Let User reach the Filament panel outside local - #8
Merged
Merged
Conversation
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Filament's Authenticate middleware aborts 403 for any user model that
does not implement FilamentUser once app.env is not "local":
abort_if(
$user instanceof FilamentUser
? (! $user->canAccessPanel($panel))
: (config('app.env') !== 'local'),
403,
);
So a deployed Super Stack served /admin a bare 403 to every user, with
nothing on screen explaining why. User now implements the contract and
returns true, which matches a kit that ships no public registration:
every row in the users table is one you created on purpose.
The admin dashboard test no longer forces app.env to "local" to pass,
and a second test pins the behaviour under "production" so the 403
cannot come back unnoticed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
shanerbaner82
force-pushed
the
fix/filament-user-panel-access
branch
from
September 20, 2026 20:14
4d1f3da to
9436158
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #3 — it edits the
AdminPanelTest.phpthat #3 adds, so merge #3 first and this diff reduces to one commit.The problem
Filament\Http\Middleware\Authenticate(filament/filament 5.8.4, line 36) aborts 403 for any user model that doesn't implementFilamentUser, as soon asapp.envisn'tlocal:App\Models\Userdidn't implement it. So the kit works on your machine and then serves a bare 403 at/adminto every user once it's deployed, with nothing on screen saying why. #3 ran into this — its dashboard test has to setconfig(['app.env' => 'local'])to get a 200.The change
UserimplementsFilamentUserand returnstrue. That's the right default for this kit specifically: there's no public registration, the panel is configured with->login()and not->registration(), so every row inusersis one you created deliberately. The docblock says to tighten it before opening sign-ups.AdminPanelTestdrops theapp.envworkaround, and a new test pins the behaviour underproductionso the 403 can't come back unnoticed.Verified
Reverting just the model change fails both dashboard tests with
Expected response status code [200] but received 403. With the change,php artisan testis 7/7 on this branch and 15/15 with #1, #2, #4 and #6 merged alongside.vendor/bin/pint --testpasses.🤖 Generated with Claude Code