New modules/reporting Filament page: filterable bookings table (travel
date range, status, route, channel) with CSV/Excel export. Report
columns include booking ref, route, passenger name/count, price,
best-payment status/amount, and driver info, plus a TOTAL row summing
passenger count, price, and payment amount in both export formats.
- BookingsRevenueExport backs both CSV and XLSX via maatwebsite/excel
^4.0 (the only version compatible with PHP 8.5; 3.1.x caps
phpoffice/phpspreadsheet below 8.5).
- CSV export writes a UTF-8 BOM so non-Latin passenger names (Burmese)
open correctly in Excel.
- New view_reports permission (super_admin/admin/support) gates the
page; new indexes on bookings.travel_date/status/created_by_channel
and payments.completed_at support the report's filters.
Access group (Filament):
- StaffResource: manage users with an admin-tier role, gated by manage_staff
- CustomerResource: read-only view of role-less users, gated by view_customers
- RoleResource: edit permissions per role (fixed role set), gated by manage_roles
- ManageAppSettings: tabbed General/Booking settings page that reads/writes
real .env keys via new EnvFileWriter (no parallel DB settings table, so
BookingService/config('booking.*') stay unchanged)
- Moved Access above Catalog in the nav group order
- New permissions: manage_staff, manage_roles, view_customers, manage_settings
Booking soft deletes:
- bookings.deleted_at + SoftDeletes on the Booking model
- BookingPolicy::delete (manage_bookings, cancelled/expired only) and
::restore (manage_bookings)
- DeleteBookingTableAction/RestoreBookingTableAction + TrashedFilter on
BookingsTable, using authorize() so the policy is enforced at call time,
not just cosmetically hidden
Refund crash fix:
- ProcessRefundAction passed a nullable $payment->booking into
RefundBookingAction's non-nullable Booking param — a soft-deleted
booking's payment reaching the refund picker was an uncaught TypeError.
Excluded such payments from the picker and added a defensive guard.
- Same unguarded $event->payment->booking / $event->refund->payment->booking
pattern fixed in the MarkBookingPaid/MarkBookingRefunded queued listeners.
289 tests passing.
Implements T1.1-T1.4: Spatie role/permission seeding, Sanctum token
issuance for customer channels and the FastAPI agent (with an
ability-exact-match middleware to tell them apart), Filament admin
panel access restricted to admin-tier roles with the navigation group
order, and skeleton BookingPolicy/RoutePolicy gated on the seeded
permissions ahead of their models landing in later phases.
Nyan Lin Paing