Chapter 4 - Roles and Permissions

Authorization Stack

• SaaS mode: Spatie Permission Package guards "web" with custom models (App\Models\Role, App\Models\Permission) extending Spatie base classes.
• Non-SaaS mode: directly reference role stored in workspace_members.role; no Spatie in use — HandleInertiaRequests constructs a Role object to get permissions.
• Multi-role: Spatie supports multiple roles; observed seeds use single roles per user.
• Middleware: role, permission, permissions (CheckMultiplePermissions), role_or_permission.
• Route-level permission strings e.g. ->middleware('permission:project_view').

Roles (seed)

• super admin: all permissions, SaaS only.
• company: full plan + operational permissions under SaaS; non-SaaS adds marketing/content/admin tuple.
• owner: label is "Owner with read-only access" but grants same as company. (Ambiguity vs label)
• manager: firm level (slice).
• member: staff-level explicit list.
• client: restrictive (can view, some read, invoices, budget reads).

Grants Summary

• Total permissions: 286 across 31 modules (PermissionSeeder gave count).
• Grants by role given in database seeders/RoleSeeder $rolePermissions; see detailed seed for exhaustive matrix.
• Module list includes budget, bugs, company, contact, coupon, currency, custom_page, dashboards, email_template, expense, expense_approval, invoice, landing_page, language, media, newsletter, notification_template, payment, permission, plan, projects, referral, report, role, settings, tasks, timesheet, user, webhook, workspace, zoom_meeting.

Frontend Authorization

resources/js/utils/authorization.ts, permissions.ts, rolePermissions.ts + HandleInertiaRequests updates user's roles + permissions into inertia page props.

Cross-user data risk / notes

• autoApplyPermissionCheck active only in 3 controllers, so there may be inconsistent scoping depending on repository queries.
• No global tenant scope; scoping relies on manually filtering columns; logic verification remains recommended (audit by QA).
• Client role definition includes broad budget_view_* rights, and for a limited extent the ability of budget_create/update/delete; please review intended segregation.
• specialties/seniority_level have a user-level field, but naive consolidated permissions not enforced via gates.