create-nevela 0.4.2 → 0.5.0

package/template/laravel/src/Generator/ResourceGenerator.php

@@ -806,34 +806,35 @@ final class ResourceGenerator
         /**
          * Who may do what with {$d->pluralLabel}. Generated once — this file is yours.
          *
-         * Default: any signed-in user (routes already require auth:sanctum). Tighten this
-         * before production, e.g. `return in_array(\$user->role, ['admin', 'staff']);`.
+         * Each action asks for a permission, which a person has through their roles
+         * (the dashboard's Roles screen). Add your own conditions beside them, e.g.
+         * `return \$user->can('{$d->table}.edit') && \${$var}->user_id === \$user->id;`.
          */
         class {$d->name}Policy
         {
             public function viewAny(User \$user): bool
             {
-                return true;
+                return \$user->can('{$d->table}.view');
             }
 
             public function view(User \$user, {$d->name} \${$var}): bool
             {
-                return true;
+                return \$user->can('{$d->table}.view');
             }
 
             public function create(User \$user): bool
             {
-                return true;
+                return \$user->can('{$d->table}.create');
             }
 
             public function update(User \$user, {$d->name} \${$var}): bool
             {
-                return true;
+                return \$user->can('{$d->table}.edit');
             }
 
             public function delete(User \$user, {$d->name} \${$var}): bool
             {
-                return true;
+                return \$user->can('{$d->table}.delete');
             }
         }
 

package/template/laravel/src/Http/Access/RolesAreSetUp.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace Nevela\Laravel\Http\Access;
+
+use Closure;
+use Illuminate\Http\Request;
+use Nevela\Laravel\Access\Access;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * The users and roles endpoints need tables that an upgraded app doesn't have until it
+ * has run its migrations. Until then they say so, in place of a database error.
+ */
+final class RolesAreSetUp
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (! Access::ready()) {
+            return response()->json(['error' => 'Roles need a migration that has not been run: php nevela migrate', 'code' => 'MIGRATION_NEEDED'], 409);
+        }
+
+        return $next($request);
+    }
+}

package/template/laravel/src/Http/Access/RolesController.php

@@ -0,0 +1,197 @@
+<?php
+
+namespace Nevela\Laravel\Http\Access;
+
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Gate;
+use Illuminate\Validation\Rule;
+use Nevela\Laravel\Access\Access;
+use Nevela\Laravel\Access\Permissions;
+use Nevela\Laravel\Http\Auth\Answers;
+use Nevela\Laravel\Models\Role;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+
+/**
+ * Roles: named sets of grants.
+ *
+ * The same ceiling as for users applies: a role can be given only what its editor holds,
+ * so editing roles is never a way to gain a permission. The ADMIN role always grants
+ * everything, and the three built-in roles keep their names and can't be deleted.
+ */
+final class RolesController
+{
+    use Answers;
+
+    /** GET _nevela/permissions: every permission there is, shaped for the roles screen. */
+    public function catalog(): JsonResponse
+    {
+        Gate::authorize('roles.view');
+
+        return response()->json(['modules' => Permissions::catalog(), 'total' => count(Permissions::keys())]);
+    }
+
+    /** GET _nevela/roles. Open to anyone who manages users too: the user form lists them. */
+    public function index(Request $request): JsonResponse
+    {
+        $user = $request->user();
+        if (! $user->can('roles.view') && ! $user->can('users.view')) {
+            throw new AccessDeniedHttpException("You don't have access to this.");
+        }
+        $counts = DB::table('nevela_role_user')->groupBy('role_id')->selectRaw('role_id, count(*) as users')->pluck('users', 'role_id');
+        $held = Access::grantsFor($user);
+        $roles = Role::query()->orderByDesc('is_system')->orderBy('name')->get();
+
+        return response()->json(['data' => $roles->map(fn (Role $role) => self::present($role, (int) ($counts[$role->id] ?? 0), $held))->all()]);
+    }
+
+    /** GET _nevela/roles/{id} */
+    public function show(Request $request, string $id): JsonResponse
+    {
+        Gate::authorize('roles.view');
+        $role = $this->find($id);
+
+        return response()->json(self::present($role, $this->users($role), Access::grantsFor($request->user())));
+    }
+
+    /** POST _nevela/roles */
+    public function store(Request $request): JsonResponse
+    {
+        Gate::authorize('roles.create');
+        $input = $this->validated($request, null);
+        if ($refused = $this->beyondCaller($request, $input['grants'])) {
+            return $refused;
+        }
+        $role = Role::query()->create(['name' => $input['name'], 'description' => $input['description'] ?? null, 'grants' => $input['grants'], 'is_system' => false]);
+
+        return response()->json(self::present($role, 0, Access::grantsFor($request->user())), 201);
+    }
+
+    /** PATCH _nevela/roles/{id}: any of name, description, grants. */
+    public function update(Request $request, string $id): JsonResponse
+    {
+        Gate::authorize('roles.edit');
+        $role = $this->find($id);
+        $input = $this->validated($request, $role);
+        $held = Access::grantsFor($request->user());
+
+        // A role that already allows more than its editor holds is not theirs to reshape.
+        if (Permissions::beyond($held, $role->grants) !== []) {
+            return $this->refuse('BEYOND_YOUR_OWN', "You can't change the {$role->name} role: it allows things your own roles don't.", 403);
+        }
+        if ($role->is_system && isset($input['name']) && $input['name'] !== $role->name) {
+            return $this->refuse('BUILT_IN', "The {$role->name} role is built in. It can be edited, and not renamed.", 409);
+        }
+        if (array_key_exists('grants', $input)) {
+            if ($role->name === Role::ADMIN && $role->is_system && ! in_array('*', $input['grants'], true)) {
+                return $this->refuse('BUILT_IN', 'The ADMIN role always allows everything. Make another role for less.', 409);
+            }
+            if ($refused = $this->beyondCaller($request, $input['grants'])) {
+                return $refused;
+            }
+        }
+
+        $role->fill(array_intersect_key($input, array_flip(['name', 'description', 'grants'])))->save();
+        Access::forget();
+
+        return response()->json(self::present($role, $this->users($role), $held));
+    }
+
+    /** DELETE _nevela/roles/{id} */
+    public function destroy(Request $request, string $id): JsonResponse|Response
+    {
+        Gate::authorize('roles.delete');
+        $role = $this->find($id);
+        if ($role->is_system) {
+            return $this->refuse('BUILT_IN', "The {$role->name} role is built in and can't be deleted.", 409);
+        }
+        if (Permissions::beyond(Access::grantsFor($request->user()), $role->grants) !== []) {
+            return $this->refuse('BEYOND_YOUR_OWN', "You can't delete the {$role->name} role: it allows things your own roles don't.", 403);
+        }
+        // Deleting it would quietly take its permissions from everyone who holds it.
+        if (($users = $this->users($role)) > 0) {
+            return $this->refuse('IN_USE', $users === 1 ? 'One user has this role. Give them another before deleting it.' : "{$users} users have this role. Give them another before deleting it.", 409);
+        }
+        $role->delete();
+        Access::forget();
+
+        return response()->noContent();
+    }
+
+    private function find(string $id): Role
+    {
+        return Role::query()->find($id) ?? throw new NotFoundHttpException('No such role.');
+    }
+
+    private function users(Role $role): int
+    {
+        return DB::table('nevela_role_user')->where('role_id', $role->id)->count();
+    }
+
+    /** @return array{name?: string, description?: string|null, grants?: list<string>} */
+    private function validated(Request $request, ?Role $role): array
+    {
+        $sometimes = $role ? ['sometimes'] : [];
+        $input = $request->validate([
+            'name' => [...$sometimes, 'required', 'string', 'min:2', 'max:80', 'regex:/^[\pL\pN][\pL\pN _-]*$/u', function (string $attribute, mixed $value, \Closure $fail) use ($role) {
+                // "Support" and "support" would be two roles nobody could tell apart.
+                $taken = Role::query()->whereRaw('lower(name) = ?', [mb_strtolower((string) $value)])->when($role, fn ($query) => $query->where('id', '!=', $role->id))->exists();
+                if ($taken) {
+                    $fail('There is already a role with this name.');
+                }
+            }],
+            'description' => ['sometimes', 'nullable', 'string', 'max:500'],
+            'grants' => [...$sometimes, 'present', 'array', 'max:2000'],
+            // bail: what follows reads the value as text, which a list sent in its place is not.
+            'grants.*' => ['bail', 'string', 'max:120', function (string $attribute, mixed $value, \Closure $fail) {
+                if (! is_string($value) || ! Permissions::understood($value)) {
+                    $fail(is_string($value) ? "\"{$value}\" isn't a permission this app has." : 'A grant is a piece of text.');
+                }
+            }],
+        ], ['name.regex' => 'Use letters, numbers, spaces, dashes and underscores.']);
+        if (isset($input['grants'])) {
+            $input['grants'] = array_values(array_unique($input['grants']));
+        }
+
+        return $input;
+    }
+
+    /** @param list<string> $grants */
+    private function beyondCaller(Request $request, array $grants): ?JsonResponse
+    {
+        $beyond = Permissions::beyond(Access::grantsFor($request->user()), $grants);
+        if ($beyond === []) {
+            return null;
+        }
+
+        return response()->json([
+            'error' => "A role can't allow more than you hold yourself: ".implode(', ', array_slice($beyond, 0, 6)).(count($beyond) > 6 ? ', and '.(count($beyond) - 6).' more' : '').'.',
+            'code' => 'BEYOND_YOUR_OWN',
+            'beyond' => $beyond,
+        ], 403);
+    }
+
+    /**
+     * @param  list<string>  $held  The grants of whoever is asking
+     * @return array<string, mixed>
+     */
+    public static function present(Role $role, int $users, array $held): array
+    {
+        return [
+            'id' => $role->id,
+            'name' => $role->name,
+            'description' => $role->description,
+            // As written, patterns included, and what they come to today.
+            'grants' => $role->grants,
+            'permissions' => Permissions::expand($role->grants),
+            'isSystem' => (bool) $role->is_system,
+            'isAdmin' => Permissions::hasAll($role->grants),
+            'users' => $users,
+            // Whether whoever is asking may give this role to someone, or change it.
+            'withinYours' => Permissions::beyond($held, $role->grants) === [],
+        ];
+    }
+}

package/template/laravel/src/Http/Access/UsersController.php

@@ -0,0 +1,382 @@
+<?php
+
+namespace Nevela\Laravel\Http\Access;
+
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Gate;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Validation\Rule;
+use Nevela\Laravel\Access\Access;
+use Nevela\Laravel\Access\Permissions;
+use Nevela\Laravel\Auth\Account;
+use Nevela\Laravel\Auth\AuthMail;
+use Nevela\Laravel\Http\Auth\Answers;
+use Nevela\Laravel\Media\Uploads;
+use Nevela\Laravel\Models\Role;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+
+/**
+ * The people who can sign in, for someone allowed to manage them.
+ *
+ * Three rules sit on top of the permissions (users.view, .create, .edit, .delete), so that
+ * managing users is never a way to take more than you were given:
+ *
+ *   - you hand out only roles whose grants you hold yourself;
+ *   - you change only accounts that may do no more than you. Otherwise setting someone's
+ *     password, or their email and then asking for a reset, would be a way to sign in as
+ *     them and have what they have;
+ *   - the last administrator can't be removed, switched off or demoted, by anyone.
+ */
+final class UsersController
+{
+    use Answers;
+
+    /** GET _nevela/users?q=&role=&status=&page=&perPage= */
+    public function index(Request $request): JsonResponse
+    {
+        Gate::authorize('users.view');
+        $input = $request->validate([
+            'q' => ['nullable', 'string', 'max:200'],
+            'role' => ['nullable', 'string', 'max:64'],
+            'status' => ['nullable', Rule::in(['active', 'inactive'])],
+            'page' => ['nullable', 'integer', 'min:1'],
+            'perPage' => ['nullable', 'integer', 'min:1', 'max:100'],
+        ]);
+        $model = Account::model();
+        $instance = new $model;
+        $query = $model::query();
+
+        if (($search = trim((string) ($input['q'] ?? ''))) !== '') {
+            $pattern = '%'.str_replace(['\\', '%', '_'], ['\\\\', '\\%', '\\_'], mb_strtolower($search)).'%';
+            $query->where(fn ($where) => $where->whereRaw('lower(name) like ?', [$pattern])->orWhereRaw('lower(email) like ?', [$pattern]));
+        }
+        if (! empty($input['role'])) {
+            // Read as a list first: the link table keeps ids as text, whatever type they are here.
+            $query->whereIn($instance->getKeyName(), DB::table('nevela_role_user')->where('role_id', $input['role'])->pluck('user_id')->all());
+        }
+        if (isset($input['status']) && Schema::hasColumn($instance->getTable(), 'active')) {
+            $query->where('active', $input['status'] === 'active');
+        }
+
+        $perPage = (int) ($input['perPage'] ?? 25);
+        $page = (int) ($input['page'] ?? 1);
+        $total = (clone $query)->count();
+        $users = $query->orderBy('name')->orderBy($instance->getKeyName())->forPage($page, $perPage)->get();
+
+        return response()->json([
+            'data' => self::present($users, $request->user()),
+            'meta' => ['page' => $page, 'perPage' => $perPage, 'total' => $total, 'totalPages' => max(1, (int) ceil($total / $perPage))],
+        ]);
+    }
+
+    /** GET _nevela/users/{id} */
+    public function show(Request $request, string $id): JsonResponse
+    {
+        Gate::authorize('users.view');
+
+        return response()->json(self::present(collect([$this->find($id)]), $request->user())[0]);
+    }
+
+    /** POST _nevela/users */
+    public function store(Request $request): JsonResponse
+    {
+        Gate::authorize('users.create');
+        $model = Account::model();
+        $user = new $model;
+        $input = $request->validate([
+            'name' => ['required', 'string', 'max:255'],
+            'email' => ['required', 'email', 'max:255'],
+            'password' => Account::passwordRules(),
+            'roles' => ['present', 'array', 'max:50'],
+            'roles.*' => ['string', 'max:64'],
+            'active' => ['nullable', 'boolean'],
+        ]);
+        if (Account::findByEmail($input['email'])) {
+            return response()->json(['error' => 'Validation failed.', 'issues' => [['path' => 'email', 'message' => 'Someone already has this email.']]], 422);
+        }
+        $roles = $this->roles($input['roles']);
+        if ($roles instanceof JsonResponse) {
+            return $roles;
+        }
+        if ($refused = $this->beyondCaller($request, $roles)) {
+            return $refused;
+        }
+
+        $attributes = ['name' => $input['name'], 'email' => mb_strtolower(trim($input['email'])), 'password' => Hash::make($input['password'])];
+        if (Schema::hasColumn($user->getTable(), 'active')) {
+            $attributes['active'] = (bool) ($input['active'] ?? true);
+        }
+        if (Schema::hasColumn($user->getTable(), 'email_verified_at')) {
+            // Someone allowed to create users vouches for the address.
+            $attributes['email_verified_at'] = now();
+        }
+        $user->forceFill($attributes)->save();
+        Access::assign($user, $roles->pluck('id')->all());
+
+        return response()->json(self::present(collect([$user]), $request->user())[0], 201);
+    }
+
+    /** PATCH _nevela/users/{id}: any of name, email, password, roles, active. */
+    public function update(Request $request, string $id): JsonResponse
+    {
+        Gate::authorize('users.edit');
+        $user = $this->find($id);
+        $caller = $request->user();
+        $self = (string) $caller->getAuthIdentifier() === (string) $user->getAuthIdentifier();
+        $input = $request->validate([
+            'name' => ['sometimes', 'required', 'string', 'max:255'],
+            'email' => ['sometimes', 'required', 'email', 'max:255'],
+            'password' => ['sometimes', ...Account::passwordRules()],
+            'roles' => ['sometimes', 'array', 'max:50'],
+            'roles.*' => ['string', 'max:64'],
+            'active' => ['sometimes', 'boolean'],
+        ]);
+
+        $wasAdmin = $this->holdsEverything($user);
+        if (! $self && ($refused = $this->aboveCaller($caller, $user, 'change'))) {
+            return $refused;
+        }
+        if (isset($input['email'])) {
+            $taken = Account::findByEmail($input['email']);
+            if ($taken && (string) $taken->getAuthIdentifier() !== (string) $user->getAuthIdentifier()) {
+                return response()->json(['error' => 'Validation failed.', 'issues' => [['path' => 'email', 'message' => 'Someone already has this email.']]], 422);
+            }
+        }
+
+        $roles = null;
+        if (array_key_exists('roles', $input)) {
+            $roles = $this->roles($input['roles']);
+            if ($roles instanceof JsonResponse) {
+                return $roles;
+            }
+            // Only what is being added is checked: a role they already hold isn't being handed out.
+            $held = Access::rolesOf($user)->pluck('id')->all();
+            if ($refused = $this->beyondCaller($request, $roles->reject(fn (Role $role) => in_array($role->id, $held, true)))) {
+                return $refused;
+            }
+        }
+
+        $deactivating = array_key_exists('active', $input) && ! $input['active'] && Access::active($user);
+        if ($deactivating && $self) {
+            return $this->refuse('SELF', "You can't switch your own account off. Ask another administrator.", 409);
+        }
+        $demoting = $roles !== null && $wasAdmin && ! $roles->contains(fn (Role $role) => Permissions::hasAll($role->grants));
+        if (($deactivating || $demoting) && $wasAdmin && Access::active($user) && Access::otherAdmins($user) === 0) {
+            return $this->refuse('LAST_ADMIN', 'This is the only administrator. Make someone else an administrator first.', 409);
+        }
+
+        $attributes = [];
+        if (isset($input['name'])) {
+            $attributes['name'] = $input['name'];
+        }
+        if (isset($input['email'])) {
+            $attributes['email'] = mb_strtolower(trim($input['email']));
+        }
+        if (isset($input['password'])) {
+            $attributes['password'] = Hash::make($input['password']);
+        }
+        if (array_key_exists('active', $input) && Schema::hasColumn($user->getTable(), 'active')) {
+            $attributes['active'] = (bool) $input['active'];
+        }
+        if ($attributes !== []) {
+            $user->forceFill($attributes)->save();
+        }
+        if ($roles !== null) {
+            Access::assign($user, $roles->pluck('id')->all());
+        }
+
+        // A new password or a switched-off account ends every session it had. Their own
+        // session survives their own password change, as it does on the account page.
+        if ($deactivating || isset($input['password'])) {
+            Account::revokeTokens($user, $self ? $caller->currentAccessToken()?->getKey() : null);
+        }
+        if (isset($input['password']) && ! $self) {
+            AuthMail::send($user->email, 'Your '.AuthMail::app().' password was changed', ['An administrator set a new password for your account.', "If you weren't expecting this, ask them about it before signing in."]);
+        }
+        Access::forget();
+
+        return response()->json(self::present(collect([$user->refresh()]), $caller)[0]);
+    }
+
+    /** DELETE _nevela/users/{id} */
+    public function destroy(Request $request, string $id): JsonResponse|Response
+    {
+        Gate::authorize('users.delete');
+        $user = $this->find($id);
+        $caller = $request->user();
+        if ((string) $caller->getAuthIdentifier() === (string) $user->getAuthIdentifier()) {
+            return $this->refuse('SELF', "You can't delete your own account here.", 409);
+        }
+        if ($refused = $this->aboveCaller($caller, $user, 'delete')) {
+            return $refused;
+        }
+        if ($this->holdsEverything($user) && Access::active($user) && Access::otherAdmins($user) === 0) {
+            return $this->refuse('LAST_ADMIN', 'This is the only administrator. Make someone else an administrator first.', 409);
+        }
+
+        $key = (string) $user->getAuthIdentifier();
+        DB::transaction(function () use ($user, $key) {
+            Account::revokeTokens($user);
+            DB::table('nevela_role_user')->where('user_id', $key)->delete();
+            foreach (['nevela_two_factor', 'nevela_passkeys'] as $table) {
+                if (Schema::hasTable($table)) {
+                    DB::table($table)->where('user_id', $key)->delete();
+                }
+            }
+            $user->delete();
+        });
+        Access::forget();
+
+        return response()->noContent();
+    }
+
+    /** DELETE _nevela/users/{id}/sessions: sign them out of every device. */
+    public function revokeSessions(Request $request, string $id): JsonResponse
+    {
+        Gate::authorize('users.edit');
+        $user = $this->find($id);
+        $self = (string) $request->user()->getAuthIdentifier() === (string) $user->getAuthIdentifier();
+        if (! $self && ($refused = $this->aboveCaller($request->user(), $user, 'sign out'))) {
+            return $refused;
+        }
+
+        return response()->json(['revoked' => Account::revokeTokens($user, $self ? $request->user()->currentAccessToken()?->getKey() : null)]);
+    }
+
+    private function find(string $id): mixed
+    {
+        return Account::model()::query()->find($id) ?? throw new NotFoundHttpException('No such user.');
+    }
+
+    /**
+     * A refusal when the account may do something the caller may not, and null otherwise.
+     *
+     * What the account may do is read from its roles, not from whether it is switched on:
+     * a switched-off administrator is still not for a lesser manager to give a new
+     * password and switch back on.
+     */
+    private function aboveCaller(mixed $caller, mixed $user, string $verb): ?JsonResponse
+    {
+        if (self::within(Access::grantsFor($caller), $user)) {
+            return null;
+        }
+
+        return $this->holdsEverything($user)
+            ? $this->refuse('ADMIN_ONLY', "Only an administrator can {$verb} an administrator's account.", 403)
+            : $this->refuse('ABOVE_YOUR_OWN', "You can't {$verb} this account: it may do things your own roles don't allow.", 403);
+    }
+
+    /**
+     * Whether everything an account's roles allow is covered by `$held`.
+     *
+     * @param  list<string>  $held
+     * @param  iterable<Role>|null  $roles  The account's roles, when they are already at hand
+     */
+    private static function within(array $held, mixed $user, ?iterable $roles = null): bool
+    {
+        $theirs = [];
+        foreach ($roles ?? Access::rolesOf($user) as $role) {
+            array_push($theirs, ...$role->grants);
+        }
+
+        return Permissions::beyond($held, $theirs) === [];
+    }
+
+    /** Whether this account holds a role that comes to everything. */
+    private function holdsEverything(mixed $user): bool
+    {
+        return Access::rolesOf($user)->contains(fn (Role $role) => Permissions::hasAll($role->grants));
+    }
+
+    /**
+     * The roles named by id, or a 422 when one doesn't exist.
+     *
+     * @param  list<string>  $ids
+     * @return Collection<int, Role>|JsonResponse
+     */
+    private function roles(array $ids): Collection|JsonResponse
+    {
+        $ids = array_values(array_unique($ids));
+        $roles = Role::query()->whereIn('id', $ids)->get();
+        if ($roles->count() !== count($ids)) {
+            return response()->json(['error' => 'Validation failed.', 'issues' => [['path' => 'roles', 'message' => 'One of those roles no longer exists. Reload and try again.']]], 422);
+        }
+
+        return $roles;
+    }
+
+    /** @param Collection<int, Role> $roles */
+    private function beyondCaller(Request $request, Collection $roles): ?JsonResponse
+    {
+        $held = Access::grantsFor($request->user());
+        foreach ($roles as $role) {
+            if (Permissions::beyond($held, $role->grants) !== []) {
+                return $this->refuse('BEYOND_YOUR_OWN', "You can't give someone the {$role->name} role: it allows things your own roles don't.", 403);
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * Users as the dashboard shows them, with what a list needs asked for once and not per row.
+     *
+     * @param  Collection<int, mixed>  $users
+     * @return list<array<string, mixed>>
+     */
+    public static function present(Collection $users, mixed $caller): array
+    {
+        $ids = $users->map(fn ($user) => (string) $user->getAuthIdentifier())->all();
+        if ($ids === []) {
+            return [];
+        }
+        $roles = Role::query()->get()->keyBy('id');
+        $held = [];
+        foreach (DB::table('nevela_role_user')->whereIn('user_id', $ids)->get() as $link) {
+            if ($role = $roles->get($link->role_id)) {
+                $held[$link->user_id][] = $role;
+            }
+        }
+        $secondStep = Schema::hasTable('nevela_two_factor')
+            ? DB::table('nevela_two_factor')->whereIn('user_id', $ids)->whereNotNull('enabled_at')->pluck('user_id')->flip()
+            : collect();
+        $first = $users->first();
+        $devices = DB::table('personal_access_tokens')
+            ->where('tokenable_type', $first->getMorphClass())->whereIn('tokenable_id', $ids)
+            ->groupBy('tokenable_id')->selectRaw('tokenable_id, count(*) as devices, max(last_used_at) as last_used_at')
+            ->get()->keyBy(fn ($row) => (string) $row->tokenable_id);
+
+        $callerGrants = Access::grantsFor($caller);
+
+        return $users->map(function ($user) use ($held, $secondStep, $devices, $caller, $callerGrants) {
+            $id = (string) $user->getAuthIdentifier();
+            $mine = collect($held[$id] ?? [])->sortBy('name')->values();
+            $avatar = $user->avatar ?? null;
+            $file = is_string($avatar) && $avatar !== '' ? Uploads::ref($avatar) : null;
+            $seen = $devices->get($id);
+
+            return [
+                'id' => $id,
+                'name' => $user->name ?? null,
+                'email' => $user->email ?? null,
+                'active' => Access::active($user),
+                'emailVerified' => ($user->email_verified_at ?? null) !== null,
+                'twoFactorEnabled' => $secondStep->has($id),
+                'image' => $file ? ($file['renditions']->thumb['url'] ?? $file['url']) : null,
+                'roles' => $mine->map(fn (Role $role) => ['id' => $role->id, 'name' => $role->name])->all(),
+                'isAdmin' => $mine->contains(fn (Role $role) => Permissions::hasAll($role->grants)),
+                'isSelf' => $id === (string) $caller->getAuthIdentifier(),
+                // Whether whoever is asking may change this account: it may do no more than they may.
+                'withinYours' => self::within($callerGrants, $user, $mine),
+                'devices' => (int) ($seen->devices ?? 0),
+                'lastActiveAt' => ! empty($seen?->last_used_at) ? date(DATE_ATOM, strtotime($seen->last_used_at)) : null,
+                'createdAt' => $user->created_at?->toAtomString(),
+            ];
+        })->all();
+    }
+}

package/template/laravel/src/Http/Auth/AccountController.php

@@ -8,6 +8,7 @@ use Illuminate\Http\Response;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Schema;
+use Nevela\Laravel\Access\Access;
 use Nevela\Laravel\Auth\Account;
 use Nevela\Laravel\Auth\AuthMail;
 use Nevela\Laravel\Auth\Challenges;
@@ -46,11 +47,14 @@ final class AccountController
 
         $user = new $model;
         $attributes = ['name' => $input['name'], 'email' => mb_strtolower(trim($input['email'])), 'password' => Hash::make($input['password'])];
-        $role = config('nevela.auth.default_role');
+        $role = config('nevela.auth.default_role', 'USER');
         if ($role !== null && Schema::hasColumn($user->getTable(), 'role')) {
             $attributes['role'] = $role;
         }
         $user->forceFill($attributes)->save();
+        if (is_string($role) && $role !== '') {
+            Access::grant($user, $role);
+        }
         self::sendVerification($user, $request);
 
         if (config('nevela.auth.require_email_verification', false)) {