autocrm/app/Filament/Tenant/Resources/UserResource/RelationManagers/PermissionOverridesRelationManager.php

<?php

namespace App\Filament\Tenant\Resources\UserResource\RelationManagers;

use App\Auth\Permissions;
use Filament\Actions;
use Filament\Forms;
use Filament\Resources\RelationManagers\RelationManager;
use Filament\Schemas;
use Filament\Schemas\Schema;
use Filament\Tables;
use Filament\Tables\Table;
use Spatie\Permission\Models\Permission;

class PermissionOverridesRelationManager extends RelationManager
{
    protected static string $relationship = 'permissionOverrides';

    protected static ?string $title = null;

    public static function getTitle(\Illuminate\Database\Eloquent\Model $ownerRecord, string $pageClass): string
    {
        return __('Excepții drepturi');
    }

    protected static string|\BackedEnum|null $icon = 'heroicon-o-shield-exclamation';

    public function form(Schema $schema): Schema
    {
        return $schema->components([
            Schemas\Components\Section::make(__('Excepție'))
                ->columns(2)
                ->schema([
                    Forms\Components\Select::make('permission_id')
                        ->label(__('Drept'))
                        ->required()
                        ->searchable()
                        ->options(function () {
                            $labels = Permissions::permissionLabels();
                            return Permission::orderBy('name')->get()
                                ->mapWithKeys(fn ($p) => [
                                    $p->id => ($labels[$p->name] ? __($labels[$p->name]) . " ({$p->name})" : $p->name),
                                ])->all();
                        })
                        ->helperText(__('Alege dreptul concret pe care vrei să-l acorzi (GRANT) sau să-l refuzi (DENY) pentru acest utilizator, indiferent de rolul lui.'))
                        ->columnSpanFull(),
                    Forms\Components\Select::make('mode')
                        ->required()
                        ->options(['grant' => __('GRANT — adaugă dreptul'), 'deny' => __('DENY — interzice dreptul')])
                        ->default('grant'),
                    Forms\Components\DatePicker::make('expires_at')
                        ->label(__('Expiră la (opțional)'))
                        ->minDate(now()),
                    Forms\Components\Textarea::make('reason')
                        ->label(__('Motiv'))
                        ->columnSpanFull()
                        ->placeholder(__('Ex: lockdown temporar; acces pentru audit; etc.'))
                        ->rows(2),
                ]),
        ]);
    }

    public function table(Table $table): Table
    {
        return $table
            ->recordTitleAttribute('mode')
            ->columns([
                Tables\Columns\TextColumn::make('permission.name')
                    ->label(__('Drept'))
                    ->searchable()
                    ->sortable()
                    ->formatStateUsing(function ($state) {
                        $labels = Permissions::permissionLabels();
                        return isset($labels[$state]) ? __($labels[$state]) . " ({$state})" : $state;
                    }),
                Tables\Columns\TextColumn::make('mode')
                    ->badge()
                    ->colors(['success' => 'grant', 'danger' => 'deny'])
                    ->formatStateUsing(fn ($state) => strtoupper($state)),
                Tables\Columns\TextColumn::make('reason')
                    ->limit(40)
                    ->placeholder('—'),
                Tables\Columns\TextColumn::make('expires_at')
                    ->label(__('Expiră'))
                    ->date()
                    ->placeholder(__('niciodată'))
                    ->color(fn ($record) => $record?->isExpired() ? 'danger' : 'gray'),
                Tables\Columns\TextColumn::make('grantedBy.name')
                    ->label(__('Acordat de'))
                    ->placeholder('—')
                    ->toggleable(),
            ])
            ->headerActions([
                Actions\CreateAction::make()
                    ->label(__('Adaugă excepție'))
                    ->modalHeading(__('Adaugă excepție de drept'))
                    ->mutateDataUsing(fn (array $data) => array_merge($data, [
                        'granted_at' => now(),
                        'granted_by_id' => auth()->id(),
                    ])),
            ])
            ->actions([
                Actions\EditAction::make()->modalHeading(__('Editează excepția')),
                Actions\DeleteAction::make(),
            ])
            ->emptyStateHeading(__('Nicio excepție'))
            ->emptyStateDescription(__('Rolurile utilizatorului îi acordă deja drepturi. Adaugă excepții doar când vrei să GRANT-uiești sau să DENY-uiești un drept specific pentru acest utilizator (peste rol).'))
            ->emptyStateIcon('heroicon-o-shield-exclamation')
            ->defaultSort('granted_at', 'desc');
    }
}