Ghassan Yusuf
2a2fac9cdf
Backend: real endpoints for role-permission overview, MQTT broker settings (with live reachability check), and SQLite backup download/restore (new system.manage permission, super-admin only; restore validates the SQLite file header and keeps a pre-restore safety copy). Desktop frontend: Roles (read-only permissions view), MQTT Settings, Backup & Restore wired to those endpoints; plus static AdminLTE-matching shells for Profile, Settings (embeds the real 2FA flow in its Security tab), Invoice, Calendar (FullCalendar), Chat, File Manager, and Projects. Mobile frontend: new frontend/src/styles/mobile.css, a from-scratch design system (purple theme, cards, slide-out sidebar, bottom tab bar) scoped entirely under a .mob-app root and mob- prefixed classes so it can never collide with the desktop Bootstrap/AdminLTE styling. Rebuilt TopBar/ BottomNav, added a new SlideOutNav, and reskinned the Dashboard and Users pages to it with real data.
54 lines
1.6 KiB
PHP
54 lines
1.6 KiB
PHP
<?php
|
|
|
|
namespace Database\Seeders;
|
|
|
|
use Illuminate\Database\Seeder;
|
|
use Spatie\Permission\Models\Permission;
|
|
use Spatie\Permission\Models\Role;
|
|
|
|
class RolePermissionSeeder extends Seeder
|
|
{
|
|
/**
|
|
* Permissions are named `{module}.{action}` so future modules just add
|
|
* their own rows here without any schema change.
|
|
*/
|
|
private const PERMISSIONS = [
|
|
'users.view', 'users.create', 'users.update', 'users.delete',
|
|
'roles.view', 'roles.assign',
|
|
'dashboard.view',
|
|
'audit.view',
|
|
'system.manage',
|
|
];
|
|
|
|
private const ROLE_PERMISSIONS = [
|
|
// super-admin gets everything, plus a Gate::before bypass (see AuthServiceProvider)
|
|
'super-admin' => self::PERMISSIONS,
|
|
'admin' => [
|
|
'users.view', 'users.create', 'users.update', 'users.delete',
|
|
'roles.view', 'roles.assign',
|
|
'dashboard.view', 'audit.view',
|
|
],
|
|
'manager' => [
|
|
'users.view', 'users.update',
|
|
'dashboard.view',
|
|
],
|
|
'user' => [
|
|
'dashboard.view',
|
|
],
|
|
];
|
|
|
|
public function run(): void
|
|
{
|
|
// Sanctum SPA (cookie) requests authenticate via the 'web' session
|
|
// guard, so roles/permissions must be registered under 'web' to be
|
|
// visible to $user->can()/hasRole() during normal API requests.
|
|
foreach (self::PERMISSIONS as $permission) {
|
|
Permission::findOrCreate($permission, 'web');
|
|
}
|
|
|
|
foreach (self::ROLE_PERMISSIONS as $role => $permissions) {
|
|
Role::findOrCreate($role, 'web')->syncPermissions($permissions);
|
|
}
|
|
}
|
|
}
|