Nyan Lin Paing
fd3a195453
Access group (Filament):
- StaffResource: manage users with an admin-tier role, gated by manage_staff
- CustomerResource: read-only view of role-less users, gated by view_customers
- RoleResource: edit permissions per role (fixed role set), gated by manage_roles
- ManageAppSettings: tabbed General/Booking settings page that reads/writes
real .env keys via new EnvFileWriter (no parallel DB settings table, so
BookingService/config('booking.*') stay unchanged)
- Moved Access above Catalog in the nav group order
- New permissions: manage_staff, manage_roles, view_customers, manage_settings
Booking soft deletes:
- bookings.deleted_at + SoftDeletes on the Booking model
- BookingPolicy::delete (manage_bookings, cancelled/expired only) and
::restore (manage_bookings)
- DeleteBookingTableAction/RestoreBookingTableAction + TrashedFilter on
BookingsTable, using authorize() so the policy is enforced at call time,
not just cosmetically hidden
Refund crash fix:
- ProcessRefundAction passed a nullable $payment->booking into
RefundBookingAction's non-nullable Booking param — a soft-deleted
booking's payment reaching the refund picker was an uncaught TypeError.
Excluded such payments from the picker and added a defensive guard.
- Same unguarded $event->payment->booking / $event->refund->payment->booking
pattern fixed in the MarkBookingPaid/MarkBookingRefunded queued listeners.
289 tests passing.
24 lines
745 B
PHP
24 lines
745 B
PHP
<?php
|
|
|
|
namespace Modules\Booking\Filament\Resources\Bookings\Actions;
|
|
|
|
use Filament\Actions\DeleteAction;
|
|
|
|
/**
|
|
* Soft-delete only (Booking uses SoftDeletes). `authorize('delete')` ties
|
|
* both the visible/hidden state AND the actual delete call itself to
|
|
* BookingPolicy::delete (manage_bookings + terminal status) — unlike
|
|
* visible()/disabled(), which are UI-only, authorize() is enforced when the
|
|
* action runs (Filament\Actions\Concerns\CanBeAuthorized). A booking that
|
|
* isn't cancelled/expired never shows this button at all, rather than a
|
|
* dead disabled one.
|
|
*/
|
|
class DeleteBookingTableAction
|
|
{
|
|
public static function make(): DeleteAction
|
|
{
|
|
return DeleteAction::make()
|
|
->authorize('delete');
|
|
}
|
|
}
|