Nyan Lin Paing
fd3a195453
Access group (Filament):
- StaffResource: manage users with an admin-tier role, gated by manage_staff
- CustomerResource: read-only view of role-less users, gated by view_customers
- RoleResource: edit permissions per role (fixed role set), gated by manage_roles
- ManageAppSettings: tabbed General/Booking settings page that reads/writes
real .env keys via new EnvFileWriter (no parallel DB settings table, so
BookingService/config('booking.*') stay unchanged)
- Moved Access above Catalog in the nav group order
- New permissions: manage_staff, manage_roles, view_customers, manage_settings
Booking soft deletes:
- bookings.deleted_at + SoftDeletes on the Booking model
- BookingPolicy::delete (manage_bookings, cancelled/expired only) and
::restore (manage_bookings)
- DeleteBookingTableAction/RestoreBookingTableAction + TrashedFilter on
BookingsTable, using authorize() so the policy is enforced at call time,
not just cosmetically hidden
Refund crash fix:
- ProcessRefundAction passed a nullable $payment->booking into
RefundBookingAction's non-nullable Booking param — a soft-deleted
booking's payment reaching the refund picker was an uncaught TypeError.
Excluded such payments from the picker and added a defensive guard.
- Same unguarded $event->payment->booking / $event->refund->payment->booking
pattern fixed in the MarkBookingPaid/MarkBookingRefunded queued listeners.
289 tests passing.
72 lines
2.0 KiB
PHP
72 lines
2.0 KiB
PHP
<?php
|
|
|
|
namespace Modules\Identity\Filament\Resources\Roles;
|
|
|
|
use BackedEnum;
|
|
use Filament\Resources\Resource;
|
|
use Filament\Schemas\Schema;
|
|
use Filament\Support\Icons\Heroicon;
|
|
use Filament\Tables\Table;
|
|
use Illuminate\Database\Eloquent\Model;
|
|
use Modules\Identity\Filament\Resources\Roles\Pages\EditRole;
|
|
use Modules\Identity\Filament\Resources\Roles\Pages\ListRoles;
|
|
use Modules\Identity\Filament\Resources\Roles\Schemas\RoleForm;
|
|
use Modules\Identity\Filament\Resources\Roles\Tables\RolesTable;
|
|
use Spatie\Permission\Models\Role;
|
|
use UnitEnum;
|
|
|
|
/**
|
|
* Deliberately no create/delete — role names (super_admin/admin/support)
|
|
* are hardcoded across policies, User::ADMIN_TIER_ROLES, and the panel
|
|
* login gate (domain.md §4, §8), so the role set itself must stay fixed.
|
|
* Only what each role can do (its permissions) is editable here.
|
|
*/
|
|
class RoleResource extends Resource
|
|
{
|
|
protected static ?string $model = Role::class;
|
|
|
|
protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedShieldCheck;
|
|
|
|
protected static string|UnitEnum|null $navigationGroup = 'Access';
|
|
|
|
protected static ?string $navigationLabel = 'Roles';
|
|
|
|
public static function form(Schema $schema): Schema
|
|
{
|
|
return RoleForm::configure($schema);
|
|
}
|
|
|
|
public static function table(Table $table): Table
|
|
{
|
|
return RolesTable::configure($table);
|
|
}
|
|
|
|
public static function getPages(): array
|
|
{
|
|
return [
|
|
'index' => ListRoles::route('/'),
|
|
'edit' => EditRole::route('/{record}/edit'),
|
|
];
|
|
}
|
|
|
|
public static function canViewAny(): bool
|
|
{
|
|
return auth()->user()?->can('manage_roles') ?? false;
|
|
}
|
|
|
|
public static function canEdit(Model $record): bool
|
|
{
|
|
return auth()->user()?->can('manage_roles') ?? false;
|
|
}
|
|
|
|
public static function canCreate(): bool
|
|
{
|
|
return false;
|
|
}
|
|
|
|
public static function canDelete(Model $record): bool
|
|
{
|
|
return false;
|
|
}
|
|
}
|