Recognise designated superusers in authenticated demography installation

app/Services/DemographicImport.php

@@ -15,7 +15,8 @@ final class DemographicImport
 {
     public function authorize(User $actor): void
     {
-        abort_unless($actor->can('manage-portal') && ! app(PortalProfileAccess::class)->has($actor, 'auditor'), 403);
+        $access = app(PortalProfileAccess::class);
+        abort_unless(($actor->can('manage-portal') || $access->superuser($actor)) && ! $access->has($actor, 'auditor'), 403);
         abort_unless($actor->two_factor_confirmed_at && $actor->two_factor_secret, 403, 'Confirme MFA para gerir dados demográficos.');
         if (! IsolatedQaDatabase::allowsSchemaChanges()) {
             abort_unless(app(DemographicInstallation::class)->activeTarget() && app(DemographicEvidence::class)->installed(), 403, 'Destino demográfico não instalado ou não autorizado.');

routes/demography.php

@@ -1,13 +1,14 @@
 <?php
 
 use App\Http\Controllers\DemographyController;
-use App\Http\Middleware\EnsureScopedPortalAdministration;
 use App\Http\Middleware\PrivateInvestmentResponse;
 use Illuminate\Support\Facades\Route;
 
 Route::get('/localizacoes/demografia', [DemographyController::class, 'index'])->middleware('throttle:30,1');
 Route::get('/api/v1/investment/demography', [DemographyController::class, 'index'])->middleware('throttle:30,1');
-Route::prefix('management/demography')->middleware(['auth', 'verified', EnsureScopedPortalAdministration::class, PrivateInvestmentResponse::class, 'throttle:20,1'])->group(function () {
+// Each action enforces its existing installer/importer authorisation. The legacy
+// catalogue gate does not recognise a designated profile superuser.
+Route::prefix('management/demography')->middleware(['auth', 'verified', PrivateInvestmentResponse::class, 'throttle:20,1'])->group(function () {
     Route::get('/install', [DemographyController::class, 'installation']);
     Route::post('/install', [DemographyController::class, 'install']);
     Route::get('/', [DemographyController::class, 'management']);

tests/Feature/DemographicInstallationTest.php

@@ -44,6 +44,17 @@ final class DemographicInstallationTest extends TestCase
         $this->actingAs(User::factory()->create())->getJson('/management/demography/install')->assertForbidden();
     }
 
+    public function test_designated_superuser_does_not_require_the_legacy_manager_gate(): void
+    {
+        config(['portal.managers' => []]);
+        $this->assertFalse($this->manager->can('manage-portal'));
+        $this->actingAs($this->manager)->withSession(['portal.mfa_actor' => $this->manager->id, 'portal.mfa_at' => time()]);
+        $this->get('/management/demography/install')->assertOk()->assertInertia(fn (\Inertia\Testing\AssertableInertia $page) => $page
+            ->component('management/demography-install')->where('plan.mfa_confirmed', true));
+        app(\App\Services\DemographicImport::class)->authorize($this->manager);
+        $this->assertTrue(true);
+    }
+
     public function test_an_unavailable_interpreter_blocks_the_plan_before_installation(): void
     {
         config(['demography.python' => base_path('storage/nonexistent-demography-python.exe')]);