fix: 🔒 restrict sites data for user client role

app/Http/Controllers/Back/SiteController.php

@@ -62,9 +62,16 @@ class SiteController extends BackendController
      */
     public function index(Request $request): \Inertia\Response
     {
+        /** @var \App\Models\User $userModel */
+        $userModel = auth('backend')->user();
+
         /** @var \Illuminate\Database\Eloquent\Builder<\App\Models\Site> $query */
-        $query = Site::query()->with(['projectManager', 'gitlabProject']);
-        ;
+        $query = Site::query()
+            ->when(
+                $userModel->role->value === UserRoleRegistry::get('client')->value,
+                fn($query) => $query->whereIn('id', $userModel->sites->modelKeys()),
+            )
+            ->with(['projectManager', 'gitlabProject']);
 
         if ($request->routeIs("back.$this->modelName.trash")) {
             $query = $query->onlyTrashed();

resources/ts/back/Pages/Sites/Show.tsx

@@ -29,8 +29,17 @@ import { AppEnv } from "@/types/global";
 import { TranslationField } from "@/back/types/i18n";
 import { GitlabProjectModel, SiteModel } from "@/back/types/project";
 
-const getColumns = (viewAnyUsers: boolean, appEnv: AppEnv) => {
-  return [
+const getColumns = (
+  appEnv: AppEnv,
+  viewAnyUsers: boolean,
+  enumUserRole: UserModel["role"][],
+  model: UserModel,
+) => {
+  const isClient =
+    enumUserRole.find((role) => role.name === "client")?.value ===
+    model.role?.value;
+
+  const columns = [
     {
       accessorKey: "name",
       header: str(GetTranslation("validation.custom.name")).ucFirst().value(),
@@ -375,6 +384,16 @@ const getColumns = (viewAnyUsers: boolean, appEnv: AppEnv) => {
       ),
     },
   ];
+
+  return columns.filter((column) => {
+    if (
+      (column.accessorKey === "users" ||
+        column.accessorKey === "gitlab_project") &&
+      isClient
+    )
+      return false;
+    return true;
+  });
 };
 
 export default function Show({
@@ -384,9 +403,10 @@ export default function Show({
   data: SingleResource;
   modelName: string;
 }) {
-  const { auth, appEnv } = usePage().props as unknown as {
+  const { auth, appEnv, enumUserRole } = usePage().props as unknown as {
     auth: AuthProp;
     appEnv: AppEnv;
+    enumUserRole: UserModel["role"][];
   };
   const { viewAny } = auth.policies.sites;
   const { viewAny: viewAnyUsers } = auth.policies.users;
@@ -402,7 +422,7 @@ export default function Show({
       },
     },
   );
-  const columns = getColumns(viewAnyUsers, appEnv);
+  const columns = getColumns(appEnv, viewAnyUsers, enumUserRole, auth.user);
 
   // Translations.
   const transCrudBackToList = useTrans("uwil-backend::back.crud_back_to_list");