Merge pull request #732 from m3ue/feature-user-auth

sparkison · web-flow · commit 7bb5d0bd7082 · 2026-02-12T08:20:01.000-07:00
Implement user authentication
diff --git a/app/Filament/Pages/M3uProxyStreamMonitor.php b/app/Filament/Pages/M3uProxyStreamMonitor.php
@@ -32,8 +32,7 @@ class M3uProxyStreamMonitor extends Page
      */
     public static function canAccess(): bool
     {
-        return true; // Allow all users to access the stream monitor
-        // return auth()->check() && auth()->user()->isAdmin();
+        return auth()->check() && auth()->user()->canUseProxy();
     }
 
     protected static string|\UnitEnum|null $navigationGroup = 'Proxy';
diff --git a/app/Filament/Resources/CustomPlaylists/CustomPlaylistResource.php b/app/Filament/Resources/CustomPlaylists/CustomPlaylistResource.php
@@ -138,6 +138,7 @@ public static function table(Table $table): Table
 
                         return $state;
                     })
+                    ->hidden(fn () => ! auth()->user()->canUseProxy())
                     ->sortable(),
                 TextColumn::make('created_at')
                     ->dateTime()
@@ -321,6 +322,7 @@ public static function getForm($creating = false): array
                 ->collapsible()
                 ->collapsed($creating)
                 ->columns(2)
+                ->hidden(fn () => ! auth()->user()->canUseProxy())
                 ->schema([
                     Toggle::make('enable_proxy')
                         ->label('Enable Stream Proxy')
diff --git a/app/Filament/Resources/MediaServerIntegrations/MediaServerIntegrationResource.php b/app/Filament/Resources/MediaServerIntegrations/MediaServerIntegrationResource.php
@@ -62,6 +62,15 @@ class MediaServerIntegrationResource extends Resource
 
     protected static ?int $navigationSort = 100;
 
+    /**
+     * Check if the user can access this page.
+     * Only users with the "integrations" permission can access this page.
+     */
+    public static function canAccess(): bool
+    {
+        return auth()->check() && auth()->user()->canUseIntegrations();
+    }
+
     public static function getRecordTitle(?Model $record): string|null|Htmlable
     {
         return $record?->name;
diff --git a/app/Filament/Resources/MergedPlaylists/MergedPlaylistResource.php b/app/Filament/Resources/MergedPlaylists/MergedPlaylistResource.php
@@ -114,6 +114,7 @@ public static function table(Table $table): Table
                     ->label('Proxy')
                     ->toggleable()
                     ->tooltip('Toggle proxy status')
+                    ->hidden(fn () => ! auth()->user()->canUseProxy())
                     ->sortable(),
                 TextColumn::make('created_at')
                     ->dateTime()
@@ -285,6 +286,7 @@ public static function getForm($creating = false): array
                 ->collapsible()
                 ->collapsed($creating)
                 ->columns(2)
+                ->hidden(fn () => ! auth()->user()->canUseProxy())
                 ->schema([
                     Toggle::make('enable_proxy')
                         ->label('Enable Stream Proxy')
diff --git a/app/Filament/Resources/Networks/NetworkResource.php b/app/Filament/Resources/Networks/NetworkResource.php
@@ -60,6 +60,15 @@ class NetworkResource extends Resource
 
     protected static ?int $navigationSort = 110;
 
+    /**
+     * Check if the user can access this page.
+     * Only users with the "integrations" permission can access this page.
+     */
+    public static function canAccess(): bool
+    {
+        return auth()->check() && auth()->user()->canUseIntegrations();
+    }
+
     public static function getDescription(): ?string
     {
         return 'Networks are your own personal TV station that contain your lineups (local media content). Create custom broadcast channels with scheduled programming from your media library.';
diff --git a/app/Filament/Resources/PersonalAccessTokens/PersonalAccessTokenResource.php b/app/Filament/Resources/PersonalAccessTokens/PersonalAccessTokenResource.php
@@ -24,6 +24,15 @@ class PersonalAccessTokenResource extends Resource
 
     protected static ?string $recordTitleAttribute = 'name';
 
+    /**
+     * Check if the user can access this page.
+     * Only users with the "tools" permission can access this page.
+     */
+    public static function canAccess(): bool
+    {
+        return auth()->check() && auth()->user()->canUseTools();
+    }
+
     public static function getGloballySearchableAttributes(): array
     {
         return ['name', 'abilities'];
diff --git a/app/Filament/Resources/PlaylistAliases/PlaylistAliasResource.php b/app/Filament/Resources/PlaylistAliases/PlaylistAliasResource.php
@@ -355,6 +355,7 @@ public static function getForm(): array
 
             Schemas\Components\Fieldset::make('Proxy Options')
                 ->columns(2)
+                ->hidden(fn () => ! auth()->user()->canUseProxy())
                 ->schema([
                     Forms\Components\Toggle::make('enable_proxy')
                         ->label('Enable Stream Proxy')
diff --git a/app/Filament/Resources/Playlists/PlaylistResource.php b/app/Filament/Resources/Playlists/PlaylistResource.php
@@ -286,6 +286,7 @@ public static function setupTable(Table $table, $relationId = null): Table
                         ? 'Proxy is required when Provider Profiles are enabled'
                         : 'Toggle proxy status')
                     ->disabled(fn (Playlist $record): bool => $record->profiles_enabled)
+                    ->hidden(fn () => ! auth()->user()->canUseProxy())
                     ->sortable(),
                 ToggleColumn::make('auto_sync')
                     ->label('Auto Sync')
@@ -2265,6 +2266,7 @@ public static function getFormSections($creating = false, $includeAuth = false):
                 ->collapsible()
                 ->collapsed($creating)
                 ->columns(2)
+                ->hidden(fn () => ! auth()->user()->canUseProxy())
                 ->schema([
                     Toggle::make('enable_proxy')
                         ->label('Enable Stream Proxy')
diff --git a/app/Filament/Resources/PostProcesses/PostProcessResource.php b/app/Filament/Resources/PostProcesses/PostProcessResource.php
@@ -47,6 +47,15 @@ class PostProcessResource extends Resource
 
     protected static string|\UnitEnum|null $navigationGroup = 'Tools';
 
+    /**
+     * Check if the user can access this page.
+     * Only users with the "tools" permission can access this page.
+     */
+    public static function canAccess(): bool
+    {
+        return auth()->check() && auth()->user()->canUseTools();
+    }
+
     public static function getGloballySearchableAttributes(): array
     {
         return ['name'];
diff --git a/app/Filament/Resources/StreamFileSettings/StreamFileSettingResource.php b/app/Filament/Resources/StreamFileSettings/StreamFileSettingResource.php
@@ -37,6 +37,15 @@ class StreamFileSettingResource extends Resource
 
     protected static ?string $pluralModelLabel = 'Stream File Settings';
 
+    /**
+     * Check if the user can access this page.
+     * Only users with the "stream file sync" permission can access this page.
+     */
+    public static function canAccess(): bool
+    {
+        return auth()->check() && auth()->user()->canUseStreamFileSync();
+    }
+
     public static function getNavigationSort(): ?int
     {
         return 6;
diff --git a/app/Filament/Resources/StreamProfiles/StreamProfileResource.php b/app/Filament/Resources/StreamProfiles/StreamProfileResource.php
@@ -20,6 +20,15 @@ class StreamProfileResource extends Resource
 
     protected static string|\UnitEnum|null $navigationGroup = 'Proxy';
 
+    /**
+     * Check if the user can access this resource.
+     * Only users with proxy permission can access stream profiles.
+     */
+    public static function canAccess(): bool
+    {
+        return auth()->check() && auth()->user()->canUseProxy();
+    }
+
     public static function form(Schema $schema): Schema
     {
         return $schema
diff --git a/app/Filament/Resources/Users/UserResource.php b/app/Filament/Resources/Users/UserResource.php
@@ -49,6 +49,18 @@ public static function form(Schema $schema): Schema
                     ->label('Email address')
                     ->email()
                     ->required(),
+                Forms\Components\CheckboxList::make('permissions')
+                    ->label('Permissions')
+                    ->options(User::getAvailablePermissions())
+                    ->descriptions([
+                        'use_proxy' => 'Allow this user to access proxy features and stream via the m3u-proxy server',
+                        'use_integrations' => 'Allow this user to access media server integrations and related features',
+                        'use_tools' => 'Allow this user to access tools like API Tokens and Post Processing',
+                        'use_stream_file_sync' => 'Allow this user to access stream file sync features',
+                    ])
+                    ->columnSpanFull()
+                    ->gridDirection('row')
+                    ->columns(2),
                 Forms\Components\Toggle::make('update_password')
                     ->label('Update Password')
                     ->default(false)
@@ -87,6 +99,10 @@ public static function table(Table $table): Table
                 Tables\Columns\TextColumn::make('email')
                     ->label('Email address')
                     ->searchable(),
+                Tables\Columns\TextColumn::make('permissions')
+                    ->label('Permissions')
+                    ->badge()
+                    ->toggleable(),
                 // Tables\Columns\TextColumn::make('email_verified_at')
                 //     ->dateTime()
                 //     ->sortable(),
diff --git a/app/Http/Controllers/PlaylistGenerateController.php b/app/Http/Controllers/PlaylistGenerateController.php
@@ -86,6 +86,13 @@ public function __invoke(Request $request, string $uuid)
         } else {
             $proxyEnabled = $playlist->enable_proxy;
         }
+
+        // Check if user has permission to use proxy
+        // If not, force proxy to be disabled regardless of settings
+        if ($proxyEnabled && ! $playlist->user->canUseProxy()) {
+            $proxyEnabled = false;
+        }
+
         $logoProxyEnabled = $playlist->enable_logo_proxy;
 
         // Get the base URL
diff --git a/app/Models/CustomPlaylist.php b/app/Models/CustomPlaylist.php
@@ -4,6 +4,7 @@
 
 use App\Enums\PlaylistChannelId;
 use App\Traits\ShortUrlTrait;
+use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
@@ -219,4 +220,20 @@ public function getPooledSourcePlaylists(): \Illuminate\Database\Eloquent\Collec
             ->where('profiles_enabled', true)
             ->get();
     }
+
+    public function enableProxy(): Attribute
+    {
+        return Attribute::make(
+            get: function ($value) {
+                if ($value) {
+                    // Check playlist user has access to proxy features
+                    if (! $this->user?->canUseProxy()) {
+                        return false;
+                    }
+                }
+
+                return $value;
+            }
+        );
+    }
 }
diff --git a/app/Models/MergedPlaylist.php b/app/Models/MergedPlaylist.php
@@ -5,6 +5,7 @@
 use App\Enums\PlaylistChannelId;
 use App\Pivots\MergedPlaylistPivot;
 use App\Traits\ShortUrlTrait;
+use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
@@ -161,4 +162,20 @@ public function postProcesses(): MorphToMany
     {
         return $this->morphToMany(PostProcess::class, 'processable');
     }
+
+    public function enableProxy(): Attribute
+    {
+        return Attribute::make(
+            get: function ($value) {
+                if ($value) {
+                    // Check playlist user has access to proxy features
+                    if (! $this->user?->canUseProxy()) {
+                        return false;
+                    }
+                }
+
+                return $value;
+            }
+        );
+    }
 }
diff --git a/app/Models/Playlist.php b/app/Models/Playlist.php
@@ -325,6 +325,22 @@ public function getAllConfigs(): array
         return collect($configs)->sortBy('priority')->values()->all();
     }
 
+    public function enableProxy(): Attribute
+    {
+        return Attribute::make(
+            get: function ($value) {
+                if ($value) {
+                    // Check playlist user has access to proxy features
+                    if (! $this->user?->canUseProxy()) {
+                        return false;
+                    }
+                }
+
+                return $value;
+            }
+        );
+    }
+
     public function xtreamStatus(): Attribute
     {
         return Attribute::make(
diff --git a/app/Models/PlaylistAlias.php b/app/Models/PlaylistAlias.php
@@ -290,6 +290,22 @@ public function enabled_vod_channels(): BelongsToMany|HasManyThrough
             ->where('enabled', true);
     }
 
+    public function enableProxy(): Attribute
+    {
+        return Attribute::make(
+            get: function ($value) {
+                if ($value) {
+                    // Check playlist user has access to proxy features
+                    if (! $this->user?->canUseProxy()) {
+                        return false;
+                    }
+                }
+
+                return $value;
+            }
+        );
+    }
+
     public function liveCount(): Attribute
     {
         return Attribute::make(
diff --git a/app/Models/User.php b/app/Models/User.php
@@ -44,6 +44,7 @@ protected function casts(): array
             // 'avatar_url' => 'array'
             'app_authentication_secret' => 'encrypted',
             'app_authentication_recovery_codes' => 'encrypted:array',
+            'permissions' => 'array',
         ];
     }
 
@@ -184,4 +185,65 @@ public function isAdmin(): bool
     {
         return in_array($this->email, config('dev.admin_emails', []));
     }
+
+    /**
+     * Check if user has a specific permission.
+     * Admins always have all permissions.
+     */
+    public function hasPermission(string $permission): bool
+    {
+        // Admins have all permissions
+        if ($this->isAdmin()) {
+            return true;
+        }
+
+        $permissions = $this->permissions ?? [];
+
+        return in_array($permission, $permissions);
+    }
+
+    /**
+     * Check if user can use the proxy feature.
+     */
+    public function canUseProxy(): bool
+    {
+        return $this->hasPermission('use_proxy');
+    }
+
+    /**
+     * Check if user can use integrations.
+     */
+    public function canUseIntegrations(): bool
+    {
+        return $this->hasPermission('use_integrations');
+    }
+
+    /**
+     * Check if user can use tools.
+     */
+    public function canUseTools(): bool
+    {
+        return $this->hasPermission('use_tools');
+    }
+
+    /**
+     * Check if user can use stream file sync.
+     */
+    public function canUseStreamFileSync(): bool
+    {
+        return $this->hasPermission('use_stream_file_sync');
+    }
+
+    /**
+     * Get all available permissions.
+     */
+    public static function getAvailablePermissions(): array
+    {
+        return [
+            'use_proxy' => 'Use Proxy',
+            'use_integrations' => 'Use Integrations',
+            'use_tools' => 'Use Tools',
+            'use_stream_file_sync' => 'Use Stream File Sync',
+        ];
+    }
 }
diff --git a/database/migrations/2026_02_11_161020_add_permissions_to_users_table.php b/database/migrations/2026_02_11_161020_add_permissions_to_users_table.php

Original file line number	Diff line number	Diff line change
`@@ -32,8 +32,7 @@ class M3uProxyStreamMonitor extends Page`
`32`	`32`	`*/`
`33`	`33`	`public static function canAccess(): bool`
`34`	`34`	`{`
`35`		`- return true; // Allow all users to access the stream monitor`
`36`		`- // return auth()->check() && auth()->user()->isAdmin();`
	`35`	`+ return auth()->check() && auth()->user()->canUseProxy();`
`37`	`36`	`}`
`38`	`37`
`39`	`38`	`protected static string\|\UnitEnum\|null $navigationGroup = 'Proxy';`