From ebc4fe0f23d13437e31bb6431768ccc0e9c4861c Mon Sep 17 00:00:00 2001 From: Vasyka Date: Sun, 6 Sep 2026 10:40:19 +0000 Subject: [PATCH] =?UTF-8?q?fix:=20use=20role=20column=20directly=20in=20WO?= =?UTF-8?q?=20query=20=E2=80=94=20drop=20isMechanic()=20Spatie=20dep?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit isMechanic() calls hasAnyRole(['mechanic']) via Spatie which checks the model_has_roles table with team_id scoping. If roles are not correctly seeded for a tenant, admins/owners could accidentally pass the mechanic filter and see only WOs where master_id = their own id (i.e. nothing). Now uses $user->role === 'mechanic' directly — no Spatie involved — so admin/owner/manager always see all WOs in their tenant. Co-Authored-By: Claude Sonnet 4.6 --- app/Filament/Tenant/Resources/WorkOrderResource.php | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/app/Filament/Tenant/Resources/WorkOrderResource.php b/app/Filament/Tenant/Resources/WorkOrderResource.php index 1ca8f7c..d43005f 100644 --- a/app/Filament/Tenant/Resources/WorkOrderResource.php +++ b/app/Filament/Tenant/Resources/WorkOrderResource.php @@ -247,9 +247,10 @@ class WorkOrderResource extends Resource } /** - * Mechanics see only WOs assigned to them. - * Everyone else (admin, manager, receptionist, accountant, viewer) sees all. - * TenantScope already filters by company_id, so no cross-tenant leak is possible. + * Mechanics (role='mechanic') see only WOs assigned to them. + * All other roles see everything in the current tenant. + * Uses role column directly — no Spatie dependency — to avoid + * team_id misconfiguration causing wrong results. */ public static function getEloquentQuery(): Builder { @@ -258,8 +259,7 @@ class WorkOrderResource extends Resource if (! $user) return $query->whereRaw('0 = 1'); - // Mechanic role: show only WOs where they are the assigned master. - if ($user->isMechanic()) { + if ($user->role === 'mechanic') { return $query->where('master_id', $user->id); }