allow non-teamowner to invite users

Hi there, I am trying to allow someone other than the team owner to invite users to the team. When team owner I can POST to /settings/teams/{team}/invitations successfully, however when not the team owner I get a 403 Forbidden.

I have traced through the route, controller, function and the SendInvitation interaction, and nowhere can I find a check on teamOwner. I wanted to see how Taylor did it before modifying or replacing it.

I have been through Jeffrey's excellent Vue 2 series, so I'm no longer Private Noob, more like PFC :P Thanks for your guidance!

resleeved

8 years ago

Level 1

I wasn't clear that I am just looking at the built-in team settings -> team membership -> send invitation form, but commented out the template's if statements that only show the form if teamOwner.

The Vue send function uses Spark.send to post to the correct route, and it works fine if user=teamOwner, but not otherwise. Any clue as to where else the check and block is happening? Thx

resleeved

8 years ago

Best Answer

Level 1

Ok, tracked it down to CreateInvitationRequest.php under spark/src/Http/Requests/Settings/Teams. I missed the fact that the MailedInvititationController was accepting a CreateInvitationRequest object in the store method. Instead of building my own, I think I will just modify its authorize function to return true based on role instead of just owner.

Cronix

8 years ago

Level 67

I think I will just modify its authorize function to return true based on role instead of just owner

@resleeved If you modify the original file you will (or can if they changed it) overwrite your changes when you upgrade, so you'd have to track that and make sure your changes don't get overridden.

It's best to copy the original file to app\SparkExtensions (or some other place in app), namespace it appropriately, alter it how you need, and then bind your custom class to the ioc so laravel will use your class instead of the default when the app calls it.

In app/Providers/SparkServiceProvider:

public function register()
{
    $this->app->singleton(
        // The original class location
        'Laravel\Spark\Contracts\Interactions\Settings\Profile\UpdateContactInformation',

        // Your custom class to use instead
        'App\SparkExtensions\UpdateContactInformation'
    );
}

resleeved

8 years ago

Level 1

Cronix, thank you, that is good advice and I will follow it.

Please or to participate in this conversation.