From a618f0af3295e0b0f9464e9d81ee759e6a08a88e Mon Sep 17 00:00:00 2001 From: Vasyka Date: Sun, 6 Sep 2026 10:16:55 +0000 Subject: [PATCH] feat: implement per-role WO visibility via getEloquentQuery Admin/owner and users with work_orders.view_all see all work orders. Users with only work_orders.view_own_assigned (mechanics) see only work orders where master_id = their own user ID. Roles without either permission see nothing. Co-Authored-By: Claude Sonnet 4.6 --- .../Tenant/Resources/WorkOrderResource.php | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/app/Filament/Tenant/Resources/WorkOrderResource.php b/app/Filament/Tenant/Resources/WorkOrderResource.php index c9c0683..f0df425 100644 --- a/app/Filament/Tenant/Resources/WorkOrderResource.php +++ b/app/Filament/Tenant/Resources/WorkOrderResource.php @@ -11,6 +11,7 @@ use App\Models\Tenant\WorkOrder; use App\Tenancy\TenantManager; use Filament\Actions; use Filament\Forms; +use Illuminate\Database\Eloquent\Builder; use Filament\Resources\Resource; use Filament\Schemas; use Filament\Schemas\Components\Utilities\Get; @@ -244,4 +245,25 @@ class WorkOrderResource extends Resource 'edit' => Pages\EditWorkOrder::route('/{record}/edit'), ]; } + + /** + * Apply per-user visibility based on the permissions matrix: + * admin/owner → all work orders + * work_orders.view_all → all work orders + * view_own_assigned only → only WOs where master_id = current user + */ + public static function getEloquentQuery(): Builder + { + $query = parent::getEloquentQuery(); + $user = auth()->user(); + + if (! $user) return $query->whereRaw('0 = 1'); + if ($user->isAdmin()) return $query; + if ($user->canDo(\App\Auth\Permissions::WORK_ORDERS_VIEW_ALL)) return $query; + if ($user->canDo(\App\Auth\Permissions::WORK_ORDERS_VIEW_OWN_ASSIGNED)) { + return $query->where('master_id', $user->id); + } + + return $query->whereRaw('0 = 1'); + } }