Ensembia/QRForge-selfhosted
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fase 2: read-only user role with per-category view toggles

Browse Source 
Adds a third account type 'user' alongside super/admin: no create/edit/delete
rights on qr codes, view access to dynamic/static lists gated per-account by
two admin-controlled toggles (can_view_static, can_view_dynamic), and always
full visibility into the dashboard/reports regardless of those toggles.

- New columns can_view_static/can_view_dynamic on users (migrations/003)
- Users class + form_users.php: 'user' type option with the two toggles
- Access control: dynamic_qrcode.php/static_qrcode.php/bulk_action.php reject
  all mutations for type=user; dynamic_qrcodes.php/static_qrcodes.php enforce
  the view toggle and show all codes (no owner scoping, since 'user' owns none)
- Sidebar and list tables hide add/edit/delete/bulk UI for the read-only role
- index.php dashboard stats are unscoped for both 'super' and 'user'

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Dillard Blom
2026-07-08 16:37:25 +02:00
parent feb5380b28
commit a1ab16d54c
15 changed files with 163 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/includes/sidebar.php
+10
View File
@@ -33,6 +33,7 @@
</p>
</a>
</li>
<?php if ($_SESSION['type'] !== 'user' || !empty($_SESSION['can_view_dynamic'])): ?>
<li <?php echo ((substr(CURRENT_PAGE, 0, 19) == 'dynamic_qrcodes.php') || (substr(CURRENT_PAGE, 0, 18) == 'dynamic_qrcode.php')) ? ' class="nav-item has-treeview menu-open"' : ' class="nav-item has-treeview"'; ?>>
<a href="#" <?php echo ((substr(CURRENT_PAGE, 0, 19) == 'dynamic_qrcodes.php') || (substr(CURRENT_PAGE, 0, 18) == 'dynamic_qrcode.php')) ? ' class="nav-link active"' : ' class="nav-link"'; ?>>
<i class="nav-icon fa fa-qrcode"></i>
@@ -48,14 +49,18 @@
<p>List all</p>
</a>
</li>
<?php if ($_SESSION['type'] !== 'user'): ?>
<li class="nav-item">
<a href="./dynamic_qrcode.php" <?php echo (CURRENT_PAGE == 'dynamic_qrcode.php') ? ' class="nav-link active"' : ' class="nav-link"'; ?>>
<i class="far fa-circle nav-icon"></i>
<p>Add new</p>
</a>
</li>
<?php endif; ?>
</ul>
</li>
<?php endif; ?>
<?php if ($_SESSION['type'] !== 'user' || !empty($_SESSION['can_view_static'])): ?>
<li <?php echo ((substr(CURRENT_PAGE, 0, 18) == 'static_qrcodes.php') || (substr(CURRENT_PAGE, 0, 17) == 'static_qrcode.php')) ? ' class="nav-item has-treeview menu-open"' : ' class="nav-item has-treeview"'; ?>>
<a href="#" <?php echo ((substr(CURRENT_PAGE, 0, 18) == 'static_qrcodes.php') || (substr(CURRENT_PAGE, 0, 17) == 'static_qrcode.php')) ? ' class="nav-link active"' : ' class="nav-link"'; ?>>
<i class="nav-icon fa fa-qrcode"></i>
@@ -71,20 +76,25 @@
<p>List all</p>
</a>
</li>
<?php if ($_SESSION['type'] !== 'user'): ?>
<li class="nav-item">
<a href="./static_qrcode.php" <?php echo (CURRENT_PAGE == 'static_qrcode.php') ? ' class="nav-link active"' : ' class="nav-link"'; ?>>
<i class="far fa-circle nav-icon"></i>
<p>Add new</p>
</a>
</li>
<?php endif; ?>
</ul>
</li>
<?php endif; ?>
<?php if ($_SESSION['type'] === 'super'): ?>
<li class="nav-item">
<a href="./users.php" <?php echo ((substr(CURRENT_PAGE, 0, 15) == 'users.php') || (substr(CURRENT_PAGE, 0, 14) == 'user.php')) ? ' class="nav-link active"' : ' class="nav-link"'; ?>>
<i class="fas fa-users nav-icon"></i>
<p>Users</p>
</a>
</li>
<?php endif; ?>
</ul>
</nav>
<!-- /.sidebar-menu -->