From 0c44bfa6d0839c232eb0e01a87bf2d1778cd2605 Mon Sep 17 00:00:00 2001
From: Malek Tellissi <malek@tellissi.com>
Date: Sun, 13 Sep 2026 02:03:46 +0200
Subject: [PATCH] Implement role-based access control and revert hardcoded
 OAuth credentials

- sms-admin: full access (create, edit, delete)
- sms-manager: create and edit only, no delete
- sms-viewer: read-only, all write buttons hidden
- Apply EnforcesRolesInRelation trait to BatchesRelationManager
- Revert Nextcloud OAuth credentials to env vars (OAUTH_CLOUDSPICESBLUE_*)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .../BatchesRelationManager.php                |  2 ++
 app/Traits/EnforcesRoles.php                  | 13 +++-------
 app/Traits/EnforcesRolesInRelation.php        | 26 +++++++++++++++++++
 config/services.php                           |  6 ++---
 4 files changed, 35 insertions(+), 12 deletions(-)
 create mode 100644 app/Traits/EnforcesRolesInRelation.php

diff --git a/app/Filament/User/Resources/ProductResource/RelationManagers/BatchesRelationManager.php b/app/Filament/User/Resources/ProductResource/RelationManagers/BatchesRelationManager.php
index c39ddf1..f42bb0f 100644
--- a/app/Filament/User/Resources/ProductResource/RelationManagers/BatchesRelationManager.php
+++ b/app/Filament/User/Resources/ProductResource/RelationManagers/BatchesRelationManager.php
@@ -6,6 +6,7 @@ use App\Models\Farmer;
 use App\Models\ProductSize;
 use App\Models\Recipe;
 use App\Models\Spice;
+use App\Traits\EnforcesRolesInRelation;
 use Filament\Forms;
 use Filament\Forms\Form;
 use Filament\Forms\Get;
@@ -16,6 +17,7 @@ use Illuminate\Support\HtmlString;
 
 class BatchesRelationManager extends RelationManager
 {
+    use EnforcesRolesInRelation;
     protected static string $relationship = 'batches';
     protected static ?string $title = 'Chargen (LOT)';
     protected static ?string $modelLabel = 'Charge';
diff --git a/app/Traits/EnforcesRoles.php b/app/Traits/EnforcesRoles.php
index db7bc23..df2af12 100644
--- a/app/Traits/EnforcesRoles.php
+++ b/app/Traits/EnforcesRoles.php
@@ -6,28 +6,23 @@ use Illuminate\Database\Eloquent\Model;
 
 trait EnforcesRoles
 {
-    private static function canWrite(): bool
+    public static function canCreate(): bool
     {
         return auth()->user()?->hasAnyRole(['sms-admin', 'sms-manager']) ?? false;
     }
 
-    public static function canCreate(): bool
-    {
-        return static::canWrite();
-    }
-
     public static function canEdit(Model $record): bool
     {
-        return static::canWrite();
+        return auth()->user()?->hasAnyRole(['sms-admin', 'sms-manager']) ?? false;
     }
 
     public static function canDelete(Model $record): bool
     {
-        return static::canWrite();
+        return auth()->user()?->hasRole('sms-admin') ?? false;
     }
 
     public static function canDeleteAny(): bool
     {
-        return static::canWrite();
+        return auth()->user()?->hasRole('sms-admin') ?? false;
     }
 }
diff --git a/app/Traits/EnforcesRolesInRelation.php b/app/Traits/EnforcesRolesInRelation.php
new file mode 100644
index 0000000..fdb72f0
--- /dev/null
+++ b/app/Traits/EnforcesRolesInRelation.php
@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Traits;
+
+trait EnforcesRolesInRelation
+{
+    public function canCreate(): bool
+    {
+        return auth()->user()?->hasAnyRole(['sms-admin', 'sms-manager']) ?? false;
+    }
+
+    public function canEdit(): bool
+    {
+        return auth()->user()?->hasAnyRole(['sms-admin', 'sms-manager']) ?? false;
+    }
+
+    public function canDelete(): bool
+    {
+        return auth()->user()?->hasRole('sms-admin') ?? false;
+    }
+
+    public function canDeleteAny(): bool
+    {
+        return auth()->user()?->hasRole('sms-admin') ?? false;
+    }
+}
diff --git a/config/services.php b/config/services.php
index b129012..2c28650 100644
--- a/config/services.php
+++ b/config/services.php
@@ -36,9 +36,9 @@ return [
     ],
 
     'nextcloud' => [
-        'client_id'     => 'IxZ1RQgoRxlgKcplVHFWDYhFFlOieX34X3ceSvb0KkkZJ5xKxTZ6Rxozs5rwZR7h',
-        'client_secret' => 'gSdG1hJSTqHq6jaVLWbINB22ZfNZZsMmufCloZ3jcgWaoBIJSNEeqm0yhe3jyxnu',
-        'redirect'      => 'https://sms.spices.blue/auth/nextcloud/callback',
+        'client_id'     => env('OAUTH_CLOUDSPICESBLUE_ID'),
+        'client_secret' => env('OAUTH_CLOUDSPICESBLUE_SECRETKEY'),
+        'redirect'      => env('OAUTH_CLOUDSPICESBLUE_REDIRECTURI', 'https://sms.spices.blue/auth/nextcloud/callback'),
         'instance_uri'  => 'https://cloud.spices.blue',
     ],