Vasyka/autocrm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: use role column directly in WO query — drop isMechanic() Spatie dep

Browse Source 
isMechanic() calls hasAnyRole(['mechanic']) via Spatie which checks the
model_has_roles table with team_id scoping. If roles are not correctly
seeded for a tenant, admins/owners could accidentally pass the mechanic
filter and see only WOs where master_id = their own id (i.e. nothing).

Now uses $user->role === 'mechanic' directly — no Spatie involved —
so admin/owner/manager always see all WOs in their tenant.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Vasyka
2026-09-06 10:40:19 +00:00
parent 7b1d296bd4
commit ebc4fe0f23
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Filament/Tenant/Resources/WorkOrderResource.php
+5 -5
View File
@@ -247,9 +247,10 @@ class WorkOrderResource extends Resource
} }
/** /**
* Mechanics see only WOs assigned to them. * Mechanics (role='mechanic') see only WOs assigned to them.
* Everyone else (admin, manager, receptionist, accountant, viewer) sees all. * All other roles see everything in the current tenant.
* TenantScope already filters by company_id, so no cross-tenant leak is possible. * Uses role column directly — no Spatie dependency — to avoid
* team_id misconfiguration causing wrong results.
*/ */
public static function getEloquentQuery(): Builder public static function getEloquentQuery(): Builder
{ {
@@ -258,8 +259,7 @@ class WorkOrderResource extends Resource
if (! $user) return $query->whereRaw('0 = 1'); if (! $user) return $query->whereRaw('0 = 1');
// Mechanic role: show only WOs where they are the assigned master. if ($user->role === 'mechanic') {
if ($user->isMechanic()) {
return $query->where('master_id', $user->id); return $query->where('master_id', $user->id);
} }