Created a middleware for checking permissions in admin controllers, so I cannot forget to add permission checks.

Changed some descriptions of the admin tools for Miraak.

Aded some more Permissions and added a moderator role.

dist/app/Attributes/IgnorePermissionCheck.php

@@ -0,0 +1,8 @@
+<?php
+
+namespace App\Attributes;
+
+use Attribute;
+
+#[Attribute]
+class IgnorePermissionCheck {}

dist/app/Enums/Auth/Permissions.php

@@ -10,8 +10,10 @@ enum Permissions: string
     case GAME_NEWS = 'game-news';
     case VIEW_USERS = 'view-users';
     case EDIT_USERS = 'edit-users';
+    case USER_BANS = 'user-bans';
     // Access to the homepage while its in maintenance mode
     case VIEW_MAINTENANCE = 'view-maintenance-mode';
-
     case INBOX_MAILER = 'inbox-mailer';
+    case CHAT_REPORTS = 'chat-reports';
+    case PLAYER_REPORTS = 'player-reports';
 }

dist/app/Enums/Auth/Roles.php

@@ -6,7 +6,9 @@
 
 enum Roles: string
 {
-    case ADMIN = 'admin';
+    case Admin = 'admin';
+
+    case Moderator = 'moderator';
 
     public function getRole(): Role
     {

dist/app/Http/Controllers/Web/Admin/Tools/ChatMessageController.php

@@ -10,13 +10,13 @@
 
 class ChatMessageController extends AdminToolController
 {
-    protected static string $name = 'Chat Messages';
+    protected static string $name = 'Chat Profanity Alarm';
 
-    protected static string $description = 'See list of chat messages that triggered the Profanity filter.';
+    protected static string $description = 'View Triggered Chat Messages';
 
     protected static string $iconComponent = 'icons.chat';
 
-    protected static Permissions $neededPermission = Permissions::VIEW_USERS;
+    protected static Permissions $neededPermission = Permissions::CHAT_REPORTS;
 
     public function index()
     {

dist/app/Http/Controllers/Web/Admin/Tools/FileManagerController.php

@@ -8,9 +8,9 @@
 
 class FileManagerController extends AdminToolController
 {
-    protected static string $name = 'File Manager';
+    protected static string $name = 'Pak Manager';
 
-    protected static string $description = 'Add and edit game files the launcher installs.';
+    protected static string $description = 'Deploy Pak Updates for the Launcher';
     protected static string $iconComponent = 'icons.file-manager';
 
     protected static Permissions $neededPermission = Permissions::FILE_UPLOAD;

dist/app/Http/Controllers/Web/Admin/Tools/GameNewsController.php

@@ -16,7 +16,7 @@ class GameNewsController extends AdminToolController
 {
     protected static string $name = 'Game News';
 
-    protected static string $description = 'Create and edit in game news.';
+    protected static string $description = 'Create & Edit Game News';
 
     protected static string $iconComponent = 'icons.gamenews';
 

dist/app/Http/Controllers/Web/Admin/Tools/InboxMailerController.php

@@ -17,7 +17,7 @@ class InboxMailerController extends AdminToolController
 {
     protected static string $name = 'Mailer';
 
-    protected static string $description = 'Send inbox messages to one or multiple users.';
+    protected static string $description = 'Send Messages to Users';
     protected static string $iconComponent = 'icons.mail';
 
     protected static Permissions $neededPermission = Permissions::INBOX_MAILER;

dist/app/Http/Controllers/Web/Admin/Tools/LogViewerController.php

@@ -10,7 +10,7 @@ class LogViewerController extends AdminToolController
 {
     protected static string $name = 'Logs';
 
-    protected static string $description = 'View Application and Session Logs';
+    protected static string $description = 'View Backend Logs';
 
     protected static string $iconComponent = 'icons.logs';
 

dist/app/Http/Controllers/Web/Admin/Tools/PlayerReportsController.php

@@ -12,9 +12,9 @@
 class PlayerReportsController extends AdminToolController
 {
     protected static string $name = 'Reports';
-    protected static string $description = 'See player reports';
+    protected static string $description = 'View Reported Players';
     protected static string $iconComponent = 'icons.flag';
-    protected static Permissions $neededPermission = Permissions::VIEW_USERS;
+    protected static Permissions $neededPermission = Permissions::PLAYER_REPORTS;
 
     public function index()
     {

dist/app/Http/Controllers/Web/Admin/Tools/UsersController.php

@@ -3,6 +3,7 @@
 namespace App\Http\Controllers\Web\Admin\Tools;
 
 use App\APIClients\HttpMethod;
+use App\Attributes\IgnorePermissionCheck;
 use App\Enums\Auth\Permissions;
 use App\Enums\Game\Characters;
 use App\Enums\Game\Runner;
@@ -24,7 +25,7 @@ class UsersController extends AdminToolController
 {
     protected static string $name = 'Users';
 
-    protected static string $description = 'View and Manage Users';
+    protected static string $description = 'View & Manage Users';
 
     protected static string $iconComponent = 'icons.users';
 
@@ -36,9 +37,6 @@ class UsersController extends AdminToolController
 
     public function index(Request $request)
     {
-        if(!Auth::user()->can(Permissions::VIEW_USERS->value))
-            abort(403, 'No Permission to view this Page');
-
         $searchString = $request->input('search');
         $query = User::orderBy('last_known_username');
 
@@ -67,6 +65,9 @@ public function details(User $user)
 
     public function edit(User $user, EditUserRequest $request)
     {
+        if(!Auth::user()->can(Permissions::EDIT_USERS->value))
+            abort(403);
+
         $playerData = $user->playerData();
 
         $playerData->currency_a = $request->currencyA;
@@ -94,10 +95,12 @@ public function edit(User $user, EditUserRequest $request)
         return redirect()->back();
     }
 
+    #[IgnorePermissionCheck]
     public function getUsersForDropdown(Request $request)
     {
-        if(!Auth::check() && Auth::user()->can(Permissions::VIEW_USERS->value))
-            abort(403, 'No Permission to get this Data');
+        // only allow the retrieval of the dropdown if we have the view users permission or inbox mailer because there we need it.
+        if(!Auth::check() || !(Auth::user()->can(Permissions::VIEW_USERS->value) || Auth::user()->can(Permissions::INBOX_MAILER->value)))
+            abort(403);
 
         $searchTerm = $request->input('term');
 
@@ -131,10 +134,8 @@ public function getUsersForDropdown(Request $request)
 
     public function reset(User $user)
     {
-        $canReset = Auth::check() && Auth::user()->can(Permissions::EDIT_USERS->value);
-
-        if(!$canReset)
-            abort(403, 'You dont have enough permissions for this action.');
+        if(!Auth::user()->can(Permissions::EDIT_USERS->value))
+            abort(403);
 
         $user->playerData()->delete();
         return redirect()->back();
@@ -142,8 +143,8 @@ public function reset(User $user)
 
     public function bans(User $user)
     {
-        if(!Auth::user()->can(Permissions::EDIT_USERS->value))
-            abort(403, 'You are not allowed to edit Bans of a User.');
+        if(!Auth::user()->can(Permissions::USER_BANS->value))
+            abort(403);
 
         $bans = $user->bans;
         $this->overrideTitle('Bans for User: '.$user->id.'('.$user->last_known_username.')');
@@ -172,8 +173,8 @@ public function banPost(User $user, Ban $ban, BanPostRequest $request) {
     }
 
     public function createBan(User $user) {
-        if(!Auth::user()->can(Permissions::EDIT_USERS->value))
-            abort(403, 'No Permission to create a Ban.');
+        if(!Auth::user()->can(Permissions::USER_BANS->value))
+            abort(403);
 
         $newBan = new Ban();
         $newBan->ban_reason = 'Placeholder';

dist/app/Http/Middleware/AdminPermissionCheck.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Attributes\IgnorePermissionCheck;
+use App\Enums\Auth\Permissions;
+use App\Http\Controllers\Web\Admin\Tools\AdminToolController;
+use Auth;
+use Closure;
+use Illuminate\Http\Request;
+use phpDocumentor\Reflection\Types\ClassString;
+use ReflectionClass;
+use Route;
+use Symfony\Component\HttpFoundation\Response;
+
+class AdminPermissionCheck
+{
+    /**
+     * Check Permissions automatically if we are in a Admin Tool Controller.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        /** @var ClassString<AdminToolController> $currentControllerClass */
+        $currentControllerClass = Route::getCurrentRoute()->getControllerClass();
+
+        if(!class_exists($currentControllerClass) || !is_subclass_of($currentControllerClass, AdminToolController::class))
+            return $next($request);
+
+        $currentMethod = Route::getCurrentRoute()->getActionMethod();
+        $reflector = new ReflectionClass($currentControllerClass);
+
+        // Skip permission check if the attribute exists on this function
+        if(count($reflector->getMethod($currentMethod)->getAttributes(IgnorePermissionCheck::class)) > 0)
+            return $next($request);
+
+        if(!Auth::user()->can($currentControllerClass::getNeededPermission()))
+            abort(403);
+
+        return $next($request);
+    }
+}

dist/app/Http/Requests/Api/Admin/Tools/BanPostRequest.php

@@ -24,7 +24,7 @@ class BanPostRequest extends FormRequest
      */
     public function authorize(): bool
     {
-        return Auth::user()?->can(Permissions::EDIT_USERS->value);
+        return Auth::user()?->can(Permissions::USER_BANS->value);
     }
 
     /**

dist/app/Http/Requests/Api/Admin/Tools/HandleModerationRequest.php

@@ -12,7 +12,7 @@ class HandleModerationRequest extends FormRequest
 
     public function authorize(): bool
     {
-        return Auth::check() && Auth::user()->can(Permissions::VIEW_USERS->value);
+        return Auth::check();
     }
 
     public function rules(): array

dist/app/Providers/RouteServiceProvider.php

@@ -2,6 +2,7 @@
 
 namespace App\Providers;
 
+use App\Http\Middleware\AdminPermissionCheck;
 use Illuminate\Cache\RateLimiting\Limit;
 use Illuminate\Foundation\Support\Providers\RouteServiceProvider as ServiceProvider;
 use Illuminate\Http\Request;
@@ -52,7 +53,7 @@ public function boot(): void
             Route::middleware(['api', 'api.session'])
                 ->group(base_path('routes/messages.php'));
 
-            Route::middleware(['web', 'auth'])
+            Route::middleware(['web', 'auth', AdminPermissionCheck::class])
                 ->prefix('admin')
                 ->group(base_path('routes/admin.php'));
         });

dist/database/seeders/RolesAndPermissionsSeeder.php

@@ -3,6 +3,7 @@
 namespace Database\Seeders;
 
 use App\Enums\Auth\Permissions;
+use App\Enums\Auth\Roles;
 use Illuminate\Database\Seeder;
 use Spatie\Permission\Models\Permission;
 use Spatie\Permission\Models\Role;
@@ -15,25 +16,43 @@ class RolesAndPermissionsSeeder extends Seeder
     public function run(): void
     {
         // Create default Roles and Permissions
-       $adminRole = Role::findOrCreate(\App\Enums\Auth\Roles::ADMIN->value);
+       $adminRole = Role::findOrCreate(Roles::Admin->value);
+       $moderatorRole = Role::findOrCreate(Roles::Moderator->value);
+
        $viewAdminAreaPerm = Permission::findOrCreate(Permissions::ADMIN_AREA->value);
        $viewLogPerm = Permission::findOrCreate(Permissions::VIEW_LOG->value);
        $fileUploadPerm = Permission::findOrCreate(Permissions::FILE_UPLOAD->value);
        $gameNewsPerm = Permission::findOrCreate(Permissions::GAME_NEWS->value);
        $userReadPerm = Permission::findOrCreate(Permissions::VIEW_USERS->value);
        $userEditPerm = Permission::findOrCreate(Permissions::EDIT_USERS->value);
+       $userBansPerm = Permission::findOrCreate(Permissions::USER_BANS->value);
        $viewMaintenanceMode = Permission::findOrCreate(Permissions::VIEW_MAINTENANCE->value);
        $inboxMailerPerm = Permission::findOrCreate(Permissions::INBOX_MAILER->value);
+       $chatReportsPerm = Permission::findOrCreate(Permissions::CHAT_REPORTS->value);
+       $playerReportsPerm = Permission::findOrCreate(Permissions::PLAYER_REPORTS->value);
 
        $adminRole->givePermissionTo(
            $viewAdminAreaPerm,
            $viewLogPerm,
+           $fileUploadPerm,
            $gameNewsPerm,
            $userReadPerm,
            $userEditPerm,
-           $fileUploadPerm,
+           $userBansPerm,
            $viewMaintenanceMode,
            $inboxMailerPerm,
+           $chatReportsPerm,
+           $playerReportsPerm,
+       )->save();
+
+       $moderatorRole->givePermissionTo(
+           $viewAdminAreaPerm,
+           $userReadPerm,
+           $gameNewsPerm,
+           $inboxMailerPerm,
+           $userBansPerm,
+           $chatReportsPerm,
+           $playerReportsPerm,
        )->save();
     }
 }