latest

backend/database/seeders/DatabaseSeeder.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace Database\Seeders;
+
+use Illuminate\Database\Seeder;
+
+class DatabaseSeeder extends Seeder
+{
+    /**
+     * Seed the application's database.
+     */
+    public function run(): void
+    {
+        $this->call([
+            RolePermissionSeeder::class,
+            SuperAdminSeeder::class,
+        ]);
+    }
+}

backend/database/seeders/RolePermissionSeeder.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace Database\Seeders;
+
+use Illuminate\Database\Seeder;
+use Spatie\Permission\Models\Permission;
+use Spatie\Permission\Models\Role;
+
+class RolePermissionSeeder extends Seeder
+{
+    /**
+     * Permissions are named `{module}.{action}` so future modules just add
+     * their own rows here without any schema change.
+     */
+    private const PERMISSIONS = [
+        'users.view', 'users.create', 'users.update', 'users.delete',
+        'roles.view', 'roles.assign',
+        'dashboard.view',
+        'audit.view',
+    ];
+
+    private const ROLE_PERMISSIONS = [
+        // super-admin gets everything, plus a Gate::before bypass (see AuthServiceProvider)
+        'super-admin' => self::PERMISSIONS,
+        'admin' => [
+            'users.view', 'users.create', 'users.update', 'users.delete',
+            'roles.view', 'roles.assign',
+            'dashboard.view', 'audit.view',
+        ],
+        'manager' => [
+            'users.view', 'users.update',
+            'dashboard.view',
+        ],
+        'user' => [
+            'dashboard.view',
+        ],
+    ];
+
+    public function run(): void
+    {
+        // Sanctum SPA (cookie) requests authenticate via the 'web' session
+        // guard, so roles/permissions must be registered under 'web' to be
+        // visible to $user->can()/hasRole() during normal API requests.
+        foreach (self::PERMISSIONS as $permission) {
+            Permission::findOrCreate($permission, 'web');
+        }
+
+        foreach (self::ROLE_PERMISSIONS as $role => $permissions) {
+            Role::findOrCreate($role, 'web')->syncPermissions($permissions);
+        }
+    }
+}

backend/database/seeders/SuperAdminSeeder.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace Database\Seeders;
+
+use App\Models\User;
+use Illuminate\Database\Seeder;
+
+class SuperAdminSeeder extends Seeder
+{
+    public function run(): void
+    {
+        $email = env('SUPER_ADMIN_EMAIL', '[email protected]');
+        $username = env('SUPER_ADMIN_USERNAME', 'superadmin');
+        $password = env('SUPER_ADMIN_PASSWORD', 'password');
+
+        $user = User::firstOrCreate(
+            ['email' => $email],
+            [
+                'name' => 'Super Admin',
+                'username' => $username,
+                'password' => $password,
+                'email_verified_at' => now(),
+            ]
+        );
+
+        if (! $user->hasRole('super-admin')) {
+            $user->assignRole('super-admin');
+        }
+    }
+}