Vasyka/autocrm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: simplify WO visibility — only mechanics are restricted to own WOs

Browse Source 
Previous implementation relied on Spatie canDo() for all roles, which
caused admins/managers to see nothing if permissions weren't seeded.
Now: mechanics see only their assigned WOs (master_id = self); every
other role (admin, manager, receptionist, etc.) sees all WOs in the
tenant — TenantScope already prevents cross-tenant access.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Vasyka
2026-09-06 10:25:55 +00:00
parent a618f0af32
commit 4a896118b9
1 changed files with 7 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Filament/Tenant/Resources/WorkOrderResource.php
+7 -8
View File
@@ -247,10 +247,9 @@ class WorkOrderResource extends Resource
}
/**
* Apply per-user visibility based on the permissions matrix:
* admin/owner → all work orders
* work_orders.view_all → all work orders
* view_own_assigned only → only WOs where master_id = current user
* Mechanics see only WOs assigned to them.
* Everyone else (admin, manager, receptionist, accountant, viewer) sees all.
* TenantScope already filters by company_id, so no cross-tenant leak is possible.
*/
public static function getEloquentQuery(): Builder
{
@@ -258,12 +257,12 @@ class WorkOrderResource extends Resource
$user = auth()->user();
if (! $user) return $query->whereRaw('0 = 1');
if ($user->isAdmin()) return $query;
if ($user->canDo(\App\Auth\Permissions::WORK_ORDERS_VIEW_ALL)) return $query;
if ($user->canDo(\App\Auth\Permissions::WORK_ORDERS_VIEW_OWN_ASSIGNED)) {
// Mechanic role: show only WOs where they are the assigned master.
if ($user->isMechanic()) {
return $query->where('master_id', $user->id);
}
return $query->whereRaw('0 = 1');
return $query;
}
}