starred/newznab-tmux
1
0
Fork 0
mirror of https://github.com/NNTmux/newznab-tmux.git synced 2026-08-28 17:01:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix getCategoryExclusionById() excluding every category for role-only users

Browse Source 
RolesAndPermissionsSeeder grants every 'view *' permission via
Role::givePermissionTo() only -- it never grants permissions directly to a
user with User::givePermissionTo(). That is true for every seeded role,
including Admin.

User::getCategoryExclusionById() computed the allowed permission set as:

    $userAllowed = $user->getDirectPermissions()->pluck('name')->toArray();
    $roleAllowed = $user->getAllPermissions()->pluck('name')->toArray();
    $allowed = array_intersect($roleAllowed, $userAllowed);

getAllPermissions() already includes permissions granted via the user's
role(s), so intersecting it with getDirectPermissions() (permissions
assigned directly to the user, bypassing roles) means $allowed is empty
for any user whose permissions come only from their role. Since every
seeded role works this way, this silently excluded every category root
for every user on a fresh install, and any subsequent Newznab/Torznab API
search or browse request returned zero results with no visible error.

Fix: use getAllPermissions() directly, since it already reflects both
role-granted and directly-granted permissions.

Added a regression test (test_role_only_permissions_are_not_excluded)
that mirrors the real seeder setup -- role-only permissions, nothing
granted directly to the user -- to make sure this doesn't regress.
This commit is contained in:
joemeyer76
2026-07-03 18:18:46 -04:00
parent 09ad515969
commit e62724f2cd
2 changed files with 32 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Feature/UserExcludedCategoryTest.php
+23
View File
@@ -266,6 +266,29 @@ final class UserExcludedCategoryTest extends TestCase
$this->assertContains(2070, $exclusions);
}
public function test_role_only_permissions_are_not_excluded(): void
{
// Regression test: RolesAndPermissionsSeeder grants every view permission
// via the role only (Role::givePermissionTo), never directly to the user
// (User::givePermissionTo). getCategoryExclusionById() must honor
// role-granted permissions, not just permissions assigned directly to
// the user, or every category ends up excluded on a fresh install.
$roleOnlyUser = $this->createTestUser($this->userRole->id);
$roleOnlyUser->assignRole($this->userRole);
// Deliberately do NOT call $roleOnlyUser->givePermissionTo(...) here.
$exclusions = User::getCategoryExclusionById($roleOnlyUser->id);
// The role has every 'view *' permission except 'view other', so only
// the 'Other' root category (id 1) should be excluded -- nothing from
// the seeded Movies (2000) or TV (5000) root categories.
$this->assertNotContains(2030, $exclusions);
$this->assertNotContains(2040, $exclusions);
$this->assertNotContains(2070, $exclusions);
$this->assertNotContains(5030, $exclusions);
$this->assertNotContains(5040, $exclusions);
}
public function test_clearing_exclusions_works(): void
{
// First add exclusions