Merge remote-tracking branch 'origin/6.x' into frontend-two-factor

jasonvarga · jasonvarga · commit 18103b329f2f · 2026-04-21T14:29:04.000-04:00
diff --git a/config/users.php b/config/users.php
@@ -176,12 +176,15 @@
     | Users may be required to reauthorize before performing certain
     | sensitive actions. This is called an elevated session. Here
     | you may configure the duration of the session in minutes.
+    | You may also disable the elevated session entirely.
     |
     */
 
+    'elevated_sessions_enabled' => env('STATAMIC_ELEVATED_SESSIONS_ENABLED', true),
+
     'elevated_session_duration' => 15,
 
-    'elevated_session_url' => null,
+    'elevated_sessions_url' => null,
 
     /*
     |--------------------------------------------------------------------------
diff --git a/resources/js/components/elevated-sessions/index.js b/resources/js/components/elevated-sessions/index.js
@@ -1,6 +1,8 @@
 import axios from 'axios';
 
 export async function requireElevatedSession() {
+    if (!Statamic.$config.get('elevatedSessionsEnabled')) return;
+
     const response = await axios.get(cp_url('elevated-session'));
 
     if (response.data.elevated) return;
diff --git a/routes/cp.php b/routes/cp.php
@@ -443,11 +443,13 @@
 
     Route::get('session-timeout', SessionTimeoutController::class)->name('session.timeout');
 
-    Route::get('auth/confirm-password', [ElevatedSessionController::class, 'showForm'])->name('confirm-password');
-    Route::get('elevated-session', [ElevatedSessionController::class, 'status'])->name('elevated-session.status');
-    Route::get('elevated-session/passkey-options', [ElevatedSessionController::class, 'options'])->name('elevated-session.passkey-options')->middleware('throttle:statamic.cp.passkeys');
-    Route::post('elevated-session', [ElevatedSessionController::class, 'confirm'])->name('elevated-session.confirm')->middleware('throttle:statamic.cp.auth');
-    Route::get('elevated-session/resend-code', [ElevatedSessionController::class, 'resendCode'])->name('elevated-session.resend-code')->middleware('throttle:send-elevated-session-code');
+    if (config('statamic.users.elevated_sessions_enabled')) {
+        Route::get('auth/confirm-password', [ElevatedSessionController::class, 'showForm'])->name('confirm-password');
+        Route::get('elevated-session', [ElevatedSessionController::class, 'status'])->name('elevated-session.status');
+        Route::get('elevated-session/passkey-options', [ElevatedSessionController::class, 'options'])->name('elevated-session.passkey-options')->middleware('throttle:statamic.cp.passkeys');
+        Route::post('elevated-session', [ElevatedSessionController::class, 'confirm'])->name('elevated-session.confirm')->middleware('throttle:statamic.cp.auth');
+        Route::get('elevated-session/resend-code', [ElevatedSessionController::class, 'resendCode'])->name('elevated-session.resend-code')->middleware('throttle:send-elevated-session-code');
+    }
 
     Route::get('playground', PlaygroundController::class)->name('playground');
 
diff --git a/routes/web.php b/routes/web.php
@@ -55,12 +55,14 @@
             Route::get('password/reset/{token}', [ResetPasswordController::class, 'showResetForm'])->name('password.reset');
             Route::post('password/reset', [ResetPasswordController::class, 'reset'])->middleware('throttle:statamic.auth')->name('password.reset.action');
 
-            Route::middleware('auth')->group(function () {
-                Route::get('confirm-password', [ElevatedSessionController::class, 'showForm'])->name('elevated-session')->middleware([HandleInertiaRequests::class]);
-                Route::post('elevated-session', [ElevatedSessionController::class, 'confirm'])->name('elevated-session.confirm')->middleware('throttle:statamic.auth');
-                Route::get('elevated-session/passkey-options', [ElevatedSessionController::class, 'options'])->name('elevated-session.passkey-options')->middleware('throttle:statamic.passkeys');
-                Route::get('elevated-session/resend-code', [ElevatedSessionController::class, 'resendCode'])->name('elevated-session.resend-code')->middleware('throttle:send-elevated-session-code');
-            });
+            if (config('statamic.users.elevated_sessions_enabled')) {
+                Route::middleware('auth')->group(function () {
+                    Route::get('confirm-password', [ElevatedSessionController::class, 'showForm'])->name('elevated-session')->middleware([HandleInertiaRequests::class]);
+                    Route::post('elevated-session', [ElevatedSessionController::class, 'confirm'])->name('elevated-session.confirm')->middleware('throttle:statamic.auth');
+                    Route::get('elevated-session/passkey-options', [ElevatedSessionController::class, 'options'])->name('elevated-session.passkey-options')->middleware('throttle:statamic.passkeys');
+                    Route::get('elevated-session/resend-code', [ElevatedSessionController::class, 'resendCode'])->name('elevated-session.resend-code')->middleware('throttle:send-elevated-session-code');
+                });
+            }
 
             Route::group(['prefix' => 'passkeys'], function () {
                 Route::middleware('throttle:statamic.passkeys')->group(function () {
diff --git a/src/Auth/Eloquent/User.php b/src/Auth/Eloquent/User.php
@@ -303,7 +303,11 @@ public function remove($key)
 
     public function merge($data)
     {
-        $this->data($this->data()->merge(collect($data)->filter(fn ($v) => $v !== null)->all()));
+        $merged = $this->data()
+            ->except(['roles', 'groups'])
+            ->merge(collect($data)->filter(fn ($v) => $v !== null)->all());
+
+        $this->data($merged->all());
 
         return $this;
     }
diff --git a/src/CP/Navigation/NavBuilder.php b/src/CP/Navigation/NavBuilder.php
@@ -998,7 +998,7 @@ protected function ensureUrlCachesAreUpToDate()
         $updated = collect($this->items)
             ->filter(fn ($item) => collect($this->itemsWithChildrenClosures)->contains($item->id()))
             ->filter(fn ($item) => $item->isActive() || $this->withHidden)
-            ->mapWithKeys(fn ($item) => [$item->id() => $item->children()?->map->url()->all() ?? []])
+            ->mapWithKeys(fn ($item) => [$item->id() => $item->resolveChildren()->children()?->map->url()->all() ?? []])
             ->filter(fn ($urls, $id) => $this->urlsUnresolvedChildren->get($id) != $urls)
             ->each(fn ($urls, $id) => $this->trackChangedChildren($id, $urls))
             ->isNotEmpty();
diff --git a/src/Http/Controllers/Auth/ElevatedSessionController.php b/src/Http/Controllers/Auth/ElevatedSessionController.php
@@ -17,7 +17,7 @@ class ElevatedSessionController extends Controller
 {
     public function showForm(Request $request)
     {
-        if ($customUrl = config('statamic.users.elevated_session_url')) {
+        if ($customUrl = config('statamic.users.elevated_sessions_url')) {
             return redirect()->to($customUrl);
         }
 
diff --git a/src/Http/Controllers/CP/CpController.php b/src/Http/Controllers/CP/CpController.php
@@ -72,7 +72,7 @@ public function authorizeProIf($condition)
 
     public function requireElevatedSession(): void
     {
-        if (! request()->hasElevatedSession()) {
+        if (config('statamic.users.elevated_sessions_enabled') && ! request()->hasElevatedSession()) {
             throw new ElevatedSessionAuthorizationException;
         }
     }
diff --git a/src/Http/Middleware/RequireElevatedSession.php b/src/Http/Middleware/RequireElevatedSession.php
@@ -9,7 +9,7 @@ class RequireElevatedSession
 {
     public function handle($request, Closure $next)
     {
-        if (! $request->hasElevatedSession()) {
+        if (config('statamic.users.elevated_sessions_enabled') && ! $request->hasElevatedSession()) {
             throw new ElevatedSessionAuthorizationException;
         }
 
diff --git a/src/Http/View/Composers/JavascriptComposer.php b/src/Http/View/Composers/JavascriptComposer.php
@@ -64,6 +64,7 @@ private function protectedVariables()
             'ajaxTimeout' => config('statamic.system.ajax_timeout'),
             'googleDocsViewer' => config('statamic.assets.google_docs_viewer'),
             'focalPointEditorEnabled' => config('statamic.assets.focal_point_editor'),
+            'elevatedSessionsEnabled' => config('statamic.users.elevated_sessions_enabled'),
             'user' => $this->user($user),
             'defaultPreferences' => Preference::default()->all(),
             'paginationSize' => config('statamic.cp.pagination_size'),
diff --git a/tests/Auth/ElevatedSessionDisabledTest.php b/tests/Auth/ElevatedSessionDisabledTest.php
@@ -0,0 +1,55 @@
+<?php
+
+namespace Tests\Auth;
+
+use PHPUnit\Framework\Attributes\Group;
+use PHPUnit\Framework\Attributes\Test;
+use Statamic\Facades\User;
+use Tests\PreventSavingStacheItemsToDisk;
+use Tests\TestCase;
+
+#[Group('elevated-session')]
+class ElevatedSessionDisabledTest extends TestCase
+{
+    use PreventSavingStacheItemsToDisk;
+
+    private $user;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->user = User::make()->email('foo@bar.com')->makeSuper()->password('secret');
+        $this->user->save();
+    }
+
+    protected function getEnvironmentSetUp($app)
+    {
+        parent::getEnvironmentSetUp($app);
+
+        $app['config']->set('statamic.users.elevated_sessions_enabled', false);
+    }
+
+    #[Test]
+    public function cp_elevated_session_routes_are_not_registered()
+    {
+        $this->actingAs($this->user);
+
+        $this->get('/cp/elevated-session')->assertNotFound();
+        $this->get('/cp/elevated-session/passkey-options')->assertNotFound();
+        $this->post('/cp/elevated-session')->assertNotFound();
+        $this->get('/cp/elevated-session/resend-code')->assertNotFound();
+        $this->get('/cp/auth/confirm-password')->assertNotFound();
+    }
+
+    #[Test]
+    public function frontend_elevated_session_routes_are_not_registered()
+    {
+        $this->actingAs($this->user);
+
+        $this->get('/!/auth/confirm-password')->assertNotFound();
+        $this->post('/!/auth/elevated-session')->assertNotFound();
+        $this->get('/!/auth/elevated-session/passkey-options')->assertNotFound();
+        $this->get('/!/auth/elevated-session/resend-code')->assertNotFound();
+    }
+}
diff --git a/tests/Auth/ElevatedSessionTest.php b/tests/Auth/ElevatedSessionTest.php
@@ -321,6 +321,47 @@ public function middleware_denies_request_when_elevated_session_has_expired_via_
             ->assertJson(['message' => __('Requires an elevated session.')]);
     }
 
+    #[Test]
+    public function middleware_does_not_require_elevated_session_when_elevated_session_is_disabled()
+    {
+        config(['statamic.users.elevated_sessions_enabled' => false]);
+
+        $this->actingAs($this->user);
+
+        $this
+            ->get('/requires-elevated-session')
+            ->assertOk()
+            ->assertSee('ok');
+    }
+
+    #[Test]
+    public function middleware_does_not_require_elevated_session_when_elevated_session_is_disabled_even_if_session_expired()
+    {
+        config(['statamic.users.elevated_sessions_enabled' => false]);
+
+        $this->actingAs($this->user);
+
+        $this
+            ->withElevatedSession(now()->subMinutes(16))
+            ->get('/requires-elevated-session')
+            ->assertOk()
+            ->assertSee('ok');
+    }
+
+    #[Test]
+    public function middleware_does_not_require_elevated_session_when_elevated_session_is_disabled_via_json()
+    {
+        config(['statamic.users.elevated_sessions_enabled' => false]);
+
+        $this->actingAs($this->user);
+
+        $this
+            ->withElevatedSession(now()->subMinutes(16))
+            ->getJson('/requires-elevated-session')
+            ->assertOk()
+            ->assertSee('ok');
+    }
+
     #[Test]
     public function the_session_is_elevated_upon_login()
     {
@@ -647,7 +688,7 @@ public function frontend_middleware_denies_request_when_elevated_session_has_exp
     #[Test]
     public function frontend_elevated_session_redirects_to_custom_url_when_configured()
     {
-        config(['statamic.users.elevated_session_url' => '/custom-elevated-session']);
+        config(['statamic.users.elevated_sessions_url' => '/custom-elevated-session']);
 
         $this
             ->actingAs($this->user)
@@ -658,7 +699,7 @@ public function frontend_elevated_session_redirects_to_custom_url_when_configure
     #[Test]
     public function frontend_elevated_session_shows_inertia_page_when_no_custom_url()
     {
-        config(['statamic.users.elevated_session_url' => null]);
+        config(['statamic.users.elevated_sessions_url' => null]);
 
         $this
             ->actingAs($this->user)
@@ -735,7 +776,7 @@ public function frontend_verification_code_will_be_sent_for_passwordless_user_wh
     {
         Notification::fake();
         Str::createRandomStringsUsing(fn () => 'abc');
-        config(['statamic.users.elevated_session_url' => null]);
+        config(['statamic.users.elevated_sessions_url' => null]);
 
         $this
             ->actingAs($user = tap(User::make()->email('foo@bar.com')->makeSuper())->save())
diff --git a/tests/Auth/Eloquent/EloquentUserTest.php b/tests/Auth/Eloquent/EloquentUserTest.php
@@ -335,6 +335,20 @@ public function it_does_not_save_null_values_on_the_model()
         $this->assertFalse($attributes['not_null_field']);
     }
 
+    #[Test]
+    public function merge_does_not_set_roles_and_groups_as_model_attributes()
+    {
+        $user = $this->user();
+
+        $user->merge(['name' => 'Updated Name']);
+
+        $attributes = $user->model()->getAttributes();
+
+        $this->assertArrayNotHasKey('roles', $attributes);
+        $this->assertArrayNotHasKey('groups', $attributes);
+        $this->assertEquals('Updated Name', $attributes['name']);
+    }
+
     #[Test]
     #[Group('passkeys')]
     public function it_gets_passkeys()
diff --git a/tests/Feature/Roles/StoreRoleTest.php b/tests/Feature/Roles/StoreRoleTest.php
@@ -68,6 +68,26 @@ public function it_denies_access_without_active_elevated_session()
             ->assertRedirect('/cp/auth/confirm-password');
     }
 
+    #[Test]
+    public function it_allows_storing_a_role_without_elevated_session_when_elevated_sessions_are_disabled()
+    {
+        config(['statamic.users.elevated_sessions_enabled' => false]);
+
+        $this
+            ->actingAsUserWithPermissions(['edit roles'])
+            ->store([
+                'title' => 'No Elevated Session',
+                'handle' => 'no_elevated_session',
+                'permissions' => ['one', 'two'],
+            ])
+            ->assertOk()
+            ->assertJson(['redirect' => cp_route('roles.index')]);
+
+        $role = Role::find('no_elevated_session');
+        $this->assertEquals('No Elevated Session', $role->title());
+        $this->assertEquals(['one', 'two'], $role->permissions()->all());
+    }
+
     #[Test]
     public function it_stores_a_role()
     {

Original file line number	Diff line number	Diff line change
`@@ -303,7 +303,11 @@ public function remove($key)`
`303`	`303`
`304`	`304`	`public function merge($data)`
`305`	`305`	`{`
`306`		`- $this->data($this->data()->merge(collect($data)->filter(fn ($v) => $v !== null)->all()));`
	`306`	`+ $merged = $this->data()`
	`307`	`+ ->except(['roles', 'groups'])`
	`308`	`+ ->merge(collect($data)->filter(fn ($v) => $v !== null)->all());`
	`309`	`+`
	`310`	`+ $this->data($merged->all());`
`307`	`311`
`308`	`312`	`return $this;`
`309`	`313`	`}`
Original file line number	Diff line number	Diff line change
`@@ -17,7 +17,7 @@ class ElevatedSessionController extends Controller`
`17`	`17`	`{`
`18`	`18`	`public function showForm(Request $request)`
`19`	`19`	`{`
`20`		`- if ($customUrl = config('statamic.users.elevated_session_url')) {`
	`20`	`+ if ($customUrl = config('statamic.users.elevated_sessions_url')) {`
`21`	`21`	`return redirect()->to($customUrl);`
`22`	`22`	`}`
`23`	`23`
Original file line number	Diff line number	Diff line change
`@@ -72,7 +72,7 @@ public function authorizeProIf($condition)`
`72`	`72`
`73`	`73`	`public function requireElevatedSession(): void`
`74`	`74`	`{`
`75`		`- if (! request()->hasElevatedSession()) {`
	`75`	`+ if (config('statamic.users.elevated_sessions_enabled') && ! request()->hasElevatedSession()) {`
`76`	`76`	`throw new ElevatedSessionAuthorizationException;`
`77`	`77`	`}`
`78`	`78`	`}`
Original file line number	Diff line number	Diff line change
`@@ -9,7 +9,7 @@ class RequireElevatedSession`
`9`	`9`	`{`
`10`	`10`	`public function handle($request, Closure $next)`
`11`	`11`	`{`
`12`		`- if (! $request->hasElevatedSession()) {`
	`12`	`+ if (config('statamic.users.elevated_sessions_enabled') && ! $request->hasElevatedSession()) {`
`13`	`13`	`throw new ElevatedSessionAuthorizationException;`
`14`	`14`	`}`
`15`	`15`