Implement role-based access control and revert hardcoded OAuth credentials

- sms-admin: full access (create, edit, delete)
- sms-manager: create and edit only, no delete
- sms-viewer: read-only, all write buttons hidden
- Apply EnforcesRolesInRelation trait to BatchesRelationManager
- Revert Nextcloud OAuth credentials to env vars (OAUTH_CLOUDSPICESBLUE_*)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/Filament/User/Resources/ProductResource/RelationManagers/BatchesRelationManager.php

@@ -6,6 +6,7 @@ use App\Models\Farmer;
 use App\Models\ProductSize;
 use App\Models\Recipe;
 use App\Models\Spice;
+use App\Traits\EnforcesRolesInRelation;
 use Filament\Forms;
 use Filament\Forms\Form;
 use Filament\Forms\Get;
@@ -16,6 +17,7 @@ use Illuminate\Support\HtmlString;
 
 class BatchesRelationManager extends RelationManager
 {
+    use EnforcesRolesInRelation;
     protected static string $relationship = 'batches';
     protected static ?string $title = 'Chargen (LOT)';
     protected static ?string $modelLabel = 'Charge';

app/Traits/EnforcesRoles.php

@@ -6,28 +6,23 @@ use Illuminate\Database\Eloquent\Model;
 
 trait EnforcesRoles
 {
-    private static function canWrite(): bool
+    public static function canCreate(): bool
     {
         return auth()->user()?->hasAnyRole(['sms-admin', 'sms-manager']) ?? false;
     }
 
-    public static function canCreate(): bool
-    {
-        return static::canWrite();
-    }
-
     public static function canEdit(Model $record): bool
     {
-        return static::canWrite();
+        return auth()->user()?->hasAnyRole(['sms-admin', 'sms-manager']) ?? false;
     }
 
     public static function canDelete(Model $record): bool
     {
-        return static::canWrite();
+        return auth()->user()?->hasRole('sms-admin') ?? false;
     }
 
     public static function canDeleteAny(): bool
     {
-        return static::canWrite();
+        return auth()->user()?->hasRole('sms-admin') ?? false;
     }
 }

app/Traits/EnforcesRolesInRelation.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Traits;
+
+trait EnforcesRolesInRelation
+{
+    public function canCreate(): bool
+    {
+        return auth()->user()?->hasAnyRole(['sms-admin', 'sms-manager']) ?? false;
+    }
+
+    public function canEdit(): bool
+    {
+        return auth()->user()?->hasAnyRole(['sms-admin', 'sms-manager']) ?? false;
+    }
+
+    public function canDelete(): bool
+    {
+        return auth()->user()?->hasRole('sms-admin') ?? false;
+    }
+
+    public function canDeleteAny(): bool
+    {
+        return auth()->user()?->hasRole('sms-admin') ?? false;
+    }
+}

config/services.php

@@ -36,9 +36,9 @@ return [
     ],
 
     'nextcloud' => [
-        'client_id'     => 'IxZ1RQgoRxlgKcplVHFWDYhFFlOieX34X3ceSvb0KkkZJ5xKxTZ6Rxozs5rwZR7h',
-        'client_secret' => 'gSdG1hJSTqHq6jaVLWbINB22ZfNZZsMmufCloZ3jcgWaoBIJSNEeqm0yhe3jyxnu',
-        'redirect'      => 'https://sms.spices.blue/auth/nextcloud/callback',
+        'client_id'     => env('OAUTH_CLOUDSPICESBLUE_ID'),
+        'client_secret' => env('OAUTH_CLOUDSPICESBLUE_SECRETKEY'),
+        'redirect'      => env('OAUTH_CLOUDSPICESBLUE_REDIRECTURI', 'https://sms.spices.blue/auth/nextcloud/callback'),
         'instance_uri'  => 'https://cloud.spices.blue',
     ],