Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/raczkodavid/Zooniverse/llms.txt

Use this file to discover all available pages before exploring further.

Zooniverse uses a two-role model to control access to enclosure and animal management features. Every authenticated user is either an Admin or a Caretaker, determined by the boolean admin column on the users table. Admins have unrestricted access to all create, edit, and delete operations; caretakers can only view the enclosures and animals they have been assigned to.

​
The two roles

Admin

Full CRUD access to enclosures and animals. Can assign caretakers to enclosures, view archived animals, and restore them to active enclosures. Identified by admin = true on the user record.

Caretaker

Read-only access to assigned enclosures and their animals. Can view the homepage dashboard with their feeding schedule. Cannot create, edit, or delete any records. Identified by admin = false.
The admin field is cast to a boolean in the User model: 
protected function casts(): array
{
    return [
        'admin' => 'boolean',
    ];
}

​
Route access by role

Routes are split into two middleware groups in routes/web.php:

​
Admin-only routes (auth + admin middleware)

MethodURIAction
GET/enclosures/createShow create enclosure form
POST/enclosuresStore new enclosure
GET/enclosures/{id}/editShow edit enclosure form
PUT/PATCH/enclosures/{id}Update enclosure
DELETE/enclosures/{id}Delete enclosure
GET/animals/createShow create animal form
POST/animalsStore new animal
GET/animals/{id}/editShow edit animal form
PUT/PATCH/animals/{id}Update animal
DELETE/animals/{id}Archive (soft-delete) animal
GET/animals/archivedView all archived animals
POST/animals/{id}/restoreRestore an archived animal

​
All authenticated users (auth middleware only)

MethodURIAction
GET/homepageDashboard with feeding schedule
GET/enclosuresList enclosures (filtered by assignment for caretakers)
GET/enclosures/{id}View enclosure details
GET/profileView / edit own profile
PATCH/profileUpdate own profile
DELETE/profileDelete own account
The enclosure list and detail routes are accessible to both roles, but caretakers only see the enclosures they have been explicitly assigned to. The index action checks auth()->user()->admin and scopes the query accordingly.

​
AdminMiddleware

The AdminMiddleWare class (app/Http/Middleware/AdminMiddleWare.php) guards every admin-only route group: 
public function handle(Request $request, Closure $next): Response
{
    if (!Auth::check() || !Auth::user()->admin)
        abort(403, 'Unauthorized action!');

    return $next($request);
}
If the user is not authenticated or their admin flag is false, the middleware calls abort(403) and the request never reaches the controller. This middleware is registered as admin and applied to the admin route group: 
Route::middleware(['auth', 'admin'])->group(function () {
    // admin-only routes
});
There is no role-elevation mechanism in the UI. The admin flag must be set directly in the database. A caretaker attempting to access any admin-only URL receives a 403 Unauthorized response.

​
What admins can do

  • Enclosures — create, edit (including caretaker assignments), and delete enclosures. Deletion is blocked if the enclosure still contains animals.
  • Animals — create animals in any enclosure, edit animal details and reassign them between enclosures, and archive animals (soft-delete).
  • Archived animals — view the full list of archived animals sorted by most recently archived, and restore any animal to a compatible, non-full enclosure.
  • Caretaker assignments — on the enclosure edit form, open the caretaker modal and check or uncheck users. Assignments are synced on every save.

​
What caretakers can do

  • Homepage — view the dashboard showing total enclosure and animal counts, and a personalised feeding schedule listing their assigned enclosures with upcoming feeding times.
  • Enclosure list — browse only their assigned enclosures, paginated at 5 per page.
  • Enclosure detail — view animals in an assigned enclosure, sorted by species then birthdate. No edit or archive controls are shown.
  • Profile — view and update their own name, email, and password.
Caretakers do not have access to the animal create or edit forms, the archived animals list, or any enclosure edit or delete actions. The UI hides these buttons for non-admin users, and the routes are protected server-side by AdminMiddleWare.

​
Profile management

All authenticated users — both admins and caretakers — can manage their own profile via the profile routes: 
GET    /profile   → ProfileController::edit
PATCH  /profile   → ProfileController::update
DELETE /profile   → ProfileController::destroy
Profile management allows users to update their name, email address, and password. Deleting the profile removes the user account entirely.
Profile routes use only the auth middleware, not admin. Every logged-in user has access to their own profile regardless of role.

Build docs developers (and LLMs) love

Get started for freeTalk to us