Merge pull request #4801 from RoboJackets/kristaps/shared-device-role

Add shared-device role to allow accounts to bypass authentication checks

app/Nova/User.php

@@ -114,7 +114,7 @@ public function fields(NovaRequest $request): array
         return [
             Hidden::make('Has Ever Logged In')
                 ->showOnCreating()
-                ->default(static fn (Request $r): bool => false),
+                ->default(static fn (Request $r): int => 0),
 
             Text::make('Username', 'uid')
                 ->sortable()
@@ -413,7 +413,8 @@ public function fields(NovaRequest $request): array
                 ->hideFromDetail(static fn (NovaRequest $r, AppModelsUser $u): bool => $u->is_service_account),
 
             HasMany::make('Access Cards')
-                ->canSee(static fn (Request $request): bool => $request->user()->hasRole('admin')),
+                ->canSee(static fn (Request $request): bool => $request->user()->hasRole('admin'))
+                ->hideFromDetail(static fn (NovaRequest $r, AppModelsUser $u): bool => $u->is_service_account),
 
             HasMany::make('Attendance')
                 ->canSee(static function (Request $request): bool {

app/Util/CasUser.php

@@ -39,6 +39,12 @@ public static function createOrUpdate(): User
             Cas::setAttributes($masq_attrs);
         }
 
+        $existing_user = User::where('uid', Cas::user())->first();
+
+        if ($existing_user !== null && $existing_user->hasRole('shared-device')) {
+            return $existing_user;
+        }
+
         if (config('features.sandbox-mode') !== true) {
             foreach ($attrs as $attr) {
                 if (

database/migrations/2024_09_08_203808_add_shared_device_role.php

@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Spatie\Permission\Models\Permission;
+use Spatie\Permission\Models\Role;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        app()['cache']->forget('spatie.permission.cache');
+
+        $create_attendance = Permission::firstOrCreate(['name' => 'create-attendance']);
+        $read_events = Permission::firstOrCreate(['name' => 'read-events']);
+        $read_teams = Permission::firstOrCreate(['name' => 'read-teams']);
+        $read_teams_hidden = Permission::firstOrCreate(['name' => 'read-teams-hidden']);
+        $read_users = Permission::firstOrCreate(['name' => 'read-users']);
+
+        $shared_device = Role::firstOrCreate(['name' => 'shared-device']);
+
+        $shared_device->givePermissionTo($create_attendance);
+        $shared_device->givePermissionTo($read_events);
+        $shared_device->givePermissionTo($read_teams);
+        $shared_device->givePermissionTo($read_teams_hidden);
+        $shared_device->givePermissionTo($read_users);
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        app()['cache']->forget('spatie.permission.cache');
+
+        Role::where('name', 'shared-device')->delete();
+    }
+};