Josep Piguillem
f93775e549
A token acts as the person who made it, within the permissions it was given and those they still hold, checked on every request. Permission checks now go through one gate rule, since spatie's answered first and never asked the token. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
51 lines
1.7 KiB
PHP
51 lines
1.7 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Resources;
|
|
|
|
use App\Models\User;
|
|
use App\Support\Permissions;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Http\Resources\Json\JsonResource;
|
|
|
|
/**
|
|
* @mixin User
|
|
*/
|
|
class UserResource extends JsonResource
|
|
{
|
|
/**
|
|
* @return array<string, mixed>
|
|
*/
|
|
public function toArray(Request $request): array
|
|
{
|
|
return [
|
|
'id' => $this->id,
|
|
// The identity server's id for this person, for clients that also
|
|
// talk to oauth.pireon.dev directly.
|
|
'oauth_id' => $this->oauth_id,
|
|
'name' => $this->name,
|
|
'email' => $this->email,
|
|
'avatar_url' => $this->avatar_url,
|
|
'locale' => $this->locale,
|
|
'is_active' => $this->is_active,
|
|
'last_login_at' => $this->last_login_at?->toIso8601String(),
|
|
'created_at' => $this->created_at?->toIso8601String(),
|
|
|
|
// Local authorisation — what this person may do in *this* app.
|
|
'roles' => $this->whenLoaded('roles', fn () => $this->roles->pluck('name')->values()),
|
|
'permissions' => $this->when(
|
|
$request->routeIs('api.v1.me'),
|
|
// Through a machine token, only what the token may do.
|
|
fn () => $this->resource->currentAccessToken()
|
|
? collect(Permissions::all())->filter(fn (string $permission) => $this->resource->can($permission))->values()
|
|
: $this->getAllPermissions()->pluck('name')->values(),
|
|
),
|
|
|
|
// Roles reported by the identity server. Informational only: they
|
|
// grant nothing here.
|
|
'remote_roles' => $this->remote_roles ?? [],
|
|
];
|
|
}
|
|
}
|