bert.hausmans/crewli
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: round 2 — multi-tenancy isolation (OrganisationScope, scoped validation, boundary checks)

Browse Source 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
bert.hausmans
2026-04-14 06:38:19 +02:00
parent 1028498705
commit 090d2b7d89
40 changed files with 603 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
api/app/Http/Requests/Api/V1/AddPersonToCrowdListRequest.php
View File

@@ -5,6 +5,7 @@ declare(strict_types=1);
namespace App\Http\Requests\Api\V1;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rule;
final class AddPersonToCrowdListRequest extends FormRequest
{
@@ -16,8 +17,11 @@ final class AddPersonToCrowdListRequest extends FormRequest
/** @return array<string, mixed> */
public function rules(): array
{
$event = $this->route('event');
$festivalEventId = $event->parent_event_id ?? $event->id;
return [
'person_id' => ['required', 'ulid', 'exists:persons,id'],
'person_id' => ['required', 'ulid', Rule::exists('persons', 'id')->where('event_id', $festivalEventId)],
];
}
}

6
api/app/Http/Requests/Api/V1/AssignShiftRequest.php
View File

@@ -5,6 +5,7 @@ declare(strict_types=1);
namespace App\Http\Requests\Api\V1;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rule;
final class AssignShiftRequest extends FormRequest
{
@@ -16,8 +17,11 @@ final class AssignShiftRequest extends FormRequest
/** @return array<string, mixed> */
public function rules(): array
{
$event = $this->route('event');
$festivalEventId = $event->parent_event_id ?? $event->id;
return [
'person_id' => ['required', 'ulid', 'exists:persons,id'],
'person_id' => ['required', 'ulid', Rule::exists('persons', 'id')->where('event_id', $festivalEventId)],
];
}
}

16
api/app/Http/Requests/Api/V1/BulkApproveShiftAssignmentRequest.php
View File

@@ -5,6 +5,7 @@ declare(strict_types=1);
namespace App\Http\Requests\Api\V1;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rule;
final class BulkApproveShiftAssignmentRequest extends FormRequest
{
@@ -16,9 +17,22 @@ final class BulkApproveShiftAssignmentRequest extends FormRequest
/** @return array<string, mixed> */
public function rules(): array
{
$event = $this->route('event');
return [
'assignment_ids' => ['required', 'array', 'min:1', 'max:100'],
'assignment_ids.*' => ['required', 'ulid', 'exists:shift_assignments,id'],
'assignment_ids.*' => [
'required', 'ulid',
Rule::exists('shift_assignments', 'id')->where(function ($query) use ($event) {
$query->whereIn('shift_id', function ($q) use ($event) {
$q->select('id')->from('shifts')
->whereIn('festival_section_id', function ($q2) use ($event) {
$q2->select('id')->from('festival_sections')
->where('event_id', $event->id);
});
});
}),
],
];
}
}

16
api/app/Http/Requests/Api/V1/BulkConfirmIdentityMatchesRequest.php
View File

@@ -5,6 +5,7 @@ declare(strict_types=1);
namespace App\Http\Requests\Api\V1;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rule;
final class BulkConfirmIdentityMatchesRequest extends FormRequest
{
@@ -16,9 +17,22 @@ final class BulkConfirmIdentityMatchesRequest extends FormRequest
/** @return array<string, mixed> */
public function rules(): array
{
$organisation = $this->route('organisation');
return [
'match_ids' => ['required', 'array', 'min:1', 'max:100'],
'match_ids.*' => ['required', 'string', 'exists:person_identity_matches,id'],
'match_ids.*' => [
'required', 'string',
Rule::exists('person_identity_matches', 'id')->where(function ($query) use ($organisation) {
$query->whereIn('person_id', function ($q) use ($organisation) {
$q->select('id')->from('persons')
->whereIn('event_id', function ($q2) use ($organisation) {
$q2->select('id')->from('events')
->where('organisation_id', $organisation->id);
});
});
}),
],
];
}
}

24
api/app/Http/Requests/Api/V1/ImportFromEventRequest.php
View File

@@ -4,8 +4,8 @@ declare(strict_types=1);
namespace App\Http\Requests\Api\V1;
use App\Models\Event;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rule;
final class ImportFromEventRequest extends FormRequest
{
@@ -18,24 +18,10 @@ final class ImportFromEventRequest extends FormRequest
public function rules(): array
{
return [
'source_event_id' => ['required', 'ulid', 'exists:events,id'],
'source_event_id' => [
'required', 'ulid',
Rule::exists('events', 'id')->where('organisation_id', $this->route('event')->organisation_id),
],
];
}
public function withValidator($validator): void
{
$validator->after(function ($validator) {
$sourceEventId = $this->input('source_event_id');
if (!$sourceEventId) {
return;
}
$sourceEvent = Event::find($sourceEventId);
$targetEvent = $this->route('event');
if ($sourceEvent && $targetEvent && $sourceEvent->organisation_id !== $targetEvent->organisation_id) {
$validator->errors()->add('source_event_id', 'Source event must belong to the same organisation.');
}
});
}
}

5
api/app/Http/Requests/Api/V1/ReorderRegistrationFormFieldsRequest.php
View File

@@ -5,6 +5,7 @@ declare(strict_types=1);
namespace App\Http\Requests\Api\V1;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rule;
final class ReorderRegistrationFormFieldsRequest extends FormRequest
{
@@ -16,9 +17,11 @@ final class ReorderRegistrationFormFieldsRequest extends FormRequest
/** @return array<string, mixed> */
public function rules(): array
{
$event = $this->route('event');
return [
'ids' => ['required', 'array', 'min:1'],
'ids.*' => ['required', 'ulid', 'exists:registration_form_fields,id'],
'ids.*' => ['required', 'ulid', Rule::exists('registration_form_fields', 'id')->where('event_id', $event->id)],
];
}
}

4
api/app/Http/Requests/Api/V1/StoreCrowdListRequest.php
View File

@@ -19,10 +19,10 @@ final class StoreCrowdListRequest extends FormRequest
public function rules(): array
{
return [
'crowd_type_id' => ['required', 'ulid', 'exists:crowd_types,id'],
'crowd_type_id' => ['required', 'ulid', Rule::exists('crowd_types', 'id')->where('organisation_id', $this->route('event')->organisation_id)],
'name' => ['required', 'string', 'max:255'],
'type' => ['required', Rule::enum(CrowdListType::class)],
'recipient_company_id' => ['nullable', 'ulid', 'exists:companies,id'],
'recipient_company_id' => ['nullable', 'ulid', Rule::exists('companies', 'id')->where('organisation_id', $this->route('event')->organisation_id)],
'auto_approve' => ['sometimes', 'boolean'],
'max_persons' => ['nullable', 'integer', 'min:1'],
];

3
api/app/Http/Requests/Api/V1/StoreEventRequest.php
View File

@@ -5,6 +5,7 @@ declare(strict_types=1);
namespace App\Http\Requests\Api\V1;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rule;
final class StoreEventRequest extends FormRequest
{
@@ -23,7 +24,7 @@ final class StoreEventRequest extends FormRequest
'end_date' => ['required', 'date', 'after_or_equal:start_date'],
'timezone' => ['sometimes', 'string', 'max:50'],
'status' => ['sometimes', 'string', 'in:draft,published,registration_open,buildup,showday,teardown,closed'],
'parent_event_id' => ['nullable', 'ulid', 'exists:events,id'],
'parent_event_id' => ['nullable', 'ulid', Rule::exists('events', 'id')->where('organisation_id', $this->route('organisation')->id)],
'event_type' => ['nullable', 'in:event,festival,series'],
'event_type_label' => ['nullable', 'string', 'max:50'],
'sub_event_label' => ['nullable', 'string', 'max:50'],

7
api/app/Http/Requests/Api/V1/StorePersonRequest.php
View File

@@ -5,6 +5,7 @@ declare(strict_types=1);
namespace App\Http\Requests\Api\V1;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rule;
final class StorePersonRequest extends FormRequest
{
@@ -16,14 +17,16 @@ final class StorePersonRequest extends FormRequest
/** @return array<string, mixed> */
public function rules(): array
{
$orgId = $this->route('event')->organisation_id;
return [
'crowd_type_id' => ['required', 'ulid', 'exists:crowd_types,id'],
'crowd_type_id' => ['required', 'ulid', Rule::exists('crowd_types', 'id')->where('organisation_id', $orgId)],
'first_name' => ['required', 'string', 'max:255'],
'last_name' => ['required', 'string', 'max:255'],
'date_of_birth' => ['nullable', 'date', 'before:today'],
'email' => ['required', 'email', 'max:255'],
'phone' => ['nullable', 'string', 'max:30'],
'company_id' => ['nullable', 'ulid', 'exists:companies,id'],
'company_id' => ['nullable', 'ulid', Rule::exists('companies', 'id')->where('organisation_id', $orgId)],
'status' => ['nullable', 'in:invited,applied,pending,approved,rejected,no_show'],
'remarks' => ['nullable', 'string', 'max:5000'],
'custom_fields' => ['nullable', 'array'],

2
api/app/Http/Requests/Api/V1/StoreShiftRequest.php
View File

@@ -28,7 +28,7 @@ final class StoreShiftRequest extends FormRequest
$query->whereIn('event_id', $eventIds);
})],
'location_id' => ['nullable', 'ulid', 'exists:locations,id'],
'location_id' => ['nullable', 'ulid', Rule::exists('locations', 'id')->where('event_id', $this->route('event')->id)],
'title' => ['nullable', 'string', 'max:255'],
'description' => ['nullable', 'string'],
'instructions' => ['nullable', 'string'],

14
api/app/Http/Requests/Api/V1/SyncVolunteerAvailabilityRequest.php
View File

@@ -5,6 +5,7 @@ declare(strict_types=1);
namespace App\Http\Requests\Api\V1;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rule;
final class SyncVolunteerAvailabilityRequest extends FormRequest
{
@@ -16,9 +17,20 @@ final class SyncVolunteerAvailabilityRequest extends FormRequest
/** @return array<string, mixed> */
public function rules(): array
{
$event = $this->route('event');
$eventIds = [$event->id];
if ($event->parent_event_id) {
$eventIds[] = $event->parent_event_id;
} elseif ($event->isFestival()) {
$eventIds = array_merge($eventIds, $event->children()->pluck('id')->all());
}
return [
'availabilities' => ['required', 'array'],
'availabilities.*.time_slot_id' => ['required', 'ulid', 'exists:time_slots,id'],
'availabilities.*.time_slot_id' => [
'required', 'ulid',
Rule::exists('time_slots', 'id')->whereIn('event_id', $eventIds),
],
'availabilities.*.preference_level' => ['sometimes', 'integer', 'min:1', 'max:5'],
];
}

4
api/app/Http/Requests/Api/V1/UpdateCrowdListRequest.php
View File

@@ -19,10 +19,10 @@ final class UpdateCrowdListRequest extends FormRequest
public function rules(): array
{
return [
'crowd_type_id' => ['sometimes', 'ulid', 'exists:crowd_types,id'],
'crowd_type_id' => ['sometimes', 'ulid', Rule::exists('crowd_types', 'id')->where('organisation_id', $this->route('event')->organisation_id)],
'name' => ['sometimes', 'string', 'max:255'],
'type' => ['sometimes', Rule::enum(CrowdListType::class)],
'recipient_company_id' => ['nullable', 'ulid', 'exists:companies,id'],
'recipient_company_id' => ['nullable', 'ulid', Rule::exists('companies', 'id')->where('organisation_id', $this->route('event')->organisation_id)],
'auto_approve' => ['sometimes', 'boolean'],
'max_persons' => ['nullable', 'integer', 'min:1'],
];

3
api/app/Http/Requests/Api/V1/UpdateEventRequest.php
View File

@@ -5,6 +5,7 @@ declare(strict_types=1);
namespace App\Http\Requests\Api\V1;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rule;
final class UpdateEventRequest extends FormRequest
{
@@ -23,7 +24,7 @@ final class UpdateEventRequest extends FormRequest
'start_date' => ['sometimes', 'date'],
'end_date' => ['sometimes', 'date', 'after_or_equal:start_date'],
'timezone' => ['sometimes', 'string', 'max:50'],
'parent_event_id' => ['nullable', 'ulid', 'exists:events,id'],
'parent_event_id' => ['nullable', 'ulid', Rule::exists('events', 'id')->where('organisation_id', $this->route('organisation')->id)],
'event_type' => ['sometimes', 'in:event,festival,series'],
'event_type_label' => ['nullable', 'string', 'max:50'],
'sub_event_label' => ['nullable', 'string', 'max:50'],

7
api/app/Http/Requests/Api/V1/UpdatePersonRequest.php
View File

@@ -5,6 +5,7 @@ declare(strict_types=1);
namespace App\Http\Requests\Api\V1;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rule;
final class UpdatePersonRequest extends FormRequest
{
@@ -16,14 +17,16 @@ final class UpdatePersonRequest extends FormRequest
/** @return array<string, mixed> */
public function rules(): array
{
$orgId = $this->route('event')->organisation_id;
return [
'crowd_type_id' => ['sometimes', 'ulid', 'exists:crowd_types,id'],
'crowd_type_id' => ['sometimes', 'ulid', Rule::exists('crowd_types', 'id')->where('organisation_id', $orgId)],
'first_name' => ['sometimes', 'string', 'max:255'],
'last_name' => ['sometimes', 'string', 'max:255'],
'date_of_birth' => ['nullable', 'date', 'before:today'],
'email' => ['sometimes', 'email', 'max:255'],
'phone' => ['nullable', 'string', 'max:30'],
'company_id' => ['nullable', 'ulid', 'exists:companies,id'],
'company_id' => ['nullable', 'ulid', Rule::exists('companies', 'id')->where('organisation_id', $orgId)],
'status' => ['sometimes', 'in:invited,applied,pending,approved,rejected,no_show'],
'is_blacklisted' => ['sometimes', 'boolean'],
'admin_notes' => ['nullable', 'string'],

2
api/app/Http/Requests/Api/V1/UpdateShiftRequest.php
View File

@@ -28,7 +28,7 @@ final class UpdateShiftRequest extends FormRequest
$query->whereIn('event_id', $eventIds);
})],
'location_id' => ['nullable', 'ulid', 'exists:locations,id'],
'location_id' => ['nullable', 'ulid', Rule::exists('locations', 'id')->where('event_id', $this->route('event')->id)],
'title' => ['nullable', 'string', 'max:255'],
'description' => ['nullable', 'string'],
'instructions' => ['nullable', 'string'],