security: A01-13 — nest all event routes under organisation prefix
Move all authenticated organiser-facing event sub-resource routes from
/events/{event}/... to /organisations/{organisation}/events/{event}/...
to enforce multi-tenancy at the routing layer.
Changes:
- Routes: restructured api.php to nest all event sub-resources under
the existing organisation prefix group
- Controllers: added Organisation parameter and VerifiesOrganisationEvent
trait to all 12 affected controllers (sections, time-slots, shifts,
persons, crowd-lists, locations, shift-assignments, registration-fields,
availabilities, field-values, section-preferences, stats)
- Tests: updated all 20 feature test files with new route paths
- Frontend: updated 8 API composables and 20 Vue components/pages
- API.md: updated documentation to reflect new route structure
Portal routes, public routes (volunteer-register), and invitation routes
remain unchanged as they operate without organisation context.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -146,63 +146,73 @@ Route::middleware('auth:sanctum')->group(function () {
|
||||
Route::get('members', [MemberController::class, 'index']);
|
||||
Route::put('members/{user}', [MemberController::class, 'update']);
|
||||
Route::delete('members/{user}', [MemberController::class, 'destroy']);
|
||||
});
|
||||
|
||||
// Event-scoped resources
|
||||
Route::get('events/{event}/stats', [EventController::class, 'stats']);
|
||||
Route::prefix('events/{event}')->group(function () {
|
||||
Route::apiResource('locations', LocationController::class)
|
||||
->except(['show']);
|
||||
Route::get('sections/registration-settings', [FestivalSectionController::class, 'registrationSettings']);
|
||||
Route::put('sections/registration-settings', [FestivalSectionController::class, 'updateRegistrationSettings']);
|
||||
Route::apiResource('sections', FestivalSectionController::class)
|
||||
->except(['show']);
|
||||
Route::post('sections/reorder', [FestivalSectionController::class, 'reorder']);
|
||||
Route::apiResource('time-slots', TimeSlotController::class)
|
||||
->except(['show']);
|
||||
// Event sub-resources (all nested under organisation prefix — A01-13)
|
||||
Route::prefix('events/{event}')->group(function () {
|
||||
// Stats
|
||||
Route::get('stats', [EventController::class, 'stats']);
|
||||
|
||||
// Shifts nested under sections
|
||||
Route::prefix('sections/{section}')->group(function () {
|
||||
Route::apiResource('shifts', ShiftController::class)
|
||||
// Locations
|
||||
Route::apiResource('locations', LocationController::class)
|
||||
->except(['show']);
|
||||
Route::post('shifts/{shift}/assign', [ShiftController::class, 'assign']);
|
||||
Route::post('shifts/{shift}/claim', [ShiftController::class, 'claim']);
|
||||
|
||||
// Festival sections
|
||||
Route::get('sections/registration-settings', [FestivalSectionController::class, 'registrationSettings']);
|
||||
Route::put('sections/registration-settings', [FestivalSectionController::class, 'updateRegistrationSettings']);
|
||||
Route::apiResource('sections', FestivalSectionController::class)
|
||||
->except(['show']);
|
||||
Route::post('sections/reorder', [FestivalSectionController::class, 'reorder']);
|
||||
|
||||
// Time slots
|
||||
Route::apiResource('time-slots', TimeSlotController::class)
|
||||
->except(['show']);
|
||||
|
||||
// Shifts nested under sections
|
||||
Route::prefix('sections/{section}')->group(function () {
|
||||
Route::apiResource('shifts', ShiftController::class)
|
||||
->except(['show']);
|
||||
Route::post('shifts/{shift}/assign', [ShiftController::class, 'assign']);
|
||||
Route::post('shifts/{shift}/claim', [ShiftController::class, 'claim']);
|
||||
});
|
||||
|
||||
// Shift assignments (event-level)
|
||||
Route::get('shift-assignments', [ShiftAssignmentController::class, 'index']);
|
||||
Route::get('shifts/{shift}/assignable-persons', [ShiftAssignmentController::class, 'assignablePersons']);
|
||||
Route::post('shift-assignments/{shiftAssignment}/approve', [ShiftAssignmentController::class, 'approve']);
|
||||
Route::post('shift-assignments/{shiftAssignment}/reject', [ShiftAssignmentController::class, 'reject']);
|
||||
Route::post('shift-assignments/{shiftAssignment}/cancel', [ShiftAssignmentController::class, 'cancel']);
|
||||
Route::post('shift-assignments/bulk-approve', [ShiftAssignmentController::class, 'bulkApprove']);
|
||||
|
||||
// Persons
|
||||
Route::apiResource('persons', PersonController::class);
|
||||
Route::post('persons/{person}/approve', [PersonController::class, 'approve']);
|
||||
Route::post('persons/{person}/reject', [PersonController::class, 'reject']);
|
||||
|
||||
// Volunteer availabilities
|
||||
Route::get('persons/{person}/availabilities', [VolunteerAvailabilityController::class, 'index']);
|
||||
Route::post('persons/{person}/availabilities/sync', [VolunteerAvailabilityController::class, 'sync']);
|
||||
|
||||
// Person field values
|
||||
Route::get('persons/{person}/field-values', [PersonFieldValueController::class, 'index']);
|
||||
Route::put('persons/{person}/field-values', [PersonFieldValueController::class, 'upsert']);
|
||||
|
||||
// Person section preferences
|
||||
Route::get('persons/{person}/section-preferences', [PersonSectionPreferenceController::class, 'index']);
|
||||
Route::put('persons/{person}/section-preferences', [PersonSectionPreferenceController::class, 'replace']);
|
||||
|
||||
// Registration form fields (event settings)
|
||||
Route::apiResource('registration-fields', RegistrationFormFieldController::class)
|
||||
->except(['show']);
|
||||
Route::post('registration-fields/reorder', [RegistrationFormFieldController::class, 'reorder']);
|
||||
Route::post('registration-fields/from-template', [RegistrationFormFieldController::class, 'fromTemplate']);
|
||||
Route::post('registration-fields/import-from-event', [RegistrationFormFieldController::class, 'importFromEvent']);
|
||||
|
||||
// Crowd lists
|
||||
Route::apiResource('crowd-lists', CrowdListController::class)
|
||||
->except(['show']);
|
||||
Route::get('crowd-lists/{crowdList}/persons', [CrowdListController::class, 'persons']);
|
||||
Route::post('crowd-lists/{crowdList}/persons', [CrowdListController::class, 'addPerson']);
|
||||
Route::delete('crowd-lists/{crowdList}/persons/{person}', [CrowdListController::class, 'removePerson']);
|
||||
});
|
||||
|
||||
// Shift assignments (event-level)
|
||||
Route::get('shift-assignments', [ShiftAssignmentController::class, 'index']);
|
||||
Route::get('shifts/{shift}/assignable-persons', [ShiftAssignmentController::class, 'assignablePersons']);
|
||||
Route::post('shift-assignments/{shiftAssignment}/approve', [ShiftAssignmentController::class, 'approve']);
|
||||
Route::post('shift-assignments/{shiftAssignment}/reject', [ShiftAssignmentController::class, 'reject']);
|
||||
Route::post('shift-assignments/{shiftAssignment}/cancel', [ShiftAssignmentController::class, 'cancel']);
|
||||
Route::post('shift-assignments/bulk-approve', [ShiftAssignmentController::class, 'bulkApprove']);
|
||||
|
||||
Route::apiResource('persons', PersonController::class);
|
||||
Route::post('persons/{person}/approve', [PersonController::class, 'approve']);
|
||||
Route::post('persons/{person}/reject', [PersonController::class, 'reject']);
|
||||
|
||||
// Volunteer availabilities
|
||||
Route::get('persons/{person}/availabilities', [VolunteerAvailabilityController::class, 'index']);
|
||||
Route::post('persons/{person}/availabilities/sync', [VolunteerAvailabilityController::class, 'sync']);
|
||||
|
||||
// Person field values
|
||||
Route::get('persons/{person}/field-values', [PersonFieldValueController::class, 'index']);
|
||||
Route::put('persons/{person}/field-values', [PersonFieldValueController::class, 'upsert']);
|
||||
|
||||
// Person section preferences
|
||||
Route::get('persons/{person}/section-preferences', [PersonSectionPreferenceController::class, 'index']);
|
||||
Route::put('persons/{person}/section-preferences', [PersonSectionPreferenceController::class, 'replace']);
|
||||
|
||||
// Registration form fields (event settings)
|
||||
Route::apiResource('registration-fields', RegistrationFormFieldController::class)
|
||||
->except(['show']);
|
||||
Route::post('registration-fields/reorder', [RegistrationFormFieldController::class, 'reorder']);
|
||||
Route::post('registration-fields/from-template', [RegistrationFormFieldController::class, 'fromTemplate']);
|
||||
Route::post('registration-fields/import-from-event', [RegistrationFormFieldController::class, 'importFromEvent']);
|
||||
Route::apiResource('crowd-lists', CrowdListController::class)
|
||||
->except(['show']);
|
||||
Route::get('crowd-lists/{crowdList}/persons', [CrowdListController::class, 'persons']);
|
||||
Route::post('crowd-lists/{crowdList}/persons', [CrowdListController::class, 'addPerson']);
|
||||
Route::delete('crowd-lists/{crowdList}/persons/{person}', [CrowdListController::class, 'removePerson']);
|
||||
});
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user