feat(admin): add protected admin area shell and dashboard entry#36
Conversation
There was a problem hiding this comment.
Pull request overview
Adds an initial admin-only area by introducing a protected admin dashboard route, wiring an “Admin” entry into the shared application toolbar for admins, and expanding RBAC feature coverage to assert both route protection and UI visibility.
Changes:
- Added
/adminas a protected route (auth+can:access-admin) rendering a newadmin.dashboardview. - Updated the shared
app-shellto optionally render an Admin toolbar entry for admin users. - Extended Pest feature tests to cover Admin toolbar visibility for admins vs non-admins.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| tests/Feature/Auth/RbacTest.php | Adds feature test asserting the Admin toolbar entry is only visible to admins. |
| routes/web.php | Switches /admin to render the new admin dashboard view behind authorization middleware. |
| resources/views/home.blade.php | Removes the placeholder Admin item and enables the shell’s admin entry rendering. |
| resources/views/components/layouts/app-shell.blade.php | Adds an optional Admin toolbar entry rendering block in the shared shell. |
| resources/views/admin/dashboard.blade.php | Introduces the new admin dashboard page using the shared shell and components. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| @if ($showAdminEntry && auth()->user()?->isAn('admin')) | ||
| <x-app.toolbar-item | ||
| href="{{ route('admin.dashboard') }}" | ||
| label="Admin" | ||
| icon="heroicon-o-shield-check" | ||
| :current="request()->routeIs('admin.*')" | ||
| /> |
There was a problem hiding this comment.
The admin toolbar entry visibility duplicates the authorization logic by checking auth()->user()?->isAn('admin') directly. Since the route is protected with can:access-admin (and the Gate is defined), consider switching this to @can('access-admin') / auth()->user()?->can('access-admin') so UI visibility stays consistent with the actual authorization rules if they change later.
Closes #11\n\nSummary:\n- Adds a protected admin dashboard route and dedicated admin landing page\n- Shows an admin toolbar entry only to admins\n- Reuses the shared shell and component set for the admin area\n- Extends Pest coverage for toolbar visibility and route protection\n\nValidation:\n- vendor/bin/pint --dirty --format agent\n- php artisan test --compact\n- npm run build