fix: use role column directly in WO query — drop isMechanic() Spatie dep
isMechanic() calls hasAnyRole(['mechanic']) via Spatie which checks the model_has_roles table with team_id scoping. If roles are not correctly seeded for a tenant, admins/owners could accidentally pass the mechanic filter and see only WOs where master_id = their own id (i.e. nothing). Now uses $user->role === 'mechanic' directly — no Spatie involved — so admin/owner/manager always see all WOs in their tenant. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -247,9 +247,10 @@ class WorkOrderResource extends Resource
|
||||
}
|
||||
|
||||
/**
|
||||
* Mechanics see only WOs assigned to them.
|
||||
* Everyone else (admin, manager, receptionist, accountant, viewer) sees all.
|
||||
* TenantScope already filters by company_id, so no cross-tenant leak is possible.
|
||||
* Mechanics (role='mechanic') see only WOs assigned to them.
|
||||
* All other roles see everything in the current tenant.
|
||||
* Uses role column directly — no Spatie dependency — to avoid
|
||||
* team_id misconfiguration causing wrong results.
|
||||
*/
|
||||
public static function getEloquentQuery(): Builder
|
||||
{
|
||||
@@ -258,8 +259,7 @@ class WorkOrderResource extends Resource
|
||||
|
||||
if (! $user) return $query->whereRaw('0 = 1');
|
||||
|
||||
// Mechanic role: show only WOs where they are the assigned master.
|
||||
if ($user->isMechanic()) {
|
||||
if ($user->role === 'mechanic') {
|
||||
return $query->where('master_id', $user->id);
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user