# Company Panel Policies System
## Overview
Policies have been created for all main modules in the company panel to implement role-based access control (RBAC) with multivendor isolation.
## Policy Modules
### Newly Created Policies
1. **StayPolicy** (`app/Policies/StayPolicy.php`)
- Manages access to stay records
- Methods: viewAny, view, create, update, delete, checkout, exportEsti
- Multivendor isolation via company_id check through booking->venue relationship
2. **PaymentPolicy** (`app/Policies/PaymentPolicy.php`)
- Manages access to payment records
- Methods: viewAny, view, create, update, delete
- Multivendor isolation via company_id check through booking->venue relationship
3. **FacilityPolicy** (`app/Policies/FacilityPolicy.php`)
- Manages access to facility records
- Methods: viewAny, view, create, update, delete
- Multivendor isolation via company_id check through venue relationship
4. **ServicePolicy** (`app/Policies/ServicePolicy.php`)
- Manages access to service records
- Methods: viewAny, view, create, update, delete
- Multivendor isolation via company_id check
5. **PackagePolicy** (`app/Policies/PackagePolicy.php`)
- Manages access to package records
- Methods: viewAny, view, create, update, delete
- Multivendor isolation via company_id check
6. **DocumentPolicy** (`app/Policies/DocumentPolicy.php`)
- Manages access to encrypted documents
- Methods: viewAny, view, create, update, delete, download, share, grantAccess, revokeAccess, viewAccessLogs, restore, forceDelete
- Explicit access control system with grants
- Multivendor isolation via company_id
### Existing Policies
The following policies already existed in the system:
- VenuePolicy
- ReservationPolicy (for bookings)
- InvoicePolicy
- ClientPolicy
- UserPolicy
- RolePolicy
- VenueObjectPolicy
- ProductPolicy
- ActivityPolicy
- EmailPolicy
- FiscalDevicePolicy
- FiscalReceiptPolicy
- FiscalReceiptQueuePolicy
- GalleryPolicy
- GalleryItemPolicy
- OperatorPolicy
- PaymentTransactionPolicy
- RecentEntryPolicy
- ReviewPolicy
- TokenPolicy
- VenueFacilityPolicy
- VenueMenuItemPolicy
- VenueMenuPolicy
- VenueObjectTypePolicy
- VenuePlanPolicy
- VenueSpotPolicy
- WorkspacePolicy
## Company Panel Modules Coverage
All main modules in the company panel now have corresponding policies:
| Module | Policy | Status |
|--------|--------|--------|
| Dashboard | N/A (no model) | N/A |
| Venues | VenuePolicy | ✅ Existing |
| Bookings | ReservationPolicy | ✅ Existing |
| Invoices | InvoicePolicy | ✅ Existing |
| Clients | ClientPolicy | ✅ Existing |
| Documents | DocumentPolicy | ✅ New |
| Users | UserPolicy | ✅ Existing |
| Stays | StayPolicy | ✅ New |
| Payments | PaymentPolicy | ✅ New |
| Facilities | FacilityPolicy | ✅ New |
| Roles | RolePolicy | ✅ Existing |
| Venue Objects | VenueObjectPolicy | ✅ Existing |
| Services | ServicePolicy | ✅ New |
| Packages | PackagePolicy | ✅ New |
| Products | ProductPolicy | ✅ Existing |
| ESTI Export | N/A (no model) | N/A |
| Settings | N/A (no model) | N/A |
| Statistics | N/A (no model) | N/A |
## Policy Design Pattern
All policies follow a consistent design:
### Access Control Logic
1. **Role-based Access**:
- `isAdmin()`: Super admins, general managers, company managers, developers
- `isManager()`: Company managers, regional managers, venue managers, venue object template managers
- `isCompanyManager()`: Specifically checks for company_manager role
2. **Strict Company Isolation (Top-Level Security)**:
- **All users are restricted to their own company's resources**
- No user can access resources from another company
- This applies to super admins, company managers, and all other roles
- Company ID is always validated before granting access
- Prevents any cross-company data leakage
3. **Multivendor Security**:
- Checks user's company_id against resource's company_id
- Uses session('selected_company') as fallback
- Returns false if company IDs don't match
- Returns false if either company ID is missing
4. **Standard Methods**:
- `viewAny()`: List/index access (requires company)
- `view()`: Single record view (requires same company)
- `create()`: Create new records (requires company)
- `update()`: Edit existing records (requires same company)
- `delete()`: Delete records (requires same company)
### Additional Methods for Specific Modules
- **StayPolicy**: checkout(), exportEsti()
- **DocumentPolicy**: download(), share(), grantAccess(), revokeAccess(), viewAccessLogs(), restore(), forceDelete()
## Usage in Controllers
Policies are used in controllers via Laravel's authorization system:
```php
// Simple authorization
$this->authorize('view', $stay);
// Policy check with custom logic
if ($user->can('update', $facility)) {
// Allow update
}
// Blade template authorization
@can('update', $package)
<!-- Update button -->
@endcan
```
## Role and Permission Integration
The policies integrate with Laravel's Spatie Permission package:
### User Roles
- **super.admin**: Full access to all resources
- **general_manager**: Full company access
- **company_manager**: Full company access
- **regional_manager**: Regional venue access
- **venue_manager**: Specific venue access
- **company-manager**: Company management access
- **Developer**: Full system access
### Permission Checking
Policies check user roles through helper methods:
```php
$user->isAdmin() // Checks for admin roles (includes company_manager)
$user->isCompanyManager() // Specifically checks for company_manager role
$user->isManager() // Checks for manager roles (includes company_manager)
```
### Access Hierarchy
**Strict Company-Scoped Access (All Roles):**
- Super admins (only their own company)
- Company managers (only their own company)
- General managers (only their own company)
- Developers (only their own company)
- Regional managers (only their own company)
- Venue managers (only their own company)
- Venue object template managers (only their own company)
**Resource-Specific Access (Within Same Company):**
- Document owners (their own documents)
- Users with explicit access grants (for documents)
**No Cross-Company Access:**
- No role can access resources from another company
- This ensures top-level security and complete data isolation
## Multivendor Security
### Company Isolation (Top-Level Security)
**Strict Company Isolation for All Users:**
- All users (including super admins and company managers) can only access resources from their own company
- Company ID is mandatory and must match the resource's company ID
- Returns false if company IDs don't match
- Returns false if either user or resource has no company ID
**No Role-Based Exceptions:**
- No role can bypass company isolation
- This ensures complete data separation between companies
- Prevents any possibility of cross-company data access
- Provides top-level security for multivendor environment
### Session-based Company Selection
- Uses `session('selected_company')` for current company context
- Falls back to `user->company_id` if session not set
- Ensures proper scoping in multi-company environments for regular users
## Auto-Discovery
Laravel automatically discovers policies following the naming convention:
- Policy class: `ModelNamePolicy`
- Location: `app/Policies/`
- No manual registration required in AuthServiceProvider
## Testing Recommendations
1. **Role Testing**: Test each policy method with different user roles
2. **Company Isolation**: Verify users cannot access other companies' data
3. **Edge Cases**: Test with users who have no company, multiple companies
4. **Session Handling**: Test with and without selected_company in session
## Next Steps
1. Integrate policies into CompanyAdminController methods
2. Add policy checks to blade templates
3. Create permission seeder for default roles
4. Add policy middleware to routes where needed
5. Document custom permission requirements for each module
6. Create admin UI for managing custom permissions
## Notes
- All new policies follow the existing codebase patterns
- Multivendor isolation is consistent across all policies
- DocumentPolicy has additional explicit access control system
- Policies are auto-discovered by Laravel, no manual registration needed