first commit
This commit is contained in:
+189
@@ -0,0 +1,189 @@
|
||||
<?php
|
||||
|
||||
return [
|
||||
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Demo Mode
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| Turns the deployment into a public demo: the writes described below are
|
||||
| refused, and the shared accounts named in "protected_users" cannot be
|
||||
| modified. Everything else stays interactive, so the demo still feels
|
||||
| like the real application.
|
||||
|
|
||||
| This is a per deployment switch rather than a setting. Demo mode's main
|
||||
| job is blocking settings writes, so a toggle living in the settings store
|
||||
| would either be unreachable to you once demo mode is on, or reachable to
|
||||
| any visitor signed in on the shared account.
|
||||
|
|
||||
| Flip it with DEMO_MODE in .env, then run "php artisan config:clear".
|
||||
|
|
||||
*/
|
||||
|
||||
'enabled' => env('DEMO_MODE', false),
|
||||
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Blocked Routes
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| Route names, matched with Str::is() so a trailing * covers a whole
|
||||
| domain. Only writes are considered, so "settings.*" refuses saving the
|
||||
| settings without hiding the settings pages themselves. GET routes that
|
||||
| change state belong under "unsafe_reads" below.
|
||||
|
|
||||
| A slash separated entry is matched against the request path instead,
|
||||
| which is how the largely unnamed routes in routes/api.php are covered.
|
||||
|
|
||||
*/
|
||||
|
||||
'blocked' => [
|
||||
// Settings are global. One visitor renaming the application or
|
||||
// turning registration off breaks the demo for everybody else.
|
||||
'settings.*',
|
||||
|
||||
// The role and permission matrix rewrites what every role may do,
|
||||
// including the role the demo account itself belongs to.
|
||||
'permissions.save',
|
||||
|
||||
// The installer rewrites .env and re-runs the seeders.
|
||||
'install.*',
|
||||
|
||||
// Two factor authentication on a shared account locks out every
|
||||
// other visitor.
|
||||
'2fa.*',
|
||||
'user.two-factor.*',
|
||||
'two-factor.enable',
|
||||
'two-factor.disable',
|
||||
'two-factor.confirm',
|
||||
'two-factor.regenerate-recovery-codes',
|
||||
|
||||
// The same three concerns over the API, which is unnamed and so has
|
||||
// to be matched by path.
|
||||
'api/me/2fa',
|
||||
'api/me/2fa/*',
|
||||
'api/users/*/2fa',
|
||||
'api/users/*/2fa/*',
|
||||
'api/roles/*/permissions',
|
||||
|
||||
// Announcements are visible to every visitor. Uncomment these if
|
||||
// moderating them becomes a chore. The guard is a global middleware,
|
||||
// so plugin routes are covered without touching the plugin.
|
||||
// 'announcements.store',
|
||||
// 'announcements.update',
|
||||
// 'announcements.destroy',
|
||||
],
|
||||
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Unsafe Reads
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| GET routes that change state, and so are refused despite the verb.
|
||||
| Everything else answering a safe verb is left alone, because a demo that
|
||||
| cannot be browsed is not a demo.
|
||||
|
|
||||
| Impersonation is deliberately absent: it is one of the features the demo
|
||||
| exists to show off, and it grants nothing. The rules below follow the
|
||||
| impersonated identity, so a visitor who takes over a protected account
|
||||
| still cannot modify it.
|
||||
|
|
||||
*/
|
||||
|
||||
'unsafe_reads' => [
|
||||
// The same controller action as the POST, reachable over GET.
|
||||
'install.installation.start',
|
||||
],
|
||||
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Allowed Routes
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| Checked before everything else, so these win over "blocked". This is
|
||||
| what a visitor needs in order to use the demo at all.
|
||||
|
|
||||
*/
|
||||
|
||||
'allowed' => [
|
||||
'login',
|
||||
'logout',
|
||||
'auth.logout',
|
||||
'register',
|
||||
'password.email',
|
||||
'password.update',
|
||||
'verification.resend',
|
||||
|
||||
// The two factor challenge at login, as opposed to enabling two
|
||||
// factor authentication on an account.
|
||||
'auth.token.validate',
|
||||
'two-factor.login.store',
|
||||
|
||||
// Confirms the current password, it does not change it.
|
||||
'password.confirm.store',
|
||||
|
||||
'announcements.read',
|
||||
],
|
||||
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Protected Accounts
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| Usernames or email addresses of the shared accounts the demo hands out.
|
||||
| They cannot be renamed, re-passworded, re-avatared, approved, deleted or
|
||||
| have their sessions invalidated, whether the request targets them or is
|
||||
| made by them. Matched case insensitively.
|
||||
|
|
||||
| UserSeeder creates exactly one: admin / admin@example.com.
|
||||
|
|
||||
*/
|
||||
|
||||
'protected_users' => ['admin'],
|
||||
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Self Service Routes
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| The routes where the signed in user is the thing being modified. Only
|
||||
| these consult the acting user, so a visitor on the shared account can
|
||||
| still create users, roles and permissions.
|
||||
|
|
||||
*/
|
||||
|
||||
'self_routes' => [
|
||||
'profile.update.*',
|
||||
'profile.sessions.*',
|
||||
|
||||
// The API equivalents, matched by path because they are unnamed.
|
||||
'api/me/*',
|
||||
'api/sessions/*',
|
||||
],
|
||||
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Default Roles And Permissions
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| Extends the existing "removable" column from delete to update, so the
|
||||
| seeded roles and permissions cannot be renamed either.
|
||||
|
|
||||
*/
|
||||
|
||||
'protect_default_roles' => true,
|
||||
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Message Override
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| One message in place of the translated defaults. Rendered as plain text
|
||||
| in a toast, so no markup.
|
||||
|
|
||||
*/
|
||||
|
||||
'message' => env('DEMO_MESSAGE'),
|
||||
|
||||
];
|
||||
Reference in New Issue
Block a user