security: secure role, notification, system setting, and documentation pages with spatie permissions

This commit is contained in:
2026-05-21 22:10:36 +07:00
parent bf42ca956d
commit 65804be1cb
4 changed files with 24 additions and 8 deletions
+9 -5
View File
@@ -38,10 +38,12 @@ Route::middleware(['auth', 'verified'])->group(function () {
// Settings page
Route::get('/settings', [SettingsController::class, 'index'])->name('settings.index');
// System Settings (Super-Admin only)
Route::get('/system-settings', [\App\Http\Controllers\SystemSettingController::class, 'index'])->name('system.settings.index');
Route::patch('/system-settings', [\App\Http\Controllers\SystemSettingController::class, 'update'])->name('system.settings.update');
Route::post('/system-settings/test-email', [\App\Http\Controllers\SystemSettingController::class, 'testEmail'])->name('system.settings.test-email');
// System Settings (Super-Admin / settings.manage)
Route::middleware('can:settings.manage')->group(function () {
Route::get('/system-settings', [\App\Http\Controllers\SystemSettingController::class, 'index'])->name('system.settings.index');
Route::patch('/system-settings', [\App\Http\Controllers\SystemSettingController::class, 'update'])->name('system.settings.update');
Route::post('/system-settings/test-email', [\App\Http\Controllers\SystemSettingController::class, 'testEmail'])->name('system.settings.test-email');
});
// Users CRUD
Route::get('/users', [UserController::class, 'index'])->name('users.index');
@@ -68,7 +70,9 @@ Route::middleware(['auth', 'verified'])->group(function () {
Route::post('/notifications', [\App\Http\Controllers\NotificationController::class, 'store'])->name('notifications.store');
// Internal Docs
Route::get('/documentation', fn() => Inertia::render('Docs/Index'))->name('docs.index');
Route::get('/documentation', fn() => Inertia::render('Docs/Index'))
->middleware('can:settings.manage')
->name('docs.index');
// Two-Factor Authentication
Route::get('/two-factor', [\App\Http\Controllers\TwoFactorController::class, 'show'])->name('two-factor.show');