Merge pull request #332 from opcodesio/improvement/production-authorization

better handling of the production block

Author: arukompas

config/log-viewer.php

@@ -12,6 +12,8 @@
 
     'enabled' => env('LOG_VIEWER_ENABLED', true),
 
+    'require_auth_in_production' => true,
+
     /*
     |--------------------------------------------------------------------------
     | Log Viewer Domain

src/Http/Middleware/AuthorizeLogViewer.php

@@ -2,12 +2,23 @@
 
 namespace Opcodes\LogViewer\Http\Middleware;
 
+use Illuminate\Support\Facades\App;
+use Illuminate\Support\Facades\Gate;
 use Opcodes\LogViewer\Facades\LogViewer;
 
 class AuthorizeLogViewer
 {
     public function handle($request, $next)
     {
+        if (
+            config('log-viewer.require_auth_in_production', false)
+            && App::isProduction()
+            && ! Gate::has('viewLogViewer')
+            && ! LogViewer::hasAuthCallback()
+        ) {
+            abort(403);
+        }
+
         LogViewer::auth();
 
         return $next($request);

src/LogViewerServiceProvider.php

@@ -134,12 +134,6 @@ protected function defineDefaultGates()
         if (! Gate::has('deleteLogFolder')) {
             Gate::define('deleteLogFolder', fn (mixed $user, LogFolder $folder) => true);
         }
-
-        if ($this->app->isProduction() && ! Gate::has('viewLogViewer') && ! LogViewer::hasAuthCallback()) {
-            // Disable Log Viewer in production by default. In order to allow access,
-            // developers will have to define a "viewLogViewer" gate or an "auth" callback.
-            LogViewer::auth(fn ($request) => false);
-        }
     }
 
     /**

tests/Feature/Authorization/CanViewLogViewerTest.php

@@ -40,15 +40,27 @@
 test('local environment can use Log Viewer by default', function () {
     app()->detectEnvironment(fn () => 'local');
     expect(app()->isProduction())->toBeFalse();
-    (new \Opcodes\LogViewer\LogViewerServiceProvider(app()))->boot();
 
     get(route('log-viewer.index'))->assertOk();
 });
 
 test('Log Viewer is blocked in production environment by default', function () {
     app()->detectEnvironment(fn () => 'production');
     expect(app()->isProduction())->toBeTrue();
-    (new \Opcodes\LogViewer\LogViewerServiceProvider(app()))->boot();
 
     get(route('log-viewer.index'))->assertForbidden();
+
+    // but if configuration allows...
+    config(['log-viewer.require_auth_in_production' => false]);
+    get(route('log-viewer.index'))->assertOk();
+});
+
+test('Log Viewer is not blocked if the Log Viewer auth middleware is not used', function () {
+    config(['log-viewer.middleware' => ['web']]);
+    app()->detectEnvironment(fn () => 'production');
+    expect(app()->isProduction())->toBeTrue();
+    // need to reload the routes in order for the new middleware to take place.
+    (new \Opcodes\LogViewer\LogViewerServiceProvider(app()))->boot();
+
+    get(route('log-viewer.index'))->assertOk();
 });