Skip to content

Let User reach the Filament panel outside local - #8

Merged
shanerbaner82 merged 1 commit into
mainfrom
fix/filament-user-panel-access
Sep 20, 2026
Merged

shanerbaner82 merged 1 commit into
mainfrom
fix/filament-user-panel-access

Conversation

@shanerbaner82

Copy link
Copy Markdown
Contributor

Stacked on #3 — it edits the AdminPanelTest.php that #3 adds, so merge #3 first and this diff reduces to one commit.

The problem

Filament\Http\Middleware\Authenticate (filament/filament 5.8.4, line 36) aborts 403 for any user model that doesn't implement FilamentUser, as soon as app.env isn't local:

abort_if(
    $user instanceof FilamentUser
        ? (! $user->canAccessPanel($panel))
        : (config('app.env') !== 'local'),
    403,
);

App\Models\User didn't implement it. So the kit works on your machine and then serves a bare 403 at /admin to every user once it's deployed, with nothing on screen saying why. #3 ran into this — its dashboard test has to set config(['app.env' => 'local']) to get a 200.

The change

User implements FilamentUser and returns true. That's the right default for this kit specifically: there's no public registration, the panel is configured with ->login() and not ->registration(), so every row in users is one you created deliberately. The docblock says to tighten it before opening sign-ups.

AdminPanelTest drops the app.env workaround, and a new test pins the behaviour under production so the 403 can't come back unnoticed.

Verified

Reverting just the model change fails both dashboard tests with Expected response status code [200] but received 403. With the change, php artisan test is 7/7 on this branch and 15/15 with #1, #2, #4 and #6 merged alongside. vendor/bin/pint --test passes.

🤖 Generated with Claude Code

@coderabbitai

coderabbitai Bot commented Sep 20, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: fe2bee1b-20f2-4bce-944c-4a6984006807

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Comment @coderabbitai help to get the list of available commands.

Filament's Authenticate middleware aborts 403 for any user model that
does not implement FilamentUser once app.env is not "local":

    abort_if(
        $user instanceof FilamentUser
            ? (! $user->canAccessPanel($panel))
            : (config('app.env') !== 'local'),
        403,
    );

So a deployed Super Stack served /admin a bare 403 to every user, with
nothing on screen explaining why. User now implements the contract and
returns true, which matches a kit that ships no public registration:
every row in the users table is one you created on purpose.

The admin dashboard test no longer forces app.env to "local" to pass,
and a second test pins the behaviour under "production" so the 403
cannot come back unnoticed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@shanerbaner82
shanerbaner82 force-pushed the fix/filament-user-panel-access branch from 4d1f3da to 9436158 Compare September 20, 2026 20:14
@shanerbaner82
shanerbaner82 merged commit 7c66548 into main Sep 20, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant