(
+            ['get', 'post', 'put', 'delete'],
+            'flights/{id}/subfleets',
+            'FlightController@subfleets'
+        );
+
+        Route::resource('flights', 'FlightController');
+
+        Route::resource('flightfields', 'FlightFieldController');
+
+        // pirep related routes
+        Route::get('pireps/fares', 'PirepController@fares');
+        Route::get('pireps/pending', 'PirepController@pending');
+        Route::resource('pireps', 'PirepController');
+        Route::match(['get', 'post', 'delete'], 'pireps/{id}/comments', 'PirepController@comments');
+        Route::match(['post', 'put'], 'pireps/{id}/status', 'PirepController@status')->name(
+            'pirep.status'
+        );
+
+        Route::resource('pirepfields', 'PirepFieldController');
+
+        // rankings
+        Route::resource('ranks', 'RankController');
+        Route::match(
+            ['get', 'post', 'put', 'delete'],
+            'ranks/{id}/subfleets',
+            'RankController@subfleets'
+        );
+
+        // settings
+        Route::match(['get'], 'settings', 'SettingsController@index');
+        Route::match(['post', 'put'], 'settings', 'SettingsController@update')->name(
+            'settings.update'
+        );
+
+        // maintenance
+        Route::match(['get'], 'maintenance', 'MaintenanceController@index')->name(
+            'maintenance.index'
+        );
+        Route::match(['post'], 'maintenance', 'MaintenanceController@cache')->name(
+            'maintenance.cache'
+        );
+
+        // subfleet
+        Route::get('subfleets/export', 'SubfleetController@export')->name('subfleets.export');
+        Route::match(['get', 'post'], 'subfleets/import', 'SubfleetController@import')->name(
+            'subfleets.import'
+        );
+
+        Route::match(
+            ['get', 'post', 'put', 'delete'],
+            'subfleets/{id}/expenses',
+            'SubfleetController@expenses'
+        );
+
+        Route::match(
+            ['get', 'post', 'put', 'delete'],
+            'subfleets/{id}/fares',
+            'SubfleetController@fares'
+        );
+
+        Route::match(
+            ['get', 'post', 'put', 'delete'],
+            'subfleets/{id}/ranks',
+            'SubfleetController@ranks'
+        );
+
+        Route::resource('subfleets', 'SubfleetController');
+
+        Route::resource('users', 'UserController');
+        Route::get(
+            'users/{id}/regen_apikey',
+            'UserController@regen_apikey'
+        )->name('users.regen_apikey');
+
+        // defaults
+        Route::get('', ['uses' => 'DashboardController@index'])->middleware('update_pending');
+        Route::get('/', ['uses' => 'DashboardController@index'])->middleware('update_pending');
+
+        Route::get('dashboard', ['uses' => 'DashboardController@index', 'name' => 'dashboard']);
+        Route::match(
+            ['get', 'post', 'delete'],
+            'dashboard/news',
+            ['uses' => 'DashboardController@news']
+        )->name('dashboard.news');
+    }
+);

app/Http/Routes/api.php

@@ -3,6 +3,8 @@
 /**
  * Public routes
  */
+use Illuminate\Support\Facades\Route;
+
 Route::group([], function () {
     Route::get('acars', 'AcarsController@live_flights');
     Route::get('acars/geojson', 'AcarsController@pireps_geojson');

app/Http/Routes/console.php

@@ -1,18 +0,0 @@
-<?php
-
-use Illuminate\Foundation\Inspiring;
-
-/*
-|--------------------------------------------------------------------------
-| Console Routes
-|--------------------------------------------------------------------------
-|
-| This file is where you may define all of your Closure based console
-| commands. Each Closure is bound to a command instance allowing a
-| simple approach to interacting with each command's IO methods.
-|
-*/
-
-Artisan::command('inspire', function () {
-    $this->comment(Inspiring::quote());
-});

app/Http/Routes/web.php

@@ -4,6 +4,8 @@
  * User doesn't need to be logged in for these
  */
 use App\Http\Middleware\SetActiveTheme;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Route;
 
 Route::group([
     'namespace'  => 'Frontend', 'prefix' => '', 'as' => 'frontend.',
@@ -24,7 +26,7 @@ Route::group([
  */
 Route::group([
     'namespace'  => 'Frontend', 'prefix' => '', 'as' => 'frontend.',
-    'middleware' => ['role:admin|user', SetActiveTheme::class],
+    'middleware' => ['auth', SetActiveTheme::class],
 ], function () {
     Route::resource('dashboard', 'DashboardController');
 

modules/Updater/Providers/UpdateServiceProvider.php

@@ -23,7 +23,7 @@ class UpdateServiceProvider extends ServiceProvider
         Route::group([
              'as'         => 'update.',
              'prefix'     => 'update',
-             'middleware' => ['web'],
+             'middleware' => ['auth', 'ability:admin,admin-access', 'web'],
              'namespace'  => 'Modules\Updater\Http\Controllers',
          ], function () {
              Route::get('/', 'UpdateController@index')->name('index');