Implement DDS-004 admin access foundation

.ddev/config.yaml

@@ -236,6 +236,12 @@ corepack_enable: false
 # The default time that DDEV waits for all containers to become ready can be increased from
 # the default 120. This helps in importing huge databases, for example.
 
+web_extra_exposed_ports:
+    - name: vite
+      container_port: 5173
+      http_port: 5172
+      https_port: 5173
+
 #web_extra_exposed_ports:
 #- name: nodejs
 #  container_port: 3000

.github/workflows/tests.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        php-version: ['8.3', '8.4', '8.5']
+        php-version: ['8.4', '8.5']
 
     steps:
       - name: Checkout code

app/Console/Commands/MakeAdminUserCommand.php

@@ -0,0 +1,95 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Enums\Role as RoleEnum;
+use App\Models\User;
+use Database\Seeders\RolesAndPermissionsSeeder;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Support\Str;
+use Illuminate\Validation\Rules\Password;
+use Spatie\Permission\PermissionRegistrar;
+
+class MakeAdminUserCommand extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'dds:make-admin
+        {email? : Email address of the admin user}
+        {--name= : Name to use when creating a new user}
+        {--password= : Password to set for the user}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Create or promote a user to the DDS admin role.';
+
+    /**
+     * Execute the console command.
+     */
+    public function handle(): int
+    {
+        app(RolesAndPermissionsSeeder::class)->run();
+
+        $email = $this->argument('email') ?: $this->ask('Email address');
+        $existingUser = is_string($email) ? User::query()->where('email', $email)->first() : null;
+        $name = $this->option('name') ?: $existingUser?->name ?: $this->ask('Name');
+        $password = $this->option('password');
+        $generatedPassword = null;
+
+        if (! $existingUser && ! is_string($password)) {
+            $password = $generatedPassword = Str::password(24);
+        }
+
+        $validator = Validator::make([
+            'email' => $email,
+            'name' => $name,
+            'password' => $password,
+        ], [
+            'email' => ['required', 'string', 'email:rfc', 'max:255'],
+            'name' => ['required', 'string', 'max:255'],
+            'password' => [$existingUser ? 'nullable' : 'required', 'string', Password::default()],
+        ]);
+
+        if ($validator->fails()) {
+            foreach ($validator->errors()->all() as $error) {
+                $this->error($error);
+            }
+
+            return self::FAILURE;
+        }
+
+        $validated = $validator->validated();
+        $user = $existingUser ?: new User(['email' => $validated['email']]);
+
+        $user->forceFill([
+            'name' => $validated['name'],
+            'email_verified_at' => $user->email_verified_at ?? now(),
+        ]);
+
+        if (is_string($validated['password'] ?? null) && $validated['password'] !== '') {
+            $user->password = $validated['password'];
+        }
+
+        $user->save();
+        $user->assignRole(RoleEnum::Admin->value);
+
+        app(PermissionRegistrar::class)->forgetCachedPermissions();
+
+        $this->info(sprintf('Admin access granted to %s.', $user->email));
+
+        if (is_string($generatedPassword)) {
+            $this->newLine();
+            $this->warn('Generated password: '.$generatedPassword);
+            $this->warn('Store this password now. It will not be shown again.');
+        }
+
+        return self::SUCCESS;
+    }
+}

app/Enums/Permission.php

@@ -0,0 +1,14 @@
+<?php
+
+namespace App\Enums;
+
+enum Permission: string
+{
+    case ViewEvents = 'events.view';
+    case CreateEvents = 'events.create';
+    case UpdateEvents = 'events.update';
+    case DeleteEvents = 'events.delete';
+
+    case ViewUsers = 'users.view';
+    case UpdateUsers = 'users.update';
+}

app/Enums/Role.php

@@ -0,0 +1,9 @@
+<?php
+
+namespace App\Enums;
+
+enum Role: string
+{
+    case Admin = 'admin';
+    case Editor = 'editor';
+}

app/Models/User.php

@@ -13,6 +13,7 @@
 use Laravel\Fortify\Contracts\PasskeyUser;
 use Laravel\Fortify\PasskeyAuthenticatable;
 use Laravel\Fortify\TwoFactorAuthenticatable;
+use Spatie\Permission\Traits\HasRoles;
 
 /**
  * @property int $id
@@ -32,7 +33,7 @@
 class User extends Authenticatable implements PasskeyUser
 {
     /** @use HasFactory<UserFactory> */
-    use HasFactory, Notifiable, PasskeyAuthenticatable, TwoFactorAuthenticatable;
+    use HasFactory, HasRoles, Notifiable, PasskeyAuthenticatable, TwoFactorAuthenticatable;
 
     /**
      * Get the attributes that should be cast.

composer.json

@@ -14,13 +14,14 @@
     ],
     "license": "MIT",
     "require": {
-        "php": "^8.3",
+        "php": "^8.4.1",
         "inertiajs/inertia-laravel": "^3.0",
         "laravel/chisel": "^0.1.0",
         "laravel/fortify": "^1.37.2",
         "laravel/framework": "^13.17",
         "laravel/tinker": "^3.0",
-        "laravel/wayfinder": "^0.1.14"
+        "laravel/wayfinder": "^0.1.14",
+        "spatie/laravel-permission": "^8.3"
     },
     "require-dev": {
         "fakerphp/faker": "^1.24",