fix: use role column directly in WO query — drop isMechanic() Spatie dep

isMechanic() calls hasAnyRole(['mechanic']) via Spatie which checks the
model_has_roles table with team_id scoping. If roles are not correctly
seeded for a tenant, admins/owners could accidentally pass the mechanic
filter and see only WOs where master_id = their own id (i.e. nothing).

Now uses $user->role === 'mechanic' directly — no Spatie involved —
so admin/owner/manager always see all WOs in their tenant.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
2026-09-06 10:40:19 +00:00
parent 7b1d296bd4
commit ebc4fe0f23
@@ -247,9 +247,10 @@ class WorkOrderResource extends Resource
}
/**
* Mechanics see only WOs assigned to them.
* Everyone else (admin, manager, receptionist, accountant, viewer) sees all.
* TenantScope already filters by company_id, so no cross-tenant leak is possible.
* Mechanics (role='mechanic') see only WOs assigned to them.
* All other roles see everything in the current tenant.
* Uses role column directly — no Spatie dependency — to avoid
* team_id misconfiguration causing wrong results.
*/
public static function getEloquentQuery(): Builder
{
@@ -258,8 +259,7 @@ class WorkOrderResource extends Resource
if (! $user) return $query->whereRaw('0 = 1');
// Mechanic role: show only WOs where they are the assigned master.
if ($user->isMechanic()) {
if ($user->role === 'mechanic') {
return $query->where('master_id', $user->id);
}