68 lines
2.2 KiB
PHP
68 lines
2.2 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers;
|
|
|
|
use App\Models\User;
|
|
use Illuminate\Http\RedirectResponse;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Validation\Rule;
|
|
use Illuminate\View\View;
|
|
|
|
class UserController extends Controller
|
|
{
|
|
public function index(Request $request): View
|
|
{
|
|
$this->authorizeAdmin($request);
|
|
|
|
return view('users.index', ['users' => User::orderBy('username')->paginate(20)]);
|
|
}
|
|
|
|
public function store(Request $request): RedirectResponse
|
|
{
|
|
$this->authorizeAdmin($request);
|
|
$data = $request->validate([
|
|
'username' => ['required', 'string', 'max:255', 'unique:users,username'],
|
|
'email' => ['required', 'email', 'max:255', 'unique:users,email'],
|
|
'role' => ['required', Rule::in(['admin', 'user'])],
|
|
'password' => ['required', 'string', 'min:12'],
|
|
]);
|
|
User::create($data);
|
|
|
|
return back()->with('status', 'User created.');
|
|
}
|
|
|
|
public function update(Request $request, User $user): RedirectResponse
|
|
{
|
|
$this->authorizeAdmin($request);
|
|
$data = $request->validate([
|
|
'email' => ['sometimes', 'email', Rule::unique('users', 'email')->ignore($user->id)],
|
|
'role' => ['sometimes', Rule::in(['admin', 'user'])],
|
|
'disabled' => ['sometimes', 'boolean'],
|
|
'password' => ['nullable', 'string', 'min:12'],
|
|
]);
|
|
if (empty($data['password'])) {
|
|
unset($data['password']);
|
|
}
|
|
if ($user->id === $request->user()->id && (($data['disabled'] ?? false) || ($data['role'] ?? 'admin') !== 'admin')) {
|
|
return back()->withErrors(['user' => 'You cannot disable or demote your own admin account.']);
|
|
}
|
|
$user->update($data);
|
|
|
|
return back()->with('status', 'User updated.');
|
|
}
|
|
|
|
public function destroy(Request $request, User $user): RedirectResponse
|
|
{
|
|
$this->authorizeAdmin($request);
|
|
abort_if($user->id === $request->user()->id, 422, 'You cannot delete your own account.');
|
|
$user->delete();
|
|
|
|
return back()->with('status', 'User deleted.');
|
|
}
|
|
|
|
private function authorizeAdmin(Request $request): void
|
|
{
|
|
abort_unless($request->user()->role === 'admin', 403);
|
|
}
|
|
}
|