feat: User Direct Permission Assignment API (Issue #138) #158
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR adds CHANGELOG documentation for the User Direct Permission Assignment API feature (Issue #138), which is part of RBAC Phase 4 Epic. The PR documents 4 new API endpoints for managing direct user permissions, along with supporting infrastructure (controller, policy, form request, and model method).
Key Issue: The CHANGELOG contains several inconsistencies with the PR description regarding implementation details, particularly around column names and migration requirements.
Implements Issue #138 - User Direct Permission Assignment API as part of RBAC Phase 4 Epic (#108). Added: - UserPermissionController: 4 endpoints (index, store, destroy, direct) - AssignUserPermissionRequest: Validation with temporal constraints - UserPermissionPolicy: Authorization (Admin assign/revoke, User view own) - Migration: Add temporal columns to model_has_permissions table - Tests: 13 comprehensive feature tests (52 assertions) Technical Implementation: - Direct DB manipulation for pivot attributes (Spatie limitation workaround) - hasDirectPermission() rewritten with direct DB queries (multi-tenant fix) - Temporal tracking: granted_at, granted_by, revoked_at, revoked_by Quality Assurance: - Tests: 270 passed (866 assertions) - PHPStan: Level Max, 0 errors - Laravel Pint: All files formatted - REUSE: 100% compliant
- Clarify 'List all user permissions (direct + inherited from roles)' - Change 'temporal constraints' to 'temporal tracking (audit trail)' - Fix migration description: no new migration, uses existing columns - Update column names: granted_at/granted_by/revoked_at/revoked_by (not valid_from/until) - Clarify validation description: permission existence, not already assigned Addresses 5 Copilot review comments on PR #158
kevalyq
added
the
large-pr-approved
💡 Tip: Consider Using Draft PRsBenefits of opening PRs as drafts initially:
How to convert:
This is just a friendly reminder - feel free to continue as is! 😊 |
💡 Tip: Consider Using Draft PRsBenefits of opening PRs as drafts initially:
How to convert:
This is just a friendly reminder - feel free to continue as is! 😊 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Overview
Implements User Direct Permission Assignment API as part of RBAC Phase 4 Epic (#108).
Closes #138
Implementation Summary
API Endpoints
GET /api/v1/users/{user}/permissions- List all user permissions (direct + inherited)POST /api/v1/users/{user}/permissions- Assign direct permissionDELETE /api/v1/users/{user}/permissions/{permission}- Revoke direct permissionGET /api/v1/users/{user}/permissions/direct- List only direct permissionsKey Features
Technical Details
Critical Implementation: Direct DB manipulation required for pivot attributes
givePermissionTo()doesn't support custom pivot dataupdateOrInsert()onmodel_has_permissionstableMulti-Tenant Fix:
hasDirectPermission()rewrittenFiles Changed
app/Http/Controllers/Api/V1/UserPermissionController.php(new)app/Http/Requests/AssignUserPermissionRequest.php(new)app/Policies/UserPermissionPolicy.php(new)app/Models/User.php(updated hasDirectPermission())app/Providers/AppServiceProvider.php(Gate registration)tests/Feature/UserPermissionAssignmentApiTest.php(new, 13 tests)CHANGELOG.md(updated)Quality Assurance
Testing
Migration
No new migration required. Uses existing
model_has_permissionstable with pivot columns:granted_at,granted_by,revoked_at,revoked_byNext Steps
Epic: #108 (RBAC Phase 4)
Type: Feature
Scope: Backend API