From 1bc8236d4d32b3b0e37519ce1c84eaa0c58ea8ad Mon Sep 17 00:00:00 2001 From: Agent Date: Thu, 11 Jun 2026 13:09:53 -0400 Subject: [PATCH 1/2] =?UTF-8?q?fix:=20filtrar=20servidores=20por=20usuario?= =?UTF-8?q?/equipo=20seg=C3=BAn=20rol?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Server::getAccessibleServerIds(): super_admin ve todos los servidores; admin y operator solo ven propios, asignados directos o por equipo - DashboardController: unifica lógica usando getAccessibleServerIds() - ServerController::metrics(): agrega control de acceso requireServerAccess() - ApiController::status(): filtra estadísticas por servidores accesibles - Android: bump versionCode 9, versionName 1.7.0 --- android/app/build.gradle.kts | 4 ++-- src/Controllers/ApiController.php | 7 +++++-- src/Controllers/DashboardController.php | 28 +++++++------------------ src/Controllers/ServerController.php | 2 ++ src/Models/Server.php | 16 ++++++++++++++ 5 files changed, 33 insertions(+), 24 deletions(-) diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts index 086e2cc..d9faebb 100644 --- a/android/app/build.gradle.kts +++ b/android/app/build.gradle.kts @@ -12,8 +12,8 @@ android { applicationId = "com.devlab.app" minSdk = 26 targetSdk = 37 - versionCode = 8 - versionName = "1.6.1" + versionCode = 9 + versionName = "1.7.0" } buildTypes { diff --git a/src/Controllers/ApiController.php b/src/Controllers/ApiController.php index ad951ef..189b4e8 100755 --- a/src/Controllers/ApiController.php +++ b/src/Controllers/ApiController.php @@ -48,10 +48,13 @@ class ApiController public function status(): void { - $this->authenticateRequest(); + $user = $this->authenticateRequest(); + + $serverModel = new Server(); + $accessibleIds = $serverModel->getAccessibleServerIds((int) $user['id']); $monitoringService = new MonitoringService(); - $stats = $monitoringService->getDashboardStats(); + $stats = $monitoringService->getDashboardStats($accessibleIds); $this->view->json([ 'success' => true, diff --git a/src/Controllers/DashboardController.php b/src/Controllers/DashboardController.php index c0b7199..91617d8 100755 --- a/src/Controllers/DashboardController.php +++ b/src/Controllers/DashboardController.php @@ -25,20 +25,14 @@ class DashboardController public function index(): void { - $role = Session::get('user_role'); $serverModel = new Server(); $userId = (int) Session::get('user_id'); - if ($role === 'super_admin') { - $stats = $this->monitoringService->getDashboardStats(); - $servers = $serverModel->findAll(true); - } else { - $accessibleIds = $serverModel->getAccessibleServerIds($userId); - $stats = $this->monitoringService->getDashboardStats($accessibleIds); - $servers = !empty($accessibleIds) ? array_values(array_filter($serverModel->findAll(true), function ($s) use ($accessibleIds) { - return in_array((int) $s['id'], $accessibleIds, true); - })) : []; - } + $accessibleIds = $serverModel->getAccessibleServerIds($userId); + $stats = $this->monitoringService->getDashboardStats($accessibleIds); + $servers = !empty($accessibleIds) ? array_values(array_filter($serverModel->findAll(true), function ($s) use ($accessibleIds) { + return in_array((int) $s['id'], $accessibleIds, true); + })) : []; $recentActivity = $this->auditService->getRecentActivity(10, $userId); @@ -52,15 +46,9 @@ class DashboardController public function stats(): void { - $role = Session::get('user_role'); - - if ($role === 'super_admin') { - $stats = $this->monitoringService->getDashboardStats(); - } else { - $serverModel = new Server(); - $accessibleIds = $serverModel->getAccessibleServerIds((int) Session::get('user_id')); - $stats = $this->monitoringService->getDashboardStats($accessibleIds); - } + $serverModel = new Server(); + $accessibleIds = $serverModel->getAccessibleServerIds((int) Session::get('user_id')); + $stats = $this->monitoringService->getDashboardStats($accessibleIds); $this->view->json([ 'success' => true, diff --git a/src/Controllers/ServerController.php b/src/Controllers/ServerController.php index 74e02cf..e29e9bc 100755 --- a/src/Controllers/ServerController.php +++ b/src/Controllers/ServerController.php @@ -1786,6 +1786,8 @@ class ServerController public function metrics(int $id): void { + $server = $this->requireServerAccess($id, 'viewer'); + $monitoringService = new MonitoringService(); $metrics = $monitoringService->getLatestMetrics($id); diff --git a/src/Models/Server.php b/src/Models/Server.php index 71c77de..66b21fb 100755 --- a/src/Models/Server.php +++ b/src/Models/Server.php @@ -249,6 +249,22 @@ class Server public function getAccessibleServerIds(int $userId): array { + $user = $this->db->fetch( + 'SELECT role FROM users WHERE id = ? AND status = \'active\'', + [$userId] + ); + + if (!$user) { + return []; + } + + if ($user['role'] === 'super_admin') { + $all = $this->db->fetchAll( + 'SELECT id FROM servers WHERE status = \'active\'' + ); + return array_map(fn($r) => (int) $r['id'], $all); + } + $owned = $this->db->fetchAll( 'SELECT id FROM servers WHERE created_by = ? AND status = \'active\'', [$userId] From 6e4bf2ad1db88e726b4c586bc45efbe6aaadda61 Mon Sep 17 00:00:00 2001 From: Agent Date: Thu, 11 Jun 2026 17:26:54 -0400 Subject: [PATCH 2/2] build: compile APK v1.7.0 (versionCode 9) --- public/sysadmin.apk | Bin 20911873 -> 20911873 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/public/sysadmin.apk b/public/sysadmin.apk index 74d6dcca0a6741ee14d0f036a8a173f94a8cf4c3..b4e3cc540c132d77d577243cd184dc4f1c23af52 100644 GIT binary patch delta 4371 zcmXY!cR1CL7svaMnGr=1SJ|5qxyGe|P>IUO=4&U(=5om?H$EXNC9{$dQppTu6|!%# zSF*=7udeZ{=lT6{Ue9yhf1T&N-+!DFR=CX+_P0U-0UDr%{XhrwzyOTE1k7*%Sb!DS zfE^A32XMk6I1F6C4M*T8@Bl9y13usf3<$t+I01qn1i~N!q96w1AOVsf1=1h`vLFZY za1u^|0-Od#P=Yg{3|LSBRZs(Uz<~y6!dW;6=ivfqfi~#CMbHI3(1%NK8Lof4O)v)wummfx1{<&iJFtiUzyTb=37o+NT)_=)fjis=54Z!Ka2LG5 z8+^bQ{JKk05LL|l2EZvRse5hskR z@eSx+e6Dkzu`OIUO_}|ozd}eubd&vrXPPG8zy#>>4XmT*Ihp9r3RCta#LzsZFcIZ6 zU%5)*u8O>5CL=UqUv+NW5KreC50A;q%Zv0~2;L;~jg&Wev1AvQ%$HNs-fs-g%?Dxp znsXy}i_^um=W<=tI|C%Q@mx}PD+2wfk~{4NqHDwA&sN4(#g1p*-nY#tturDzdN3BT zq8X;gp>$Py`;`(oN@$$Ij@3HVT8Em~vTJH#J0)#6%b4C29OtD8IgoIJbDdU>mO%SM z?zjqF75g@$w{*SJsJV?3SEtKpOzpT9k)aI1Gt8S`T9aIsdF#Nmg4{+52>K60*l*>C z24c$S_(BoB2w zqG)J-t!ix^se`$U8P9y3bV!lbgLaR8w)Z%D2G2Bu_TOnQk1o{`LLJ;5ex%jSh+A1Z z{m4d5hghWT68m5|;IIi7A>oxR?-O!t^VpeucUPPA`YE+Vwh0d# zgYnsWr)2B*PLky#4S2?yN4pPR?&R5iruy{&LGGRh9~$6ZxqtJuu+>M$hC0UWLj{^6 zx`X`T3vUPK9ueimc&s!l4VU*@iQc#6>y0NqbtiSXpzF34zxOm<4;V|}FmDU>OdSba#&6@fnYfLbPga$fRJNp0PxN^MhZ1FpT z!njqUsMM`ao~q(BERNOQCQlPKRAcEruNX5FkB5#_fF`S7o>gr zUgo~k?N052(P2e{!GgEhLh6HxV(j0SJLQ6@)5`wwo_D7yq0~>dJ@W3wyRt&9&u==-O@go{7ruWeal_LQbbZ zyqSEV)PbNhv%1tQ4?@lL$Ek)r7qtq`e^#iQh;Lj9UEZ*N8SuQqyOq<(@Pc2^DWw+1 zlB~@W%ct|TgS!($)lso)`PVJ=^5jmSIwAvX76M5X2D&?bb|LnQ^=sV*ANmKHYy<8R zm4Y^$kNEUwc%|2K{Nio%Ocguk#?`uCqCj{=**`?TJ?|XvtxbQzyLDZy5?w7%%XVDp zd@}9aL`TkLp@oE;vg|m@B=*@{k^U5Xn2*>=j>$6UT^sBX^wRab-)6Bjk#*H5aJ_k& z>|Zj=+bPxTbMdfkcGM3Rn;&2N>s3<3Z_4>ykY_d6oCwyk@Rjm3OKmFdU#;@gZuB$q z4X^SD61^7?6&_$jP!3PkJSb$Yx5T9Mz4=J1=KZZVmVTn2x_0laje175C2zJ)cysp# z33uCU9*$UPygfc)_U_P5IR9M6w5QqA3656$-iP^8S>y$$+rjR)^L=;U#i#UrX&5>D zSzx})!0n@1AJ3G}-nUQaneHqv?I;{sH7iJO!*i*MI?7#$ZV+~aJ;p4xQwoi${?N~z zV;6LdFR7BBQ2HKTG`8 z*|iNU_dWUJ^Ty^5sATb|r=Tq^QR>#Q3OaWjC4aZiU?q#hUKEH7)C=Y1jJ~H}t&e@C zpyCOSOT=ioR5C~SuD09o!DqreyVGi zGZ%>sa?A@Dw_?X-2 ze`6b<=(ZesoNm>7`?af!WlDIYZ?5mMQoZld=RBlb|NBAHM;_)F7_Zs}>?J+sS>2mb zb?-aWy|FA^wReQgu@Ps)>JwZ(3C7NN|0M#ag+5PX5h{@`$#XY^-wZi=%D6Xef0bI;udZ3S?B>|IY7|V) zTJ=2mU6xE>+Y3LlT^Tt{Hg5M%A?5J=Cb=ap$IM`(NP;(omtLBcYNyuFPcD$5P3v<` zS&cyM6R~>)DxCo(Ku!PJxZ;FAJMIbY{?f5LLG4_*@X8M>Q2(ByH**7X+tN> zq{3f+XskGrYMn?D6!X}8m=<+IH<+Wr?qmjwI0N^-s89z@)~g44Xy-!dZ4};qVCk(5 zw4w25^XH;usBu#Z1-Yr1oHuBLXc*s}@;J+$a|$7Q1cNo}?OU~bNcDpqzob+G{bWjP zV#f&zPsftnmK9g@@u(hSAu-yvnC9L*_Y%_W_x-bzSmyqMZt6B`vtbGUje(0fas-@v z-|Xq(m#E>1VZ%qIt&yeuvrcyTtmG&8qPDUdo|=wx_jaEDA)4WuCx!Wbb^J%ZPvxn8 zg~6*P5IiCpN_#$=EPO6C+1j{?C$UvKVDOKcd!5NLUdtr^#DJ7ztE$+%73le-Zfvk$KUelq)@Aa zUEwCNZ^M={D`dB8HAQQ$@dh6ygOjX}z~~ne-pV-kHMe&?3VhwdDB3=m&x6P zYvtQE>k6)>mY}!wJ%*=d!8m0-nmmxT`_Xjb$f6U)_vVHWTXj&v5++J+u>EHp_Gpl) zD&gAd<)j@Ko$u+__r!$O6#7q351Q!J1Y`d2n-H1`D0Mq%aFNi+9jkebA|Ho&ryhdV z*S($Dy%3#h+II{>fqDb#uRb<#_%!fp+}h&1>x?hDJCy(Nl|ow6tdwYx{FCB{)l==4 z1O-P{Vwa59hi(dvh?NY*8}EDw_~m<*%72}3tf*JU)vfq0qZf|=KL&@nTFszGnZ84r zURfq*tf-rQ(Ros*(_Gh7*SvX$NkBq}Us!N9bndU=@1rZ03^mkU&E;Rvw-lDS+TZx< zXvakTWop&6F2kqqAfD8unAAiv&h)|z_-faiaC4-a8Ca0{qlj`vtCkW4UA+1#f=Ps* z1|736g_17SZ}UaJvbLX*i*~pfUS1#P*_vt=W2&N<)J8OQPTF!vw7<-=YI?0v{YQeT zVxek*S`)w93NValPYyVfFDw7ZIoZUU=rjF%wPP#xkH%>O73;N*t+)u;l+%Tmjnkg+ zsaS7}R_bppzN5&hdRI?(V5d5^%-B;2@v|CO0~L*>%+&*!iqp;(tj1|_%HGwppG(cQ z=Dq&hh-hn9^$z)wxf+F0@yp#S4CvZ&U{AFscQ{lwmJBtoaz)6>sd@)=X0|A@TN=%3 zC>m5${myKe!&D3wcn-NwZdJV49bO(C$i@#ySD)d-_o`DqN{$#uEmhbLT6v*_0mY`W zPctWP56#w4ofcoUmJKZ*EiF~^o*|V57O0KfoxWR_*^tCydYI#Zho4|yb;kzvYp&bJD=~zfAiC!Os*mkfeTeFjOlb6`FlIjo7{~} z4AJj*1f;2E5iv^Zo!K8Jqt$Jb2`v;#N1aaPA7{C-i8@AsH1y&W2!!aIHipXCm{ll4m zQ2qz(KdAhJ>OZI4%B@_lttW2`$XvC~`fPU2wXciL}jE-{{ut*;-ECvB-+ zI?u}JqMP>f<>D^e!yzf0`MK(6-L-nGQ4wdoe+GVdJxVAiC%CGHqvPGOYbWcKTQgEB zBI4V>*EzOEP;ERP)U~*;=wS$Xr^+oZ8b5JwXzXasWA+{0rMRwHs+`$J(!cvP;Ltbc zd8B4C_t$jgOrT$JmD5)8xx;;N5-~#8ZE-!hul1)FWsaS+3P`ovoPEAwHJ7YVv`aqW zZ)-l_eY}sJb6ynLx36aT?>0n{np+(>WaQxgU&X6qIK+5A|6fni-#%4B1k%6#6(skw d{r4pa2zy23$)<`=zuQhfj(dX2L^BwPQhs~gfn0SXTcc$f^%R3rf?oEfEk#> zMX&%%u!2iq4K`p4c3=+<;0R9O3@+dbZg3f{fIIvRSHS~3!3(Z|H~7GH@C84>gFgg7 zAP^u3Zoo|lhFfqOLLd}~5C-8uf(W<+|3D-F+=YK33Zmg2#6T>d5C``m9v;9$NPtK1 z7!n}~k|70BAq~CHsru_$b~$}hXN>sA}EFuph78>K{-@FCA@$t zsD>J-g_lqV_3#QBpb?s&8D7I1cndAi3T^NX+MxqFp$od92YR6o`r$qN2OnSn24M(> z;UkQ|C-@Ab@C9fv2IKG*Cg2-P!grX0X_$don1gv(fJIn>Wmo|^tilgigLT*d2K9;l$D{I>54c|&uN(<9(3tn6ikGytWIdrjMs_4~* z?k{p%W?(@UX0Yc1 zMgJh3{uBO!HHeZcQXEm(lzY+|Yay_#vW$NcE<?D*6@60`^~e(ZdV`UCH8<- zLEgOg{jpX;3d0-Ny!KO!{jE=t>_xNG4mR%HlIXMH@)F;X^-s(Z53d+`&bH1;?3q~H z|C??7NJ)?41aV7BkQc*v%vZ7x$Nm0DW-GNevVM6(n$g;nGE~JCK(hRL)yGDE-y4H| z%O9CdqZY&W-@PJ7a}W~7Z&!*T=3`e+i?sS<@1%URQGRt+o}1!1lec^zkmMv+dqAn1 zk^V4zTrXe#l{eo2(_%)e^_TWei@32_X3g={{Uhh4NdgnpfW$=eJN!DeK0n$mRDYMh zzLDkV@?lJEOwLaBzVf}D$gJ1uKYGr6@6OtYDCole%3hM+qED~pd3?}V)ojMZ`!fgd zL??y?CT18Ox4#_QXXSgDak-T_}Tmzzj)_7CZBTRHnZ`nnM`;~qTBOLd!^A2B+gFG<>Orm zxnhlB1T6sE5ME^p8#nL4iH{OZ%57O4j3A3gg6Kd^M5<|w>i&mC95-GG4J+-wT0>#Vg z0cXhKS#f0S$eB!=>CcJ*thN6VoEF+!9rkFPGEr>T<{{JGYZN?S`($HIs&dKCv&ok$ znM<8YTBvXf6Bm8qoh`vHICP1>QQw%bePcG`LDF`q)T-K#nT)jbw5uxeC4DoBB&P!= zCRE9TSV^joGbZFr?ah1AT|xb6NSA|1yq%|j(cI)Z$MdK8;q}z$PCpry!c`HQP_njJ zC&TQW--8WbVd)fYofKIhX$*6+s+H&bAiHg&#O8gMQhG;%Jl|s$dQEvHbEnbUz4~W8 z{a+cYbKf)%ki*X(#gS$7`V5B4c%mhf6Lln;yEe?*!{_*qNtdyyakrC|W%X)jl%2Nf zq#2RUoATXSih2|Eiw3pHD;^F(=Y9GW!=rAPx8oMm2~wY5C-ygxDBqOpJG}<1V{B<| z&eLbl6qhFndwg~#j1}GrAItrq|Kdy>VGP5){%lbEq8m+1c0O}#4hg-ZUEnAC?V5pX zXxce{HN(qJ#yQ@M&HDRZXM2yj2aa6noto_8%Ses+NeH>$G1u-zXxCbaR#0Flh4wzC*sWU}Itj)P9*EA2w8gB^npTO9j z9ig0!RkMf^>@g~GCz8iB6?1%!QS0jcvOWIp?bxUNk9lN>H&$6$HivgA>|8zly3QfI z@X_qkY1VaP*`o7`kt;RPlH7r8J*Eca_Vj@7yk>pPCYE09_!QD2ktnYtAbYiFVOV$R zuj}$3FN+ymyDd$(nj6Wyq+IMnxY(~Uz%zPh_$`R>M!bc1hkH%E&0ZT9b769nS>7cpH=kP5vtb`r;glBxFFq-ingL$h%5%pNfp;|c+ z!Ho^f8vTqvsd0?cAj^QnTlOxyxaO)^FvkXT*q(AAbhgR8OHsRy3~T9Tj?V zK3A6?587>HtrnI$eEYV5>t8KX$XCs>Q(}9JOg8C{sko_KWck3n*5v&J8Rk$@c%xa$ zCc;i;cVY2MYP&+SetU(+l9*UF%=&;u#kM@w!K-y?hjj0EEae4*);m1uJu)Vo0Lo0mEmu=#!8K^$Cl}Ah*v9VjwDkyd#KYKFj{i>JtMBM6=+6(TeP5P8o zQnA^@g$@zHuM+*YI*V=<7Kb0L8re^(_2&P6MT-6JDwW~hg7}olXHI6XPw~_#HTWC6 zseTuUucMQEs~JK%i~=lUU4iBjOC4#h9*(41{1jDgXyIuP1& z0W0KM97*ko#8c=C6^vPNqNzUPrUK0@7JrV_)pApKJ~dj@vtgnm*vU8Xt|(Qpf(W(e zyVfMtKH>JchMno6%@N(^jUVIhv>4xI^tq1#+Z)q|5rsCBd2?q8_Ee?ZU;;Q{^LQoF==8#)U-@VO6QFwh>nT)!WQ90&-rn26kC)@ z%Kzz{v~6$PO}Vrqi}|53a(w!;tx02;L=CS06c6$uQUXVFtBn35x6LXZr5;Nzi&|ChJufXy zqd!;@S{t>LrsYa{tWoL;CVcDIM$d+PK4l{a&>0*h_QA^`d8sbpz(rBi}C+HkT`wjMzz*r`o;7 z=_DoJ2;*wAJQy<>5H}g{!g@NRtxAG#CDG`u=b(Tsu?_RJbB<_hQdrrVa6ejxv@TGo zI}VtF#DAeml75)w_4s&+$4d~sD z^>OvA4Cys2+`v|P57mqmf2IX{t&t52#rPan90E1II-g}ImAY;(1=m*}!};mj&rVpbYt-$;Asj3u{P&0W z0=0EM%c4$QnNY5xfpabVr(*U>66-}D@lpLpmUNAp%Oxz26`CHlQXgw1)jv4q3@!^!u*CQ<@O_785)R)?`F ziHa2@T~;k?4(9Nd_c?sEuJohwl|hoiorY#IdyTS{79^|b-sO8)nLM1@A30etdD8HS z9n-apeW^ic$sjgG&-kV|`N@Eyxc-j*NOi_zLYh6TKsA>5YJt=Ci=VChZMKZ(qn?7z ziP~4q?fNEE&+ZKyN~|-uvwkUM0y!Z+5$}C)ewK%wpQ5-uhJD{V94ma1dANrysrM+t z#MHRFdyS(=