terrylee/star-cloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] 遠端管理歷史紀錄套用機台授權過濾，修復租戶帳號 500

Browse Source 
1. RemoteController index() 與 stock() 的歷史查詢加上 whereHas('machine')，透過 Machine 的 machine_access 全域作用域，使租戶僅能看到自己被授權機台的指令／補貨紀錄；系統管理員不受限制仍可看全部，符合 RBAC 機台以帳號授權原則。
2. 修復根因：先前重構將 Blade 改為對 machine 關聯直接呼叫 only()，租戶遇到未授權機台時 machine 為 null 導致整頁 500。
3. tab-history 與 tab-history-index 三處 $item->machine->only() 改為 null-safe（?->...?? null）作為防禦，避免未來其他查詢路徑漏過濾再次崩潰。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
sky121113 2026-06-17 11:15:05 +08:00
parent cbc4ae3749
commit 63219a31fb
3 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
app/Http/Controllers/Admin/RemoteController.php
View File

@ -42,7 +42,10 @@ class RemoteController extends Controller
$machines = $machineQuery->paginate($request->input('per_page', 10), ['*'], 'machine_page'); $machines = $machineQuery->paginate($request->input('per_page', 10), ['*'], 'machine_page');
// --- 2. 歷史紀錄處理 (Operation Records Tab) --- // --- 2. 歷史紀錄處理 (Operation Records Tab) ---
// whereHas('machine') 會套用 Machine 的 machine_access 全域作用域，
// 確保租戶僅能看到自己被授權機台的指令紀錄（系統管理員不受作用域限制，仍可看全部）。
$historyQuery = RemoteCommand::where('command_type', '!=', 'reload_stock') $historyQuery = RemoteCommand::where('command_type', '!=', 'reload_stock')
->whereHas('machine')
->with(['machine', 'user']); ->with(['machine', 'user']);
if ($request->filled('search') && ($request->input('tab') === 'history' || !$request->has('tab'))) { if ($request->filled('search') && ($request->input('tab') === 'history' || !$request->has('tab'))) {
@ -233,8 +236,9 @@ class RemoteController extends Controller
->paginate($request->input('per_page', 10), ['*'], 'machine_page'); ->paginate($request->input('per_page', 10), ['*'], 'machine_page');
// 2. 歷史紀錄查詢與分頁 // 2. 歷史紀錄查詢與分頁
// whereHas('machine') 套用 machine_access 作用域，租戶僅能看到自己授權機台的補貨紀錄。
$historyQuery = RemoteCommand::with(['machine', 'user']); $historyQuery = RemoteCommand::with(['machine', 'user']);
$historyQuery->where('command_type', 'reload_stock'); $historyQuery->whereHas('machine')->where('command_type', 'reload_stock');
if ($request->filled('search')) { if ($request->filled('search')) {
$search = $request->input('search'); $search = $request->input('search');

6
resources/views/admin/remote/partials/tab-history-index.blade.php
View File

@ -162,7 +162,7 @@
@foreach ($history as $item) @foreach ($history as $item)
<tr <tr
class="group hover:bg-slate-50/80 dark:hover:bg-slate-800/40 transition-all duration-300"> class="group hover:bg-slate-50/80 dark:hover:bg-slate-800/40 transition-all duration-300">
<td class="px-6 py-6 cursor-pointer" @click="selectMachine({{ Js::from($item->machine->only(['id', 'name', 'serial_no', 'image_urls'])) }})"> <td class="px-6 py-6 cursor-pointer" @click="selectMachine({{ Js::from(($item->machine?->only(['id', 'name', 'serial_no', 'image_urls']) ?? null)) }})">
<div class="flex items-center gap-4"> <div class="flex items-center gap-4">
<div <div
class="w-12 h-12 rounded-2xl bg-slate-100 dark:bg-slate-800 flex items-center justify-center text-slate-400 border border-slate-200 dark:border-slate-700 group-hover:bg-cyan-500 group-hover:text-white transition-all duration-300 shadow-sm overflow-hidden shrink-0"> class="w-12 h-12 rounded-2xl bg-slate-100 dark:bg-slate-800 flex items-center justify-center text-slate-400 border border-slate-200 dark:border-slate-700 group-hover:bg-cyan-500 group-hover:text-white transition-all duration-300 shadow-sm overflow-hidden shrink-0">
@ -295,7 +295,7 @@
<div class="xl:hidden grid grid-cols-1 md:grid-cols-2 gap-6"> <div class="xl:hidden grid grid-cols-1 md:grid-cols-2 gap-6">
@forelse ($history as $item) @forelse ($history as $item)
<div class="luxury-card p-6 rounded-[2rem] border border-slate-100 dark:border-slate-800 bg-white/50 dark:bg-slate-900/50 transition-all duration-300 group" <div class="luxury-card p-6 rounded-[2rem] border border-slate-100 dark:border-slate-800 bg-white/50 dark:bg-slate-900/50 transition-all duration-300 group"
@click="selectMachine({{ Js::from($item->machine->only(['id', 'name', 'serial_no', 'image_urls'])) }})"> @click="selectMachine({{ Js::from(($item->machine?->only(['id', 'name', 'serial_no', 'image_urls']) ?? null)) }})">
<div class="flex items-start justify-between gap-4 mb-6"> <div class="flex items-start justify-between gap-4 mb-6">
<div class="flex items-center gap-4 min-w-0"> <div class="flex items-center gap-4 min-w-0">
<div class="w-14 h-14 rounded-2xl bg-slate-100 dark:bg-slate-800 flex items-center justify-center text-slate-400 border border-slate-200 dark:border-slate-700 group-hover:bg-cyan-500 group-hover:text-white transition-all duration-300 overflow-hidden shadow-sm shrink-0"> <div class="w-14 h-14 rounded-2xl bg-slate-100 dark:bg-slate-800 flex items-center justify-center text-slate-400 border border-slate-200 dark:border-slate-700 group-hover:bg-cyan-500 group-hover:text-white transition-all duration-300 overflow-hidden shadow-sm shrink-0">
@ -379,7 +379,7 @@
</div> </div>
<div class="flex items-center gap-3"> <div class="flex items-center gap-3">
<button type="button" @click.stop="selectMachine({{ Js::from($item->machine->only(['id', 'name', 'serial_no', 'image_urls'])) }})" <button type="button" @click.stop="selectMachine({{ Js::from(($item->machine?->only(['id', 'name', 'serial_no', 'image_urls']) ?? null)) }})"
class="flex-1 flex items-center justify-center gap-2 py-3 rounded-xl bg-slate-100 dark:bg-slate-800 text-slate-600 dark:text-slate-300 font-black text-[10px] sm:text-xs tracking-widest hover:bg-slate-200 dark:hover:bg-slate-700 transition-all duration-300 border border-slate-200 dark:border-slate-700 shadow-sm"> class="flex-1 flex items-center justify-center gap-2 py-3 rounded-xl bg-slate-100 dark:bg-slate-800 text-slate-600 dark:text-slate-300 font-black text-[10px] sm:text-xs tracking-widest hover:bg-slate-200 dark:hover:bg-slate-700 transition-all duration-300 border border-slate-200 dark:border-slate-700 shadow-sm">
<svg class="w-4 h-4 stroke-[2.5]" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" d="m16.862 4.487 1.687-1.688a1.875 1.875 0 1 1 2.652 2.652L10.582 16.07a4.5 4.5 0 0 1-1.897 1.13L6 18l.8-2.685a4.5 4.5 0 0 1 1.13-1.897l8.932-8.931Zm0 0L19.5 7.125M18 14v4.75A2.25 2.25 0 0 1 15.75 21H5.25A2.25 2.25 0 0 1 3 18.75V8.25A2.25 2.25 0 0 1 5.25 6H10" /></svg> <svg class="w-4 h-4 stroke-[2.5]" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" d="m16.862 4.487 1.687-1.688a1.875 1.875 0 1 1 2.652 2.652L10.582 16.07a4.5 4.5 0 0 1-1.897 1.13L6 18l.8-2.685a4.5 4.5 0 0 1 1.13-1.897l8.932-8.931Zm0 0L19.5 7.125M18 14v4.75A2.25 2.25 0 0 1 15.75 21H5.25A2.25 2.25 0 0 1 3 18.75V8.25A2.25 2.25 0 0 1 5.25 6H10" /></svg>
{{ __('New Command') }} {{ __('New Command') }}

6
resources/views/admin/remote/partials/tab-history.blade.php
View File

@ -129,7 +129,7 @@
<tbody class="divide-y divide-slate-50 dark:divide-slate-800/80"> <tbody class="divide-y divide-slate-50 dark:divide-slate-800/80">
@foreach ($history as $item) @foreach ($history as $item)
<tr class="group hover:bg-slate-50/80 dark:hover:bg-slate-800/40 transition-all duration-300"> <tr class="group hover:bg-slate-50/80 dark:hover:bg-slate-800/40 transition-all duration-300">
<td class="px-6 py-6 cursor-pointer" @click="selectMachine(@js($item->machine->only(['id', 'name', 'serial_no', 'image_urls'])))"> <td class="px-6 py-6 cursor-pointer" @click="selectMachine(@js(($item->machine?->only(['id', 'name', 'serial_no', 'image_urls']) ?? null)))">
<div class="flex items-center gap-4"> <div class="flex items-center gap-4">
<div <div
class="w-12 h-12 rounded-2xl bg-slate-100 dark:bg-slate-800 flex items-center justify-center text-slate-400 border border-slate-200 dark:border-slate-700 group-hover:bg-cyan-500 group-hover:text-white transition-all duration-300 shadow-sm overflow-hidden"> class="w-12 h-12 rounded-2xl bg-slate-100 dark:bg-slate-800 flex items-center justify-center text-slate-400 border border-slate-200 dark:border-slate-700 group-hover:bg-cyan-500 group-hover:text-white transition-all duration-300 shadow-sm overflow-hidden">
@ -236,7 +236,7 @@
<div class="xl:hidden grid grid-cols-1 md:grid-cols-2 gap-6"> <div class="xl:hidden grid grid-cols-1 md:grid-cols-2 gap-6">
@forelse ($history as $item) @forelse ($history as $item)
<div class="luxury-card p-6 rounded-[2rem] border border-slate-100 dark:border-slate-800 bg-white/50 dark:bg-slate-900/50 transition-all duration-300 group" <div class="luxury-card p-6 rounded-[2rem] border border-slate-100 dark:border-slate-800 bg-white/50 dark:bg-slate-900/50 transition-all duration-300 group"
@click="selectMachine(@js($item->machine->only(['id', 'name', 'serial_no', 'image_urls'])))"> @click="selectMachine(@js(($item->machine?->only(['id', 'name', 'serial_no', 'image_urls']) ?? null)))">
<div class="flex items-start justify-between gap-4 mb-6"> <div class="flex items-start justify-between gap-4 mb-6">
<div class="flex items-center gap-4 min-w-0"> <div class="flex items-center gap-4 min-w-0">
<div <div
@ -314,7 +314,7 @@
</div> </div>
<div class="flex items-center gap-3"> <div class="flex items-center gap-3">
<button type="button" @click.stop="selectMachine(@js($item->machine->only(['id', 'name', 'serial_no', 'image_urls'])))" <button type="button" @click.stop="selectMachine(@js(($item->machine?->only(['id', 'name', 'serial_no', 'image_urls']) ?? null)))"
class="flex-1 flex items-center justify-center gap-2 py-3 rounded-xl bg-slate-100 dark:bg-slate-800 text-slate-600 dark:text-slate-300 font-black text-[10px] sm:text-xs tracking-widest hover:bg-slate-200 dark:hover:bg-slate-700 transition-all duration-300 border border-slate-200 dark:border-slate-700 shadow-sm"> class="flex-1 flex items-center justify-center gap-2 py-3 rounded-xl bg-slate-100 dark:bg-slate-800 text-slate-600 dark:text-slate-300 font-black text-[10px] sm:text-xs tracking-widest hover:bg-slate-200 dark:hover:bg-slate-700 transition-all duration-300 border border-slate-200 dark:border-slate-700 shadow-sm">
<svg class="w-4 h-4 stroke-[2.5]" fill="none" stroke="currentColor" viewBox="0 0 24 24"> <svg class="w-4 h-4 stroke-[2.5]" fill="none" stroke="currentColor" viewBox="0 0 24 24">
<path stroke-linecap="round" stroke-linejoin="round" <path stroke-linecap="round" stroke-linejoin="round"