starred/newznab-tmux
1
0
Fork 0
mirror of https://github.com/NNTmux/newznab-tmux.git synced 2026-08-29 01:08:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1863 from NNTmux/revert-1860-fix/category-exclusion-role-permissions

Browse Source 
Revert "Fix getCategoryExclusionById() excluding every category for role-only users"
This commit is contained in:
DariusIII
2026-07-09 08:35:32 +02:00
committed by GitHub
parent 3927bf5656 06379f25cb
commit 2fe92b5bfa
2 changed files with 3 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Models/User.php
+3 -9
View File
@@ -1647,15 +1647,9 @@ final class User extends Authenticatable implements CanResetPasswordContract, Ha
{ {
$user = static::findOrFail($userId); $user = static::findOrFail($userId);
// getAllPermissions() already merges permissions granted directly to the $userAllowed = $user->getDirectPermissions()->pluck('name')->toArray();
// user with permissions granted via their role(s). Intersecting it with $roleAllowed = $user->getAllPermissions()->pluck('name')->toArray();
// getDirectPermissions() (as this used to do) meant that any user whose $allowed = array_intersect($roleAllowed, $userAllowed);
// permissions come only from their role -- which is how every seeded
// role in RolesAndPermissionsSeeder grants them, including Admin -- ended
// up with an empty $allowed array, and therefore every category root
// excluded. That silently zeroed out browse/API results for all users
// on a fresh install.
$allowed = $user->getAllPermissions()->pluck('name')->toArray();
$categoryPermissions = [ $categoryPermissions = [
'view console' => 1000, 'view console' => 1000,
tests/Feature/UserExcludedCategoryTest.php
-23
View File
@@ -266,29 +266,6 @@ final class UserExcludedCategoryTest extends TestCase
$this->assertContains(2070, $exclusions); $this->assertContains(2070, $exclusions);
} }
public function test_role_only_permissions_are_not_excluded(): void
{
// Regression test: RolesAndPermissionsSeeder grants every view permission
// via the role only (Role::givePermissionTo), never directly to the user
// (User::givePermissionTo). getCategoryExclusionById() must honor
// role-granted permissions, not just permissions assigned directly to
// the user, or every category ends up excluded on a fresh install.
$roleOnlyUser = $this->createTestUser($this->userRole->id);
$roleOnlyUser->assignRole($this->userRole);
// Deliberately do NOT call $roleOnlyUser->givePermissionTo(...) here.
$exclusions = User::getCategoryExclusionById($roleOnlyUser->id);
// The role has every 'view *' permission except 'view other', so only
// the 'Other' root category (id 1) should be excluded -- nothing from
// the seeded Movies (2000) or TV (5000) root categories.
$this->assertNotContains(2030, $exclusions);
$this->assertNotContains(2040, $exclusions);
$this->assertNotContains(2070, $exclusions);
$this->assertNotContains(5030, $exclusions);
$this->assertNotContains(5040, $exclusions);
}
public function test_clearing_exclusions_works(): void public function test_clearing_exclusions_works(): void
{ {
// First add exclusions // First add exclusions