Multi-tenant organizations: scoped dashboards, roles, and org deletion

.env.example

@@ -45,6 +45,14 @@ PUSHER_APP_CLUSTER=mt1
 MIX_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
 MIX_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"
 
+# Default/bootstrap user. On the first tenancy migration this account is
+# promoted to platform super-admin (the only role that can onboard or delete
+# organizations). Set DEFAULT_USER_EMAIL to your real admin email BEFORE
+# deploying/migrating in production. DEFAULT_USER_PASSWORD is only used when
+# seeding the user locally.
+DEFAULT_USER_EMAIL=user@example.com
+DEFAULT_USER_PASSWORD=
+
 UPTIME_MONITOR_MAIL_TO='' # comma separated string of emails
 UPTIME_MONITOR_GOOGLE_CHAT_WEBHOOK_URL=''
 MONITOR_HISTORY_ENABLED=false

app/Console/Commands/CreateMonitorDisabled.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Console\Commands;
+
+class CreateMonitorDisabled extends DisabledMonitorCommand
+{
+    protected $signature = 'monitor:create {url?}';
+
+    protected $description = 'Disabled in multi-tenant mode — create monitors from the dashboard';
+
+    protected function disabledMessage(): string
+    {
+        return 'monitor:create is disabled: it cannot assign an organization (organization_id is required). Create monitors from the dashboard.';
+    }
+}

app/Console/Commands/DeleteMonitor.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+
+/**
+ * Overrides spatie/laravel-uptime-monitor's monitor:delete, which hardcodes
+ * the base Spatie model and issues a HARD delete (destroying check history
+ * and bypassing the soft-delete retention window). This version resolves the
+ * configured monitor model, so delete() is a soft delete.
+ */
+class DeleteMonitor extends Command
+{
+    protected $signature = 'monitor:delete {url}';
+
+    protected $description = 'Soft-delete a monitor (restorable until the retention purge)';
+
+    public function handle(): int
+    {
+        $modelClass = config('uptime-monitor.monitor_model');
+        $url = $this->argument('url');
+
+        $monitor = $modelClass::where('url', $url)->first();
+
+        if (! $monitor) {
+            $this->error("Monitor {$url} is not configured");
+
+            return self::FAILURE;
+        }
+
+        if ($this->confirm("Are you sure you want stop monitoring {$monitor->url}?")) {
+            $monitor->delete();
+
+            $this->warn("{$monitor->url} will not be monitored anymore");
+        }
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/DisabledMonitorCommand.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+
+/**
+ * Base for spatie/laravel-uptime-monitor CLI commands that are unsafe under
+ * multi-tenancy: they operate on the base Spatie model, so they bypass
+ * organization assignment and soft deletes (e.g. `monitor:sync-file
+ * --delete-missing` hard-deletes across all organizations and destroys check
+ * history). We rebind them to this refusing shim; monitors are managed through
+ * the dashboard, and `monitor:delete` has a soft-delete-aware override.
+ */
+abstract class DisabledMonitorCommand extends Command
+{
+    public function __construct()
+    {
+        parent::__construct();
+
+        // Tolerate the vendor command's arguments/options so we can refuse
+        // cleanly instead of erroring on an unknown flag.
+        $this->ignoreValidationErrors();
+    }
+
+    public function handle(): int
+    {
+        $this->error($this->disabledMessage());
+
+        return self::FAILURE;
+    }
+
+    abstract protected function disabledMessage(): string;
+}

app/Console/Commands/PurgeDeletedOrganizations.php

@@ -0,0 +1,72 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Group;
+use App\Models\Monitor;
+use App\Models\Organization;
+use App\Services\OrganizationDeletionService;
+use Illuminate\Console\Command;
+
+class PurgeDeletedOrganizations extends Command
+{
+    protected $signature = 'organizations:purge-deleted
+        {--older-than-days= : Override the retention period in days}
+        {--dry-run : List what would be purged without deleting anything}';
+
+    protected $description = 'Hard-delete organizations (and their cascaded data) soft-deleted longer than the retention period';
+
+    public function handle(OrganizationDeletionService $service): int
+    {
+        $days = max(1, (int) ($this->option('older-than-days') ?: config('organizations.purge_after_days', 60)));
+        $cutoff = now()->subDays($days);
+
+        $organizations = Organization::onlyTrashed()
+            ->where('deleted_at', '<=', $cutoff)
+            ->orderBy('deleted_at')
+            ->get();
+
+        foreach ($organizations as $organization) {
+            $monitors = Monitor::withTrashed()->where('organization_id', $organization->id)->count();
+            $groups = Group::withTrashed()->where('organization_id', $organization->id)->count();
+
+            if ($this->option('dry-run')) {
+                $this->info("[dry-run] Would purge '{$organization->name}' ({$monitors} monitors, {$groups} groups).");
+
+                continue;
+            }
+
+            $service->purge($organization);
+            $this->info("Purged '{$organization->name}' ({$monitors} monitors, {$groups} groups).");
+        }
+
+        // Orphan pass: trashed monitors/groups of LIVE orgs (individually
+        // deleted, or skipped by a restore) past the same cutoff.
+        if ($this->option('dry-run')) {
+            $orphanMonitors = Monitor::onlyTrashed()->where('deleted_at', '<=', $cutoff)->whereHas('organization')->count();
+            $orphanGroups = Group::onlyTrashed()->where('deleted_at', '<=', $cutoff)->whereHas('organization')
+                ->whereDoesntHave('monitors', fn ($q) => $q->withTrashed())->count();
+
+            if ($orphanMonitors > 0 || $orphanGroups > 0) {
+                $this->info("[dry-run] Would purge {$orphanMonitors} orphaned monitors and {$orphanGroups} orphaned groups.");
+            }
+
+            if ($organizations->isEmpty() && $orphanMonitors === 0 && $orphanGroups === 0) {
+                $this->info('Nothing to purge.');
+            }
+
+            return self::SUCCESS;
+        }
+
+        $orphans = $service->purgeOrphanedChildren($cutoff);
+        if ($orphans['monitors'] > 0 || $orphans['groups'] > 0) {
+            $this->info("Purged {$orphans['monitors']} orphaned monitors and {$orphans['groups']} orphaned groups.");
+        }
+
+        if ($organizations->isEmpty() && $orphans['monitors'] === 0 && $orphans['groups'] === 0) {
+            $this->info('Nothing to purge.');
+        }
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/SyncFileDisabled.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Console\Commands;
+
+class SyncFileDisabled extends DisabledMonitorCommand
+{
+    protected $signature = 'monitor:sync-file {file?} {--delete-missing}';
+
+    protected $description = 'Disabled in multi-tenant mode — manage monitors from the dashboard';
+
+    protected function disabledMessage(): string
+    {
+        return 'monitor:sync-file is disabled: it operates on the base model, so --delete-missing hard-deletes monitors across all organizations (destroying check history) and it cannot assign organizations. Manage monitors from the dashboard.';
+    }
+}

app/Exceptions/OrganizationRestoreBlockedException.php

@@ -0,0 +1,7 @@
+<?php
+
+namespace App\Exceptions;
+
+use RuntimeException;
+
+class OrganizationRestoreBlockedException extends RuntimeException {}

app/Http/Controllers/Auth/AuthenticatedSessionController.php

@@ -37,6 +37,11 @@ public function store(LoginRequest $request)
 
         $request->session()->regenerate();
 
+        $organization = $request->user()->organizations()->orderBy('name')->first();
+        if ($organization) {
+            $request->session()->put('active_organization_id', $organization->id);
+        }
+
         return redirect()->intended('/monitors');
     }
 

app/Http/Controllers/GroupsController.php

@@ -4,7 +4,9 @@
 
 use App\Http\Requests\GroupRequest;
 use App\Models\Group;
+use App\Support\CurrentOrganization;
 use Illuminate\Contracts\Support\Renderable;
+use Illuminate\Validation\ValidationException;
 use Inertia\Inertia;
 
 class GroupsController extends Controller
@@ -27,7 +29,9 @@ public function __construct()
     public function index()
     {
         return Inertia::render('Groups/Index', [
-            'groups' => Group::with('monitors')->orderBy('name')->get(),
+            'groups' => Group::forOrganization(app(CurrentOrganization::class)->id())
+                ->with(['monitors' => fn ($q) => $q->forOrganization(app(CurrentOrganization::class)->id())])
+                ->orderBy('name')->get(),
         ]);
     }
 
@@ -38,6 +42,8 @@ public function index()
      */
     public function create()
     {
+        $this->authorize('create', Group::class);
+
         return Inertia::render('Groups/Create', []);
     }
 
@@ -48,6 +54,7 @@ public function create()
      */
     public function store(GroupRequest $request)
     {
+        $this->authorize('create', Group::class);
         $validated = $request->validated();
         Group::create([
             'name' => $validated['name'],
@@ -63,6 +70,8 @@ public function store(GroupRequest $request)
      */
     public function show(Group $group)
     {
+        $this->authorize('view', $group);
+
         return Inertia::render('Groups/Show', [
             'group' => $group,
         ]);
@@ -75,6 +84,8 @@ public function show(Group $group)
      */
     public function edit(Group $group)
     {
+        $this->authorize('update', $group);
+
         return Inertia::render('Groups/Edit', [
             'group' => $group,
         ]);
@@ -87,6 +98,7 @@ public function edit(Group $group)
      */
     public function update(GroupRequest $request, Group $group)
     {
+        $this->authorize('update', $group);
         $validated = $request->validated();
         $currentDomainCheck = $group->domain_check_enabled;
 
@@ -104,6 +116,16 @@ public function update(GroupRequest $request, Group $group)
      */
     public function destroy(Group $group)
     {
+        $this->authorize('delete', $group);
+
+        // The FK no longer blocks this (soft delete is an UPDATE), so enforce
+        // explicitly: a group with live monitors must not disappear from under them.
+        if ($group->monitors()->exists()) {
+            throw ValidationException::withMessages([
+                'group' => 'This group still has monitors. Move or delete them before deleting the group.',
+            ]);
+        }
+
         $group->delete();
 
         return redirect()->route('groups.index');