fix(security): prevent privilege escalation through team settings

packages/admin/composer.json

@@ -26,10 +26,10 @@
     "php": "^8.3",
     "bacon/bacon-qr-code": "^2.0|^3.1",
     "codeat3/blade-phosphor-icons": "^2.4",
-    "codewithdennis/filament-select-tree": "^4.1",
+    "codewithdennis/filament-select-tree": "^4.2",
     "danharrin/livewire-rate-limiting": "^1.0|^2.2",
-    "filament/filament": "^4.11",
-    "filament/spatie-laravel-media-library-plugin": "^4.11",
+    "filament/filament": "^4.12",
+    "filament/spatie-laravel-media-library-plugin": "^4.12",
     "gehrisandro/tailwind-merge-laravel": "^1.3",
     "leandrocfe/filament-apex-charts": "^5.1",
     "illuminate/console": "^11.28|^12.0|^13.0",
@@ -45,7 +45,7 @@
     "jaocero/radio-deck": "^3.1",
     "laravel/prompts": "^0.3.16",
     "laravelcm/livewire-slide-overs": "^2.1",
-    "livewire/blaze": "^1.0",
+    "livewire/blaze": "^1.0.14",
     "mckenziearts/filament-untitledui-icons": "^1.2",
     "milon/barcode": "^11.0|^12.0|^13.0",
     "pragmarx/google2fa": "^8.0|^9.0",
@@ -55,7 +55,7 @@
     "shopper/sidebar": "self.version",
     "shopper/shipping": "self.version",
     "shopper/payment": "self.version",
-    "spatie/laravel-medialibrary": "^11.5",
+    "spatie/laravel-medialibrary": "^11.23.3",
     "spatie/laravel-package-tools": "^1.9",
     "spatie/laravel-permission": "^6.24|^7.0",
     "stevebauman/location": "^7.6",

packages/admin/database/seeders/PermissionsTableSeeder.php

@@ -26,7 +26,7 @@ public function run(): void
             'name' => 'access_setting',
             'group_name' => 'system',
             'display_name' => __('Access Setting'),
-            'description' => __('This permission allow user to view the setting page.'),
+            'description' => __('This permission allow user to view and update the store settings, except administrators, roles and permissions.'),
             'can_be_removed' => false,
         ]);
 

packages/admin/resources/lang/en/notifications.php

@@ -74,6 +74,10 @@
     'unauthorized' => [
         'title' => 'Unauthorized',
         'body' => 'You do not have permission to perform this action.',
+        'administrator_role' => 'Only an administrator can manage the administrator role.',
+        'administrator_only' => 'Only an administrator can create or delete a permission.',
+        'permission_scope' => 'You can only grant a permission that you hold yourself.',
+        'protected_permission' => 'This permission is required by the panel and cannot be deleted.',
     ],
 
 ];

packages/admin/resources/lang/es/notifications.php

@@ -74,6 +74,10 @@
     'unauthorized' => [
         'title' => 'No autorizado',
         'body' => 'No tienes permiso para realizar esta acción.',
+        'administrator_role' => 'Solo un administrador puede gestionar el rol de administrador.',
+        'administrator_only' => 'Solo un administrador puede crear o eliminar un permiso.',
+        'permission_scope' => 'Solo puedes conceder un permiso que tú mismo posees.',
+        'protected_permission' => 'El panel necesita este permiso y no se puede eliminar.',
     ],
 
 ];

packages/admin/resources/lang/fr/notifications.php

@@ -74,6 +74,10 @@
     'unauthorized' => [
         'title' => 'Non autorisé',
         'body' => 'Vous n\'avez pas la permission d\'effectuer cette action.',
+        'administrator_role' => 'Seul un administrateur peut gérer le rôle administrateur.',
+        'administrator_only' => 'Seul un administrateur peut créer ou supprimer une permission.',
+        'permission_scope' => 'Vous ne pouvez accorder qu\'une permission que vous détenez vous-même.',
+        'protected_permission' => 'Cette permission est nécessaire au panel et ne peut pas être supprimée.',
     ],
 
 ];

packages/admin/resources/lang/tr/notifications.php

@@ -74,6 +74,10 @@
     'unauthorized' => [
         'title' => 'Yetkisiz',
         'body' => 'Bu işlemi gerçekleştirme izniniz bulunmuyor.',
+        'administrator_role' => 'Yönetici rolünü yalnızca bir yönetici yönetebilir.',
+        'administrator_only' => 'Yalnızca bir yönetici izin oluşturabilir veya silebilir.',
+        'permission_scope' => 'Yalnızca kendinizde bulunan bir izni verebilirsiniz.',
+        'protected_permission' => 'Bu izin panel için gereklidir ve silinemez.',
     ],
 
 ];

packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php

@@ -40,7 +40,7 @@ class="dark:focus:offset-gray-800 text-primary-600 focus:ring-primary-500 size-4
                                 />
                             </div>
                             <div class="flex items-center space-x-3">
-                                @if ($permission->can_be_removed)
+                                @if ($permission->can_be_removed && auth(config('shopper.auth.guard'))->user()?->isAdmin())
                                     <button
                                         wire:click="removePermission({{ $permission->id }})"
                                         type="button"

packages/admin/src/Livewire/Components/Settings/Team/Permissions.php

@@ -5,29 +5,32 @@
 namespace Shopper\Livewire\Components\Settings\Team;
 
 use Filament\Notifications\Notification;
+use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Contracts\View\View;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\On;
 use Livewire\Component;
 use Shopper\Models\Permission;
 use Shopper\Models\Role;
+use Shopper\Traits\AuthorizesTeamManagement;
 use Shopper\Traits\HandlesAuthorizationExceptions;
 
 class Permissions extends Component
 {
+    use AuthorizesTeamManagement;
     use HandlesAuthorizationExceptions;
 
     #[Locked]
     public Role $role;
 
     public function mount(): void
     {
-        $this->authorize('view_users');
+        $this->authorizeTeamAccess($this->role);
     }
 
     public function togglePermission(int $id): void
     {
-        $this->authorize('access_setting');
+        $this->authorizeTeamManagement($this->role);
 
         $permission = Permission::query()->find($id);
 
@@ -42,26 +45,34 @@ public function togglePermission(int $id): void
                 ->title(__('shopper::notifications.users_roles.permission_revoke', ['permission' => $permission->display_name]))
                 ->success()
                 ->send();
-        } else {
-            $this->role->givePermissionTo($permission->name);
 
-            Notification::make()
-                ->title(__('shopper::notifications.users_roles.permission_allow', ['permission' => $permission->display_name]))
-                ->success()
-                ->send();
+            return;
         }
+
+        $this->authorizePermissionGrant($this->role, $permission);
+
+        $this->role->givePermissionTo($permission->name);
+
+        Notification::make()
+            ->title(__('shopper::notifications.users_roles.permission_allow', ['permission' => $permission->display_name]))
+            ->success()
+            ->send();
     }
 
     public function removePermission(int $id): void
     {
-        $this->authorize('access_setting');
+        $this->authorizePermissionDefinition();
 
         $permission = Permission::query()->find($id);
 
         if ($permission === null) {
             return;
         }
 
+        if (! $permission->can_be_removed) {
+            throw new AuthorizationException(__('shopper::notifications.unauthorized.protected_permission'));
+        }
+
         $permission->delete();
 
         Notification::make()

packages/admin/src/Livewire/Components/Settings/Team/UsersRole.php

@@ -20,10 +20,12 @@
 use Livewire\Component;
 use Shopper\Models\Contracts\ShopperUser;
 use Shopper\Models\Role;
+use Shopper\Traits\AuthorizesTeamManagement;
 use Shopper\Traits\HandlesAuthorizationExceptions;
 
 class UsersRole extends Component implements HasActions, HasSchemas, HasTable
 {
+    use AuthorizesTeamManagement;
     use HandlesAuthorizationExceptions;
     use InteractsWithActions;
     use InteractsWithSchemas;
@@ -32,6 +34,11 @@ class UsersRole extends Component implements HasActions, HasSchemas, HasTable
     #[Locked]
     public Role $role;
 
+    public function mount(): void
+    {
+        $this->authorizeTeamAccess($this->role);
+    }
+
     public function table(Table $table): Table
     {
         $userModel = config('auth.providers.users.model');

packages/admin/src/Livewire/Pages/Settings/Team/Index.php

@@ -28,19 +28,21 @@
 use Mckenziearts\Icons\Untitledui\Enums\Untitledui;
 use Shopper\Models\Contracts\ShopperUser;
 use Shopper\Models\Role;
+use Shopper\Traits\AuthorizesTeamManagement;
 use Shopper\Traits\HandlesAuthorizationExceptions;
 
 #[Layout('shopper::components.layouts.setting')]
 class Index extends Component implements HasActions, HasSchemas, HasTable
 {
+    use AuthorizesTeamManagement;
     use HandlesAuthorizationExceptions;
     use InteractsWithActions;
     use InteractsWithSchemas;
     use InteractsWithTable;
 
     public function mount(): void
     {
-        $this->authorize('view_users');
+        $this->authorizeTeamAccess();
     }
 
     public function createRoleAction(): Action

packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php

@@ -29,6 +29,7 @@
 use Mckenziearts\Icons\Untitledui\Enums\Untitledui;
 use Shopper\Models\Permission;
 use Shopper\Models\Role;
+use Shopper\Traits\AuthorizesTeamManagement;
 use Shopper\Traits\HandlesAuthorizationExceptions;
 
 /**
@@ -37,6 +38,7 @@
 #[Layout('shopper::components.layouts.setting')]
 class RolePermission extends Component implements HasActions, HasSchemas
 {
+    use AuthorizesTeamManagement;
     use HandlesAuthorizationExceptions;
     use InteractsWithActions;
     use InteractsWithSchemas;
@@ -49,7 +51,7 @@ class RolePermission extends Component implements HasActions, HasSchemas
 
     public function mount(): void
     {
-        $this->authorize('view_users');
+        $this->authorizeTeamAccess($this->role);
 
         $this->form->fill($this->role->toArray());
     }
@@ -97,6 +99,7 @@ public function generatePermissionsAction(): Action
             ->icon(Untitledui::ShieldZap)
             ->color('gray')
             ->authorize('access_setting')
+            ->visible(fn (): bool => $this->actingUserIsAdmin())
             ->modalWidth(Width::Medium)
             ->modalHeading(__('shopper::pages/settings/staff.generate_permissions'))
             ->modalDescription(__('shopper::pages/settings/staff.generate_permissions_description'))
@@ -130,6 +133,8 @@ public function generatePermissionsAction(): Action
                     ->columnSpan('full'),
             ])
             ->action(function (array $data): void {
+                $this->authorizePermissionDefinition();
+
                 $resource = $data['resource'];
                 $group = $data['group_name'] ?? null;
 
@@ -156,6 +161,7 @@ public function createPermissionAction(): Action
             ->label(__('shopper::pages/settings/staff.create_permission'))
             ->icon(Untitledui::Lock04)
             ->authorize('access_setting')
+            ->visible(fn (): bool => $this->actingUserIsAdmin())
             ->modalWidth(Width::ExtraLarge)
             ->modalHeading(__('shopper::modals.permissions.new'))
             ->modalDescription(__('shopper::modals.permissions.new_description'))
@@ -183,6 +189,8 @@ public function createPermissionAction(): Action
                     ->columnSpan('full'),
             ])
             ->action(function (array $data): void {
+                $this->authorizePermissionDefinition();
+
                 /** @var Permission $permission */
                 $permission = Permission::query()->create($data);
 
@@ -199,7 +207,7 @@ public function createPermissionAction(): Action
 
     public function save(): void
     {
-        $this->authorize('access_setting');
+        $this->authorizeTeamManagement($this->role);
 
         $this->role->update($this->form->getState());
 

packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php

@@ -16,6 +16,7 @@
 use Filament\Schemas\Concerns\InteractsWithSchemas;
 use Filament\Schemas\Contracts\HasSchemas;
 use Filament\Schemas\Schema;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Str;
@@ -26,6 +27,7 @@
 use Shopper\Models\Contracts\ShopperUser;
 use Shopper\Models\Role;
 use Shopper\Notifications\AdminSendCredentials;
+use Shopper\Traits\AuthorizesTeamManagement;
 use Shopper\Traits\HandlesAuthorizationExceptions;
 use Shopper\Traits\InteractsWithSlideOverForm;
 
@@ -34,6 +36,7 @@
  */
 class CreateTeamMember extends SlideOverComponent implements HasActions, HasSchemas, SlideOverForm
 {
+    use AuthorizesTeamManagement;
     use HandlesAuthorizationExceptions;
     use InteractsWithActions;
     use InteractsWithSchemas;
@@ -50,7 +53,7 @@ class CreateTeamMember extends SlideOverComponent implements HasActions, HasSche
 
     public function mount(): void
     {
-        $this->authorize('access_setting');
+        $this->authorizeTeamManagement();
 
         $this->title = __('shopper::pages/settings/staff.add_admin');
 
@@ -106,6 +109,10 @@ public function form(Schema $schema): Schema
                             ->options(
                                 Role::query()
                                     ->where('name', '<>', config('shopper.admin.roles.user'))
+                                    ->unless(
+                                        $this->actingUserIsAdmin(),
+                                        fn (Builder $query): Builder => $query->where('name', '<>', config('shopper.admin.roles.admin'))
+                                    )
                                     ->pluck('display_name', 'id')
                             )
                             ->required(),
@@ -119,11 +126,16 @@ public function form(Schema $schema): Schema
 
     public function store(): void
     {
-        $this->authorize('access_setting');
+        $this->authorizeTeamManagement();
 
         $data = $this->form->getState();
         $userModel = config('auth.providers.users.model');
 
+        /** @var Role $role */
+        $role = Role::findById((int) $data['role_id']);
+
+        $this->authorizeTeamManagement($role);
+
         /** @var ShopperUser $user */
         $user = $userModel::query()->create([
             'email' => $data['email'],
@@ -137,9 +149,6 @@ public function store(): void
             'email_verified_at' => now()->toDateTimeString(),
         ]);
 
-        /** @var Role $role */
-        $role = Role::findById((int) $data['role_id']);
-
         $user->assignRole([$role->name]);
 
         $this->dispatch('teamUpdate');