Add Access group admin surfaces, booking soft deletes, refund crash fix

Access group (Filament): - StaffResource: manage users with an admin-tier role, gated by manage_staff - CustomerResource: read-only view of role-less users, gated by view_customers - RoleResource: edit permissions per role (fixed role set), gated by manage_roles - ManageAppSettings: tabbed General/Booking settings page that reads/writes real .env keys via new EnvFileWriter (no parallel DB settings table, so BookingService/config('booking.*') stay unchanged) - Moved Access above Catalog in the nav group order - New permissions: manage_staff, manage_roles, view_customers, manage_settings Booking soft deletes: - bookings.deleted_at + SoftDeletes on the Booking model - BookingPolicy::delete (manage_bookings, cancelled/expired only) and ::restore (manage_bookings) - DeleteBookingTableAction/RestoreBookingTableAction + TrashedFilter on BookingsTable, using authorize() so the policy is enforced at call time, not just cosmetically hidden Refund crash fix: - ProcessRefundAction passed a nullable $payment->booking into RefundBookingAction's non-nullable Booking param — a soft-deleted booking's payment reaching the refund picker was an uncaught TypeError. Excluded such payments from the picker and added a defensive guard. - Same unguarded $event->payment->booking / $event->refund->payment->booking pattern fixed in the MarkBookingPaid/MarkBookingRefunded queued listeners. 289 tests passing.
2026-08-09 23:21:11 +07:00
parent 46f9b8d5a3
commit fd3a195453
43 changed files with 1450 additions and 3 deletions
@@ -0,0 +1,33 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * Soft deletes only — a booking is never hard-removed. Admin staff may
+     * delete a cancelled/expired booking (BookingResource, gated by
+     * manage_bookings + BookingPolicy::delete), but the row stays
+     * recoverable and its Payment/Refund history stays intact.
+     */
+    public function up(): void
+    {
+        Schema::table('bookings', function (Blueprint $table) {
+            $table->softDeletes();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('bookings', function (Blueprint $table) {
+            $table->dropSoftDeletes();
+        });
+    }
+};
@@ -0,0 +1,23 @@
+<?php
+
+namespace Modules\Booking\Filament\Resources\Bookings\Actions;
+
+use Filament\Actions\DeleteAction;
+
+/**
+ * Soft-delete only (Booking uses SoftDeletes). `authorize('delete')` ties
+ * both the visible/hidden state AND the actual delete call itself to
+ * BookingPolicy::delete (manage_bookings + terminal status) — unlike
+ * visible()/disabled(), which are UI-only, authorize() is enforced when the
+ * action runs (Filament\Actions\Concerns\CanBeAuthorized). A booking that
+ * isn't cancelled/expired never shows this button at all, rather than a
+ * dead disabled one.
+ */
+class DeleteBookingTableAction
+{
+    public static function make(): DeleteAction
+    {
+        return DeleteAction::make()
+            ->authorize('delete');
+    }
+}
@@ -0,0 +1,20 @@
+<?php
+
+namespace Modules\Booking\Filament\Resources\Bookings\Actions;
+
+use Filament\Actions\RestoreAction;
+
+/**
+ * Pairs with DeleteBookingTableAction — RestoreAction is already visible
+ * only for trashed records out of the box; authorize('restore') layers
+ * BookingPolicy::restore (manage_bookings) on top, enforced at call time
+ * as well as driving visibility (Filament\Actions\Concerns\CanBeAuthorized).
+ */
+class RestoreBookingTableAction
+{
+    public static function make(): RestoreAction
+    {
+        return RestoreAction::make()
+            ->authorize('restore');
+    }
+}
@@ -7,11 +7,14 @@ use Filament\Forms\Components\DatePicker;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Filters\Filter;
 use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Filters\TrashedFilter;
 use Filament\Tables\Table;
 use Illuminate\Database\Eloquent\Builder;
 use Modules\Booking\Enums\BookingStatus;
 use Modules\Booking\Filament\Resources\Bookings\Actions\AssignDriverTableAction;
 use Modules\Booking\Filament\Resources\Bookings\Actions\CancelBookingTableAction;
+use Modules\Booking\Filament\Resources\Bookings\Actions\DeleteBookingTableAction;
+use Modules\Booking\Filament\Resources\Bookings\Actions\RestoreBookingTableAction;
 use Modules\Booking\Models\Booking;
 use Modules\Catalog\Models\EvCompany;
 use Modules\Routing\Models\EvRoute;
@@ -109,11 +112,17 @@ class BookingsTable
                        $data['value'] ?? null,
                        fn (Builder $q, $companyId) => $q->whereHas('route', fn (Builder $rq) => $rq->where('ev_company_id', $companyId)),
                    )),
+                // Deleted bookings are soft-deleted, not hard-removed
+                // (domain.md; T7.x follow-up) — this is the only place they
+                // become visible again, off by default.
+                TrashedFilter::make(),
            ])
            ->recordActions([
                ViewAction::make(),
                AssignDriverTableAction::make(),
                CancelBookingTableAction::make(),
+                DeleteBookingTableAction::make(),
+                RestoreBookingTableAction::make(),
            ]);
    }
 }
@@ -7,6 +7,7 @@ use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\SoftDeletes;
 use Modules\Booking\Database\Factories\BookingFactory;
 use Modules\Booking\Enums\BookingChannel;
 use Modules\Booking\Enums\BookingStatus;
@@ -19,7 +20,7 @@ use Spatie\Activitylog\Support\LogOptions;
 class Booking extends Model
 {
    /** @use HasFactory<BookingFactory> */
-    use HasFactory, LogsActivity;
+    use HasFactory, LogsActivity, SoftDeletes;

    /**
     * Audit trail on status transitions and driver/vehicle assignment only —
@@ -63,4 +63,26 @@ class BookingPolicy
    {
        return $user->id === $booking->user_id || $user->can('manage_bookings');
    }
+
+    /**
+     * Staff-only, and only once a booking is terminal (cancelled/expired) —
+     * a pending_payment or confirmed (paid) booking must never be deleted
+     * out from under an in-flight payment/refund flow. Soft delete only
+     * (Booking uses SoftDeletes); Payment/Refund history stays intact.
+     */
+    public function delete(User $user, Booking $booking): bool
+    {
+        return in_array($booking->status, [BookingStatus::Cancelled, BookingStatus::Expired], true)
+            && $user->can('manage_bookings');
+    }
+
+    /**
+     * Staff-only. No status restriction beyond RestoreAction's own built-in
+     * "only if trashed" visibility — a booking's status doesn't change on
+     * delete, so whatever made it deletable still holds once restored.
+     */
+    public function restore(User $user, Booking $booking): bool
+    {
+        return $user->can('manage_bookings');
+    }
 }
@@ -1,6 +1,7 @@
 <?php

 use App\Models\User;
+use Modules\Booking\Enums\BookingStatus;
 use Modules\Booking\Models\Booking;
 use Modules\Booking\Policies\BookingPolicy;
 use Spatie\Permission\Models\Permission;
@@ -86,3 +87,53 @@ test('refund requires the process_refunds permission', function () {
    expect($policy->refund($withPermission, null))->toBeTrue()
        ->and($policy->refund($withoutPermission, null))->toBeFalse();
 });
+
+test('delete allows staff with manage_bookings on a cancelled booking', function () {
+    $policy = new BookingPolicy;
+
+    $staff = User::factory()->create()->givePermissionTo('manage_bookings');
+    $booking = Booking::factory()->create(['status' => BookingStatus::Cancelled]);
+
+    expect($policy->delete($staff, $booking))->toBeTrue();
+});
+
+test('delete allows staff with manage_bookings on an expired booking', function () {
+    $policy = new BookingPolicy;
+
+    $staff = User::factory()->create()->givePermissionTo('manage_bookings');
+    $booking = Booking::factory()->create(['status' => BookingStatus::Expired]);
+
+    expect($policy->delete($staff, $booking))->toBeTrue();
+});
+
+test('delete rejects a pending_payment or confirmed booking even with manage_bookings', function () {
+    $policy = new BookingPolicy;
+
+    $staff = User::factory()->create()->givePermissionTo('manage_bookings');
+
+    $pending = Booking::factory()->create(['status' => BookingStatus::PendingPayment]);
+    $confirmed = Booking::factory()->create(['status' => BookingStatus::Confirmed]);
+
+    expect($policy->delete($staff, $pending))->toBeFalse()
+        ->and($policy->delete($staff, $confirmed))->toBeFalse();
+});
+
+test('delete rejects a cancelled booking without manage_bookings, even for the owner', function () {
+    $policy = new BookingPolicy;
+
+    $owner = User::factory()->create();
+    $booking = Booking::factory()->create(['user_id' => $owner->id, 'status' => BookingStatus::Cancelled]);
+
+    expect($policy->delete($owner, $booking))->toBeFalse();
+});
+
+test('restore requires the manage_bookings permission', function () {
+    $policy = new BookingPolicy;
+
+    $staff = User::factory()->create()->givePermissionTo('manage_bookings');
+    $stranger = User::factory()->create();
+    $booking = Booking::factory()->create();
+
+    expect($policy->restore($staff, $booking))->toBeTrue()
+        ->and($policy->restore($stranger, $booking))->toBeFalse();
+});
@@ -243,3 +243,96 @@ test('the detail page\'s assign driver action is hidden for a pending_payment bo
        ->assertActionHidden('assignDriver')
        ->assertActionEnabled('cancel');
 });
+
+test('the delete action is hidden for a pending_payment or confirmed booking, even with manage_bookings', function () {
+    $pending = Booking::factory()->create(['status' => BookingStatus::PendingPayment]);
+    $confirmed = Booking::factory()->create(['status' => BookingStatus::Confirmed]);
+
+    // authorize('delete') ties visibility straight to BookingPolicy::delete
+    // (status + permission combined) — a non-terminal booking never shows
+    // this button at all, rather than a dead disabled one.
+    Livewire::test(ListBookings::class)
+        ->assertTableActionHidden('delete', $pending)
+        ->assertTableActionHidden('delete', $confirmed);
+});
+
+test('the delete action is visible and enabled for a cancelled or expired booking', function () {
+    $cancelled = Booking::factory()->create(['status' => BookingStatus::Cancelled]);
+    $expired = Booking::factory()->create(['status' => BookingStatus::Expired]);
+
+    Livewire::test(ListBookings::class)
+        ->assertTableActionVisible('delete', $cancelled)
+        ->assertTableActionEnabled('delete', $cancelled)
+        ->assertTableActionVisible('delete', $expired)
+        ->assertTableActionEnabled('delete', $expired);
+});
+
+test('the delete action is hidden from a user without manage_bookings', function () {
+    $stranger = User::factory()->create();
+    $booking = Booking::factory()->create(['status' => BookingStatus::Cancelled]);
+
+    $this->actingAs($stranger);
+
+    Livewire::test(ListBookings::class)
+        ->assertTableActionHidden('delete', $booking);
+});
+
+test('deleting a cancelled booking soft-deletes it', function () {
+    $booking = Booking::factory()->create(['status' => BookingStatus::Cancelled]);
+
+    Livewire::test(ListBookings::class)
+        ->callTableAction('delete', $booking)
+        ->assertSuccessful();
+
+    expect(Booking::find($booking->id))->toBeNull();
+    expect(Booking::withTrashed()->find($booking->id))->not->toBeNull();
+    expect(Booking::withTrashed()->find($booking->id)->trashed())->toBeTrue();
+});
+
+test('a soft-deleted booking is hidden from the default list but visible via the trashed filter', function () {
+    $active = Booking::factory()->create();
+    $deleted = Booking::factory()->create();
+    $deleted->delete();
+
+    Livewire::test(ListBookings::class)
+        ->assertCanSeeTableRecords([$active])
+        ->assertCanNotSeeTableRecords([$deleted])
+        ->filterTable('trashed', true)
+        ->assertCanSeeTableRecords([$active, $deleted]);
+});
+
+test('the restore action is only visible for a trashed booking', function () {
+    $active = Booking::factory()->create();
+    $deleted = Booking::factory()->create();
+    $deleted->delete();
+
+    Livewire::test(ListBookings::class)
+        ->filterTable('trashed', true)
+        ->assertTableActionHidden('restore', $active)
+        ->assertTableActionVisible('restore', $deleted);
+});
+
+test('restoring a deleted booking brings it back', function () {
+    $booking = Booking::factory()->create();
+    $booking->delete();
+
+    Livewire::test(ListBookings::class)
+        ->filterTable('trashed', true)
+        ->callTableAction('restore', $booking)
+        ->assertSuccessful();
+
+    expect(Booking::find($booking->id))->not->toBeNull();
+    expect(Booking::find($booking->id)->trashed())->toBeFalse();
+});
+
+test('the restore action is hidden from a user without manage_bookings', function () {
+    $stranger = User::factory()->create();
+    $booking = Booking::factory()->create();
+    $booking->delete();
+
+    $this->actingAs($stranger);
+
+    Livewire::test(ListBookings::class)
+        ->filterTable('trashed', true)
+        ->assertTableActionHidden('restore', $booking);
+});