From 4a896118b96888e6e5602fafad08b5b75b6b41b4 Mon Sep 17 00:00:00 2001 From: Vasyka Date: Sun, 6 Sep 2026 10:25:55 +0000 Subject: [PATCH] =?UTF-8?q?fix:=20simplify=20WO=20visibility=20=E2=80=94?= =?UTF-8?q?=20only=20mechanics=20are=20restricted=20to=20own=20WOs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Previous implementation relied on Spatie canDo() for all roles, which caused admins/managers to see nothing if permissions weren't seeded. Now: mechanics see only their assigned WOs (master_id = self); every other role (admin, manager, receptionist, etc.) sees all WOs in the tenant — TenantScope already prevents cross-tenant access. Co-Authored-By: Claude Sonnet 4.6 --- .../Tenant/Resources/WorkOrderResource.php | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/app/Filament/Tenant/Resources/WorkOrderResource.php b/app/Filament/Tenant/Resources/WorkOrderResource.php index f0df425..1ca8f7c 100644 --- a/app/Filament/Tenant/Resources/WorkOrderResource.php +++ b/app/Filament/Tenant/Resources/WorkOrderResource.php @@ -247,10 +247,9 @@ class WorkOrderResource extends Resource } /** - * Apply per-user visibility based on the permissions matrix: - * admin/owner → all work orders - * work_orders.view_all → all work orders - * view_own_assigned only → only WOs where master_id = current user + * Mechanics see only WOs assigned to them. + * Everyone else (admin, manager, receptionist, accountant, viewer) sees all. + * TenantScope already filters by company_id, so no cross-tenant leak is possible. */ public static function getEloquentQuery(): Builder { @@ -258,12 +257,12 @@ class WorkOrderResource extends Resource $user = auth()->user(); if (! $user) return $query->whereRaw('0 = 1'); - if ($user->isAdmin()) return $query; - if ($user->canDo(\App\Auth\Permissions::WORK_ORDERS_VIEW_ALL)) return $query; - if ($user->canDo(\App\Auth\Permissions::WORK_ORDERS_VIEW_OWN_ASSIGNED)) { + + // Mechanic role: show only WOs where they are the assigned master. + if ($user->isMechanic()) { return $query->where('master_id', $user->id); } - return $query->whereRaw('0 = 1'); + return $query; } }