…tion
- Remove CheckContactsAndAffiliation and CheckPermissionAndAffiliation (pipeline-based
middleware replaced by simpler auth.CheckAuthorization from the auth package)
- Authenticate: fix redirect route name auth.login → login
- CheckACLPermission: rewrite to use RoleMembership.can_moderate instead of Role.moderators
- CheckAffiliationForApplication: rewrite to use new GetAffiliatedIds service
- CheckRequiredScopes: fix redirectTo() return type; extract render() as separate action
- HandleInertiaRequests: update SidebarEntries call to getFilteredEntries()
- Add LoginController and LogoutController (new dedicated auth controllers)
- GetAffiliatedIds: new service wrapping CanUserService for permission-based ID resolution
- SidebarEntries: refactor filter() → getFilteredEntries(), extract SidebarPermissionChecker
- SidebarPermissionChecker: new dedicated permission checker for sidebar visibility
- WebServiceProvider: remove deleted middleware imports, apply Pint formatting
- routes/: add login/logout named routes, apply CheckAuthorization middleware throughout,
remove references to deleted middleware classes
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
# Conflicts:
# routes/Routes/Character/Assets.php
# routes/Routes/Character/Contact.php
# routes/Routes/Character/Contract.php
# routes/Routes/Character/CorporationHistory.php
# routes/Routes/Character/Mails.php
# routes/Routes/Character/Skills.php
# routes/Routes/Character/Wallet.php
# routes/Routes/Corporation/MemberCompliance.php
# routes/Routes/Corporation/Wallet.php
# routes/routes.php
# src/Http/Controllers/Auth/LoginController.php
# src/Http/Controllers/Auth/LogoutController.php
# src/Http/Middleware/Authenticate.php
# src/Http/Middleware/CheckACLPermission.php
# src/Http/Middleware/CheckAffiliationForApplication.php
# src/Http/Middleware/CheckRequiredScopes.php
# src/Http/Middleware/Locale.php
# src/Services/GetAffiliatedIds.php
# src/Services/Sidebar/SidebarEntries.php
# src/Services/Sidebar/SidebarPermissionChecker.php
# src/WebServiceProvider.php
herpaderpaldent
force-pushed
the
web/refactor/middleware
branch
from
Summary
Removes dead pipeline-based middleware inherited from the old affiliation system and tidies up authentication routing. ACL sub-routes and moderation middleware are intentionally out of scope — they will be replaced wholesale in the upcoming Control Groups Overhaul (Phase 1.5-J) together with the new typed controllers and UI.
Changes
Deleted (dead pipeline middleware)
CheckContactsAndAffiliation— superseded byCheckAuthorizationin the auth packageCheckPermissionAndAffiliation— superseded byCheckAuthorizationin the auth packageCheckACLPermission— no longer needed; ACL routes will be re-gated via DI in Phase 1.5-JUpdated
Authenticate— fix redirect to useloginnamed route (L11 convention)WebServiceProvider— deregister removed middleware aliasesroutes/routes.php— remove stale middleware references from non-ACL routesroutes/Routes/Corporation/Wallet.php— clean up stale commentLoginController/LogoutController— align with L11 conventionsTest
RouteTest— update access control route assertions to reflect the middleware removalWhat is intentionally NOT in this PR
CheckAffiliationForApplicationetc.)CheckAuthorizationintegration on ACL routesTesting
composer run testpasses locally — 184 tests, PHPStan clean, 100% type coverage.