Add toggle for externally managed users

Open Boy132 opened this issue 2 months ago • 1 comments

Closes #1728

Oct 23 '25 07:10 Boy132

📝 Walkthrough

Walkthrough

Adds a boolean User.is_managed_externally flag (model, migration, factory, transformer), surfaces the flag in Filament admin/profile UIs, groups customization fields into a Section, conditions API authorization and client profile form fields on the flag, and updates tests and translations to include it.

Changes

Cohort / File(s)	Summary
Database Migration `database/migrations/2025_10_23_073209_add_is_managed_externally_to_users.php`	Adds boolean `is_managed_externally` column to `users` (default false) and a down() to drop it.
User Model `app/Models/User.php`	Adds PHPDoc property, includes `is_managed_externally` in `$fillable`, default `$attributes`, `$validationRules`, and `$casts` as boolean.
Factory & Transformer `database/factories/UserFactory.php`, `app/Transformers/Api/Application/UserTransformer.php`	Factory sets `is_managed_externally => false`; transformer adds `is_managed_externally` to API output.
Filament Admin Resource(s) `app/Filament/Admin/Resources/Users/UserResource.php`, `app/Filament/Pages/Auth/EditProfile.php`	Adds `is_managed_externally` Toggle to account area; groups `timezone`, `language`, and `avatar` into a full-width two-column "Customization" Section; EditProfile disables/hides username/email/password when externally managed.
API Request Validation & Authorization `app/Http/Requests/Api/Application/Users/StoreUserRequest.php`, `app/Http/Requests/Api/Client/Account/UpdateEmailRequest.php`, `app/Http/Requests/Api/Client/Account/UpdatePasswordRequest.php`, `app/Http/Requests/Api/Client/Account/UpdateUsernameRequest.php`	Store request allows `is_managed_externally`; client update requests run password validation but `authorize()` now denies final authorization when `is_managed_externally` is true.
Localization `lang/en/admin/user.php`	Adds `is_managed_externally` label and `is_managed_externally_helper` helper text.
Tests `tests/Integration/Api/Application/Users/ExternalUserControllerTest.php`, `tests/Integration/Api/Application/Users/UserControllerTest.php`	Updated expected JSON structures and assertions to include `is_managed_externally`.

Sequence Diagram(s)

sequenceDiagram
    participant Client as Client/UI
    participant Filament as Filament Admin/Profile UI
    participant API as Backend API
    participant DB as Database

    Client->>Filament: Submit profile/email/password update
    Filament->>API: Send request
    API->>DB: Load user (includes is_managed_externally)
    DB-->>API: user { is_managed_externally }

    alt is_managed_externally == true
        Note over API: Password check still runs\nbut final authorization denied
        API->>API: Validate password (may throw)
        API-->>Filament: 403 Authorization denied
        Filament-->>Client: Show disabled fields / error
    else is_managed_externally == false
        API->>API: Authorize & validate
        API->>DB: Persist changes
        DB-->>API: Success
        API-->>Filament: 200 Updated
        Filament-->>Client: Confirm changes
    end

Possibly related PRs

pelican-dev/panel#1779: Modifies the same Filament admin/profile UI and related user fields (UserResource, EditProfile), touching related form layout and external-management logic.

Pre-merge checks

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	You can run `@coderabbitai generate docstrings` to improve docstring coverage.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically summarizes the main change: introducing a toggle mechanism for managing externally-controlled user accounts.
Description check	✅ Passed	The description references the linked issue #1728 and includes visual demonstration images, providing sufficient context for the changeset's purpose.
Linked Issues check	✅ Passed	The PR fully implements the requirement to add a toggle for administrators to control whether externally-managed users can edit their own profiles.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to implementing the externally-managed user toggle feature; no unrelated modifications are present.

[!TIP]

📝 Customizable high-level summaries are now available in beta!

You can now customize how CodeRabbit generates the high-level summary in your pull requests — including its content, structure, tone, and formatting.

Provide your own instructions using the high_level_summary_instructions setting.

Format the summary however you like (bullet lists, tables, multi-section layouts, contributor stats, etc.).

Use high_level_summary_in_walkthrough to move the summary from the description to the walkthrough section.

Example instruction:

"Divide the high-level summary into five sections:

📝 Description — Summarize the main change in 50–60 words, explaining what was done.

📓 References — List relevant issues, discussions, documentation, or related PRs.

📦 Dependencies & Requirements — Mention any new/updated dependencies, environment variable changes, or configuration updates.

📊 Contributor Summary — Include a Markdown table showing contributions: | Contributor | Lines Added | Lines Removed | Files Changed |

✔️ Additional Notes — Add any extra reviewer context. Keep each section concise (under 200 words) and use bullet or numbered lists for clarity."

Note: This feature is currently in beta for Pro-tier users, and pricing will be announced later.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Oct 23 '25 07:10 coderabbitai[bot]