autocrm/app/Models/Tenant/User.php

<?php

namespace App\Models\Tenant;

use App\Models\Concerns\BelongsToTenant;
use Filament\Models\Contracts\FilamentUser;
use Filament\Panel;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\SoftDeletes;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Spatie\Permission\Traits\HasRoles;

/**
 * Tenant-bound user. Belongs to exactly one Company.
 * UNIQUE(company_id, email) — same email can exist in different tenants
 * as completely separate accounts.
 */
class User extends Authenticatable implements FilamentUser
{
    use BelongsToTenant, HasFactory, HasRoles, Notifiable, SoftDeletes;

    /** Spatie Permission scope key matches the team_foreign_key (company_id). */
    protected $guard_name = 'web';

    protected $fillable = [
        'company_id', 'name', 'email', 'phone', 'avatar_url',
        'role', 'status', 'locale',
        'email_verified_at', 'password', 'last_login_at',
    ];

    protected $hidden = [
        'password', 'remember_token',
    ];

    protected function casts(): array
    {
        return [
            'email_verified_at' => 'datetime',
            'last_login_at' => 'datetime',
            'password' => 'hashed',
        ];
    }

    public function canAccessPanel(Panel $panel): bool
    {
        return $panel->getId() === 'tenant'
            && $this->status === 'active';
    }

    public function isAdmin(): bool
    {
        return $this->role === 'admin';
    }
}