Update AdminOnlyAccess middleware

Author: dansup

app/Console/Commands/CleanAdminSecurityLogs.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Carbon\Carbon;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\File;
+
+class CleanAdminSecurityLogs extends Command
+{
+    protected $signature = 'logs:clean-admin-security {--days=14 : Number of days to keep}';
+
+    protected $description = 'Clean old admin security logs';
+
+    public function handle()
+    {
+        $days = $this->option('days');
+        $path = storage_path('logs');
+        $cutoffDate = Carbon::now()->subDays($days);
+
+        $deleted = 0;
+
+        foreach (File::glob("{$path}/admin-security-*.log") as $file) {
+            $fileDate = Carbon::createFromTimestamp(File::lastModified($file));
+
+            if ($fileDate->lt($cutoffDate)) {
+                File::delete($file);
+                $deleted++;
+                $this->info('Deleted: '.basename($file));
+            }
+        }
+
+        $this->info("Cleaned {$deleted} old admin security log file(s)");
+
+        return Command::SUCCESS;
+    }
+}

app/Http/Middleware/AdminOnlyAccess.php

@@ -4,6 +4,7 @@
 
 use Closure;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Log;
 use Symfony\Component\HttpFoundation\Response;
 
 class AdminOnlyAccess
@@ -16,11 +17,20 @@ class AdminOnlyAccess
     public function handle(Request $request, Closure $next): Response
     {
         if (! $request->user()) {
-            return redirect('/');
+            abort(401, 'Unauthenticated');
         }
 
-        if (! $request->user()->is_admin) {
-            return redirect('/');
+        if ($request->user()->is_admin !== true) {
+            Log::channel('admin_security')->warning('Unauthorized admin access attempt', [
+                'user_id' => $request->user()->id,
+                'ip' => $request->ip(),
+                'user_agent' => $request->userAgent(),
+                'route' => $request->path(),
+                'method' => $request->method(),
+                'timestamp' => now()->toIso8601String(),
+            ]);
+
+            abort(403, 'Unauthorized');
         }
 
         return $next($request);

config/logging.php

@@ -129,6 +129,14 @@
             'path' => storage_path('logs/laravel.log'),
         ],
 
+        'admin_security' => [
+            'driver' => 'daily',
+            'path' => storage_path('logs/admin-security.log'),
+            'level' => env('LOG_LEVEL', 'debug'),
+            'days' => 14,
+            'permission' => 0664,
+        ],
+
     ],
 
 ];

routes/console.php

@@ -14,6 +14,7 @@
 Schedule::command('version:check --force')->twiceDaily(9, 17)->withoutOverlapping()->runInBackground()->onOneServer();
 Schedule::command('videos:retry-failed')->everyThirtyMinutes()->onOneServer();
 Schedule::command('app:instance-stats-collector-command')->hourlyAt(20)->onOneServer();
+Schedule::command('logs:clean-admin-security --days=14')->dailyAt('03:00')->onOneServer();
 
 if (config('loops.admin_dashboard.autoUpdate')) {
     Schedule::command('admin:refresh-dashboard-30d')->everyThirtyMinutes()->onOneServer();