vernova/database/seeders/RolePermissionSeeder.php

<?php

namespace Database\Seeders;

use App\Models\Tenant;
use Illuminate\Database\Seeder;
use Spatie\Permission\Models\Permission;
use Spatie\Permission\Models\Role;

class RolePermissionSeeder extends Seeder
{
    /**
     * Run the database seeds.
     */
    public function run(): void
    {
        // 1. Create Permissions
        $permissions = $this->getPermissions();

        foreach ($permissions as $name) {
            Permission::firstOrCreate(
                ['name' => $name, 'guard_name' => 'web']
            );
        }

        $this->command->info('Permissions seeded: ' . count($permissions) . ' created.');

        // 2. Create Roles
        $roles = ['super-admin', 'admin', 'project-manager', 'accountant', 'employee'];

        // Super-admin role at the platform level (no tenant)
        Role::firstOrCreate(
            ['name' => 'super-admin', 'guard_name' => 'web', 'tenant_id' => null]
        )->syncPermissions($permissions);

        // Tenant-scoped roles
        $tenants = Tenant::all();

        foreach ($tenants as $tenant) {
            foreach ($roles as $roleName) {
                if ($roleName === 'super-admin') {
                    continue;
                }

                Role::firstOrCreate(
                    ['name' => $roleName, 'guard_name' => 'web', 'tenant_id' => $tenant->id]
                );
            }
        }

        // 3. Assign Permissions to Tenant-Scoped Roles
        foreach ($tenants as $tenant) {
            $this->assignRolePermissions($tenant);
        }

        $this->command->info('Roles seeded for ' . $tenants->count() . ' tenants.');
    }

    protected function getPermissions(): array
    {
        return [
            // Projects
            'projects.view',
            'projects.create',
            'projects.update',
            'projects.delete',

            // Tasks
            'tasks.view',
            'tasks.create',
            'tasks.update',
            'tasks.delete',
            'tasks.update-status',

            // Employees
            'employees.view',
            'employees.create',
            'employees.update',
            'employees.delete',
            'employees.view-financials',

            // Expenses
            'expenses.view',
            'expenses.create',
            'expenses.update',
            'expenses.delete',
            'expenses.approve',

            // Inventory
            'inventory.view',
            'inventory.create',
            'inventory.update',
            'inventory.delete',

            // Letters (Correspondence)
            'letters.view',
            'letters.create',
            'letters.update',
            'letters.delete',
            'letters.manage',

            // Documents
            'documents.view',
            'documents.create',
            'documents.update',
            'documents.delete',
            'documents.manage',

            // Payroll
            'payroll.view',
            'payroll.create',
            'payroll.manage',

            // Reports
            'reports.view',
            'reports.export',

            // Petty Cash
            'petty-cash.view',
            'petty-cash.create',
            'petty-cash.update',
            'petty-cash.delete',
            'petty-cash.approve',
        ];
    }

    protected function assignRolePermissions(Tenant $tenant): void
    {
        // Admin — full access within the tenant
        $admin = Role::where('name', 'admin')
            ->where('tenant_id', $tenant->id)
            ->first();

        if ($admin) {
            $admin->syncPermissions($this->getPermissions());
        }

        // Project Manager
        $pm = Role::where('name', 'project-manager')
            ->where('tenant_id', $tenant->id)
            ->first();

        if ($pm) {
            $pm->syncPermissions([
                'projects.view',
                'projects.create',
                'projects.update',
                'tasks.view',
                'tasks.create',
                'tasks.update',
                'tasks.delete',
                'tasks.update-status',
                'employees.view',
                'expenses.view',
                'expenses.create',
                'expenses.update',
                'expenses.approve',
                'letters.view',
                'letters.create',
                'letters.update',
                'documents.view',
                'documents.create',
                'documents.update',
                'petty-cash.view',
                'petty-cash.create',
                'reports.view',
                'reports.export',
            ]);
        }

        // Accountant
        $accountant = Role::where('name', 'accountant')
            ->where('tenant_id', $tenant->id)
            ->first();

        if ($accountant) {
            $accountant->syncPermissions([
                'projects.view',
                'tasks.view',
                'employees.view',
                'employees.view-financials',
                'expenses.view',
                'expenses.create',
                'expenses.update',
                'expenses.approve',
                'petty-cash.view',
                'petty-cash.create',
                'petty-cash.approve',
                'payroll.view',
                'payroll.create',
                'payroll.manage',
                'letters.view',
                'documents.view',
                'reports.view',
                'reports.export',
            ]);
        }

        // Employee
        $employee = Role::where('name', 'employee')
            ->where('tenant_id', $tenant->id)
            ->first();

        if ($employee) {
            $employee->syncPermissions([
                'projects.view',
                'tasks.view',
                'tasks.update-status',
                'expenses.view',
                'expenses.create',
                'letters.view',
                'documents.view',
            ]);
        }
    }
}