Reject form submissions if authorization not met (#50)

Denhac · Jan 16, 2024 · 69cd43d · 69cd43d
1 parent 958b543
commit 69cd43d
Show file tree

Hide file tree

Showing 6 changed files with 37 additions and 0 deletions.
diff --git a/app/External/Slack/Modals/CreateTrainableEquipment.php b/app/External/Slack/Modals/CreateTrainableEquipment.php
@@ -9,6 +9,7 @@
 use Illuminate\Support\Facades\Log;
 use SlackPhp\BlockKit\Kit;
 use SlackPhp\BlockKit\Surfaces\Modal;
+use App\Models\UserMembership;
 
 class CreateTrainableEquipment implements ModalInterface
 {
@@ -109,6 +110,11 @@ public static function callbackId(): string
 
     public static function handle(SlackRequest $request)
     {
+        if (!$request->customer()->hasMembership(UserMembership::MEMBERSHIP_META_TRAINER)) {
+            Log::warning('CreateTrainableEquipment: Rejecting unauthorized submission from user '.$request->customer()->id);
+            throw new \Exception('Unauthorized');
+        }
+
         $values = $request->payload()['view']['state']['values'];
 
         $equipmentName = $values[self::EQUIPMENT_NAME][self::EQUIPMENT_NAME]['value'];

diff --git a/app/External/Slack/Modals/EquipmentAuthorization.php b/app/External/Slack/Modals/EquipmentAuthorization.php
@@ -86,6 +86,11 @@ public static function callbackId(): string
 
     public static function handle(SlackRequest $request)
     {
+        if (!$request->customer()->isATrainer()) {
+            Log::warning('EquipmentAuthorization: Rejecting unauthorized submission from user '.$request->customer()->id);
+            throw new \Exception('Unauthorized');
+        }
+
         $state = self::getStateValues($request);
         $makeUsers = true;
         $makeTrainers = ! is_null($state[self::TRAINER_CHECK][self::TRAINER_CHECK] ?? null);

diff --git a/app/External/Slack/Modals/ManageMembersCardsModal.php b/app/External/Slack/Modals/ManageMembersCardsModal.php
@@ -7,6 +7,7 @@
 use App\Models\Customer;
 use SlackPhp\BlockKit\Kit;
 use SlackPhp\BlockKit\Surfaces\Modal;
+use Illuminate\Support\Facades\Log;
 
 class ManageMembersCardsModal implements ModalInterface
 {
@@ -53,6 +54,11 @@ public static function callbackId()
 
     public static function handle(SlackRequest $request)
     {
+        if (!$request->customer()->canIDcheck()) {
+            Log::warning('ManageMembersCardsModal: Rejecting unauthorized submission from user '.$request->customer()->id);
+            throw new \Exception('Unauthorized');
+        }
+
         $cards = $request->payload()['view']['state']['values'][self::CARD_NUM][self::CARD_NUM]['value'];
 
         $errors = [];

diff --git a/app/External/Slack/Modals/ManageOpenHouseModal.php b/app/External/Slack/Modals/ManageOpenHouseModal.php
@@ -65,6 +65,11 @@ public static function callbackId(): string
 
     public static function handle(SlackRequest $request)
     {
+        if (!$request->customer()->canIDcheck()) {
+            Log::warning('ManageOpenHouseModal: Rejecting unauthorized submission from user '.$request->customer()->id);
+            throw new \Exception('Unauthorized');
+        }
+
         $values = $request->payload()['view']['state']['values'];
         Log::info('Manage open house modal: '.print_r($values, true));
 

diff --git a/app/External/Slack/Modals/MembershipOptionsModal.php b/app/External/Slack/Modals/MembershipOptionsModal.php
@@ -8,6 +8,7 @@
 use App\Models\UserMembership;
 use SlackPhp\BlockKit\Kit;
 use SlackPhp\BlockKit\Surfaces\Modal;
+use Illuminate\Support\Facades\Log;
 
 class MembershipOptionsModal implements ModalInterface
 {
@@ -76,10 +77,18 @@ public static function handle(SlackRequest $request)
                 $modal = new ManageOpenHouseModal();
                 break;
             case self::QUICK_OPEN_HOUSE_VALUE:
+                if (!$request->customer()->canIDcheck()) {
+                    Log::warning('QuickOpenHouse: Rejecting unauthorized submission from user '.$request->customer()->id);
+                    throw new \Exception('Unauthorized');
+                }
                 Door::quickOpenHouse();
 
                 return self::clearViewStack();
             case self::ALL_DOORS_DEFAULT_VALUE:
+                if (!$request->customer()->canIDcheck()) {
+                    Log::warning('QuickOpenHouse: Rejecting unauthorized submission from user '.$request->customer()->id);
+                    throw new \Exception('Unauthorized');
+                }
                 Door::quickDefaultDoors();
 
                 return self::clearViewStack();

diff --git a/app/External/Slack/Modals/NeedIdCheckModal.php b/app/External/Slack/Modals/NeedIdCheckModal.php
@@ -7,6 +7,7 @@
 use App\Models\Customer;
 use SlackPhp\BlockKit\Kit;
 use SlackPhp\BlockKit\Surfaces\Modal;
+use Illuminate\Support\Facades\Log;
 
 class NeedIdCheckModal implements ModalInterface
 {
@@ -42,6 +43,11 @@ public static function callbackId(): string
 
     public static function handle(SlackRequest $request)
     {
+        if (!$request->customer()->canIDcheck()) {
+            Log::warning('NeedIdCheckModal: Rejecting unauthorized submission from user '.$request->customer()->id);
+            throw new \Exception('Unauthorized');
+        }
+
         $selectedOption = $request->payload()['view']['state']['values'][self::NEW_MEMBER][self::NEW_MEMBER]['selected_option']['value'];
 
         $matches = [];