Merge pull request #686 from code16/fix-wizard-command-authorization

aguingand · web-flow · commit d0b01b1ab844 · 2026-01-22T17:19:35.000+01:00
Add authorizeForStep() method for wizard commands
diff --git a/src/EntityList/Commands/Wizards/InstanceWizardCommand.php b/src/EntityList/Commands/Wizards/InstanceWizardCommand.php
@@ -57,6 +57,11 @@ protected function initialDataForStep(string $step, mixed $instanceId): array
         return [];
     }
 
+    public function authorizeForStep(string $step, mixed $instanceId): bool
+    {
+        return true;
+    }
+
     abstract protected function executeFirstStep(mixed $instanceId, array $data): array;
 
     abstract protected function buildFormFieldsForFirstStep(FieldsContainer $formFields): void;
diff --git a/src/EntityList/Commands/Wizards/IsEntityWizardCommand.php b/src/EntityList/Commands/Wizards/IsEntityWizardCommand.php
@@ -54,4 +54,9 @@ protected function initialDataForStep(string $step): array
     {
         return [];
     }
+
+    public function authorizeForStep(string $step): bool
+    {
+        return true;
+    }
 }
diff --git a/src/EntityList/Commands/Wizards/IsWizardCommand.php b/src/EntityList/Commands/Wizards/IsWizardCommand.php
@@ -38,9 +38,9 @@ protected function toStep(string $step): array
         ];
     }
 
-    protected function extractStepFromRequest(): ?string
+    public function extractStepFromRequest(): ?string
     {
-        if ($step = request()->get('command_step')) {
+        if ($step = request()->input('command_step')) {
             [$step, $this->key] = explode(':', $step);
 
             return $step;
diff --git a/src/Http/Controllers/Api/Commands/ApiDashboardCommandController.php b/src/Http/Controllers/Api/Commands/ApiDashboardCommandController.php
@@ -2,6 +2,7 @@
 
 namespace Code16\Sharp\Http\Controllers\Api\Commands;
 
+use Code16\Sharp\Dashboard\Commands\DashboardWizardCommand;
 use Code16\Sharp\Dashboard\SharpDashboard;
 use Code16\Sharp\Data\Commands\CommandFormData;
 use Code16\Sharp\Exceptions\Auth\SharpAuthorizationException;
@@ -51,14 +52,17 @@ public function update(string $globalFilter, string $entityKey, string $commandK
 
     protected function getDashboardCommandHandler(SharpDashboard $dashboard, string $commandKey)
     {
-        if ($handler = $dashboard->findDashboardCommandHandler($commandKey)) {
-            $handler->buildCommandConfig();
+        $commandHandler = $dashboard->findDashboardCommandHandler($commandKey);
+        $commandHandler->buildCommandConfig();
 
-            if (! $handler->authorize()) {
-                throw new SharpAuthorizationException();
-            }
+        $authorized = $commandHandler instanceof DashboardWizardCommand && ($step = $commandHandler->extractStepFromRequest())
+            ? $commandHandler->authorizeForStep($step)
+            : $commandHandler->authorize();
+
+        if (! $authorized) {
+            throw new SharpAuthorizationException();
         }
 
-        return $handler;
+        return $commandHandler;
     }
 }
diff --git a/src/Http/Controllers/Api/Commands/HandlesEntityCommand.php b/src/Http/Controllers/Api/Commands/HandlesEntityCommand.php
@@ -3,6 +3,7 @@
 namespace Code16\Sharp\Http\Controllers\Api\Commands;
 
 use Code16\Sharp\EntityList\Commands\EntityCommand;
+use Code16\Sharp\EntityList\Commands\Wizards\EntityWizardCommand;
 use Code16\Sharp\EntityList\SharpEntityList;
 use Code16\Sharp\Exceptions\Auth\SharpAuthorizationException;
 
@@ -13,7 +14,11 @@ protected function getEntityCommandHandler(SharpEntityList $list, string $comman
         $commandHandler = $list->findEntityCommandHandler($commandKey);
         $commandHandler->buildCommandConfig();
 
-        if (! $commandHandler->authorize()) {
+        $authorized = $commandHandler instanceof EntityWizardCommand && ($step = $commandHandler->extractStepFromRequest())
+            ? $commandHandler->authorizeForStep($step)
+            : $commandHandler->authorize();
+
+        if (! $authorized) {
             throw new SharpAuthorizationException();
         }
 
diff --git a/src/Http/Controllers/Api/Commands/HandlesInstanceCommand.php b/src/Http/Controllers/Api/Commands/HandlesInstanceCommand.php
@@ -3,6 +3,7 @@
 namespace Code16\Sharp\Http\Controllers\Api\Commands;
 
 use Code16\Sharp\EntityList\Commands\InstanceCommand;
+use Code16\Sharp\EntityList\Commands\Wizards\InstanceWizardCommand;
 use Code16\Sharp\EntityList\SharpEntityList;
 use Code16\Sharp\Exceptions\Auth\SharpAuthorizationException;
 use Code16\Sharp\Show\SharpShow;
@@ -17,7 +18,11 @@ protected function getInstanceCommandHandler(
         $commandHandler = $commandContainer->findInstanceCommandHandler($commandKey);
         $commandHandler->buildCommandConfig();
 
-        if (! $commandHandler->authorize() || ! $commandHandler->authorizeFor($instanceId)) {
+        $authorized = $commandHandler instanceof InstanceWizardCommand && ($step = $commandHandler->extractStepFromRequest())
+            ? $commandHandler->authorizeForStep($step, $instanceId)
+            : $commandHandler->authorize() && $commandHandler->authorizeFor($instanceId);
+
+        if (! $authorized) {
             throw new SharpAuthorizationException();
         }
 
diff --git a/tests/Http/Api/Commands/ApiEntityListEntityWizardCommandControllerTest.php b/tests/Http/Api/Commands/ApiEntityListEntityWizardCommandControllerTest.php
@@ -297,6 +297,104 @@ protected function executeStepNextStep(array $data): array
         ]);
 });
 
+it('authorize() is only called for firstStep', function () {
+    $authorizeForStep = true;
+
+    fakeListFor('person', new class($authorizeForStep) extends PersonList
+    {
+        public function __construct(public bool &$authorizeForStep) {}
+
+        protected function getEntityCommands(): ?array
+        {
+            return [
+                'wizard' => new class($this->authorizeForStep) extends EntityWizardCommand
+                {
+                    public function __construct(public bool &$authorizeForStep) {}
+
+                    protected function getKey(): string
+                    {
+                        return 'test-key';
+                    }
+
+                    public function label(): ?string
+                    {
+                        return 'my command';
+                    }
+
+                    public function authorize(): bool
+                    {
+                        return false;
+                    }
+
+                    public function authorizeForStep(string $step): bool
+                    {
+                        return $this->authorizeForStep;
+                    }
+
+                    public function buildFormFieldsForFirstStep(FieldsContainer $formFields): void
+                    {
+                        $formFields->addField(SharpFormTextField::make('name'));
+                    }
+
+                    protected function executeFirstStep(array $data): array
+                    {
+                        $this->validate($data, ['name' => 'required']);
+
+                        return $this->toStep('next-step');
+                    }
+
+                    public function buildFormFieldsForStepNextStep(FieldsContainer $formFields): void
+                    {
+                        $formFields->addField(SharpFormTextField::make('age'));
+                    }
+
+                    protected function executeStepNextStep(array $data): array
+                    {
+                        return $this->reload();
+                    }
+                },
+            ];
+        }
+    });
+
+    // First post step 1...
+    $this
+        ->postJson(
+            route('code16.sharp.api.list.command.entity', [
+                'globalFilter' => 'root',
+                'entityKey' => 'person',
+                'commandKey' => 'wizard',
+            ]),
+            ['data' => ['name' => 'test']],
+        )
+        ->assertForbidden();
+
+    // Then post step 2 but authorized (default)
+    $this
+        ->postJson(
+            route('code16.sharp.api.list.command.entity', [
+                'entityKey' => 'person',
+                'commandKey' => 'wizard',
+                'command_step' => 'next-step:test-key',
+            ]),
+            ['data' => ['age' => '22']],
+        )
+        ->assertOk();
+
+    // Post 2 but disallowed
+    $authorizeForStep = false;
+    $this
+        ->postJson(
+            route('code16.sharp.api.list.command.entity', [
+                'entityKey' => 'person',
+                'commandKey' => 'wizard',
+                'command_step' => 'next-step:test-key',
+            ]),
+            ['data' => ['age' => '22']],
+        )
+        ->assertForbidden();
+});
+
 it('allows to define a global method for step execution', function () {
     fakeListFor('person', new class() extends PersonList
     {
diff --git a/tests/Http/Api/Commands/ApiEntityListInstanceWizardCommandControllerTest.php b/tests/Http/Api/Commands/ApiEntityListInstanceWizardCommandControllerTest.php
@@ -302,6 +302,106 @@ protected function executeStepNextStep($instanceId, array $data): array
         ]);
 });
 
+it('authorize() is only called for firstStep', function () {
+    $authorizeForStep = true;
+
+    fakeListFor('person', new class($authorizeForStep) extends PersonList
+    {
+        public function __construct(public bool &$authorizeForStep) {}
+
+        protected function getInstanceCommands(): ?array
+        {
+            return [
+                'wizard' => new class($this->authorizeForStep) extends InstanceWizardCommand
+                {
+                    public function __construct(public bool &$authorizeForStep) {}
+
+                    protected function getKey(): string
+                    {
+                        return 'test-key';
+                    }
+
+                    public function label(): ?string
+                    {
+                        return 'my command';
+                    }
+
+                    public function authorizeFor(mixed $instanceId): bool
+                    {
+                        return false;
+                    }
+
+                    public function authorizeForStep(string $step, mixed $instanceId): bool
+                    {
+                        return $this->authorizeForStep;
+                    }
+
+                    public function buildFormFieldsForFirstStep(FieldsContainer $formFields): void
+                    {
+                        $formFields->addField(SharpFormTextField::make('name'));
+                    }
+
+                    protected function executeFirstStep($instanceId, array $data): array
+                    {
+                        $this->validate($data, ['name' => 'required']);
+
+                        return $this->toStep('next-step');
+                    }
+
+                    public function buildFormFieldsForStepNextStep(FieldsContainer $formFields): void
+                    {
+                        $formFields->addField(SharpFormTextField::make('age'));
+                    }
+
+                    protected function executeStepNextStep($instanceId, array $data): array
+                    {
+                        return $this->reload();
+                    }
+                },
+            ];
+        }
+    });
+
+    // First post step 1...
+    $this
+        ->postJson(
+            route('code16.sharp.api.list.command.instance', [
+                'globalFilter' => 'root',
+                'entityKey' => 'person',
+                'commandKey' => 'wizard',
+                'instanceId' => 1]),
+            ['data' => ['name' => 'test']],
+        )
+        ->assertForbidden();
+
+    // Then post step 2 should be authorized (default)...
+    $this
+        ->postJson(
+            route('code16.sharp.api.list.command.instance', [
+                'entityKey' => 'person',
+                'commandKey' => 'wizard',
+                'instanceId' => 1,
+                'command_step' => 'next-step:test-key',
+            ]),
+            ['data' => ['age' => '22']],
+        )
+        ->assertOk();
+
+    // Post 2 but disallowed
+    $authorizeForStep = false;
+    $this
+        ->postJson(
+            route('code16.sharp.api.list.command.instance', [
+                'entityKey' => 'person',
+                'commandKey' => 'wizard',
+                'instanceId' => 1,
+                'command_step' => 'next-step:test-key',
+            ]),
+            ['data' => ['age' => '22']],
+        )
+        ->assertForbidden();
+});
+
 it('allows to define a global method for step execution', function () {
     fakeListFor('person', new class() extends PersonList
     {

Original file line number	Diff line number	Diff line change
`@@ -54,4 +54,9 @@ protected function initialDataForStep(string $step): array`
`54`	`54`	`{`
`55`	`55`	`return [];`
`56`	`56`	`}`
	`57`	`+`
	`58`	`+ public function authorizeForStep(string $step): bool`
	`59`	`+ {`
	`60`	`+ return true;`
	`61`	`+ }`
`57`	`62`	`}`
Original file line number	Diff line number	Diff line change
`@@ -38,9 +38,9 @@ protected function toStep(string $step): array`
`38`	`38`	`];`
`39`	`39`	`}`
`40`	`40`
`41`		`- protected function extractStepFromRequest(): ?string`
	`41`	`+ public function extractStepFromRequest(): ?string`
`42`	`42`	`{`
`43`		`- if ($step = request()->get('command_step')) {`
	`43`	`+ if ($step = request()->input('command_step')) {`
`44`	`44`	`[$step, $this->key] = explode(':', $step);`
`45`	`45`
`46`	`46`	`return $step;`