Vasyka/autocrm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: simplify WO visibility — only mechanics are restricted to own WOs

Browse Source 
Previous implementation relied on Spatie canDo() for all roles, which
caused admins/managers to see nothing if permissions weren't seeded.
Now: mechanics see only their assigned WOs (master_id = self); every
other role (admin, manager, receptionist, etc.) sees all WOs in the
tenant — TenantScope already prevents cross-tenant access.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Vasyka
2026-09-06 10:25:55 +00:00
parent a618f0af32
commit 4a896118b9
1 changed files with 7 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Filament/Tenant/Resources/WorkOrderResource.php
+7 -8
View File
@@ -247,10 +247,9 @@ class WorkOrderResource extends Resource
} }
/** /**
* Apply per-user visibility based on the permissions matrix: * Mechanics see only WOs assigned to them.
* admin/owner → all work orders * Everyone else (admin, manager, receptionist, accountant, viewer) sees all.
* work_orders.view_all → all work orders * TenantScope already filters by company_id, so no cross-tenant leak is possible.
* view_own_assigned only → only WOs where master_id = current user
*/ */
public static function getEloquentQuery(): Builder public static function getEloquentQuery(): Builder
{ {
@@ -258,12 +257,12 @@ class WorkOrderResource extends Resource
$user = auth()->user(); $user = auth()->user();
if (! $user) return $query->whereRaw('0 = 1'); if (! $user) return $query->whereRaw('0 = 1');
if ($user->isAdmin()) return $query;
if ($user->canDo(\App\Auth\Permissions::WORK_ORDERS_VIEW_ALL)) return $query; // Mechanic role: show only WOs where they are the assigned master.
if ($user->canDo(\App\Auth\Permissions::WORK_ORDERS_VIEW_OWN_ASSIGNED)) { if ($user->isMechanic()) {
return $query->where('master_id', $user->id); return $query->where('master_id', $user->id);
} }
return $query->whereRaw('0 = 1'); return $query;
} }
} }