Poprawki w rolach

Extended view widzi wszystko

app/Http/Controllers/AdvanceController.php

@@ -14,7 +14,7 @@ class AdvanceController extends Controller
     {
         $query = Advance::with(['user', 'type']);
 
-        if ($request->user()->hasRole('pracownik')) {
+        if (! $request->user()->can('extended_view')) {
             $query->where('user_id', $request->user()->id);
         }
 
@@ -52,9 +52,9 @@ class AdvanceController extends Controller
     public function create()
     {
         $types = AdvanceType::orderBy('name')->get();
-        $users = request()->user()->hasRole('pracownik')
+        $users = request()->user()->can('extended_view')
-            ? collect()
+            ? User::orderBy('name')->orderBy('surname')->get()
-            : User::orderBy('name')->orderBy('surname')->get();
+            : collect([request()->user()]);
 
         return view('zaliczki.create', compact('types', 'users'));
     }
@@ -75,9 +75,9 @@ class AdvanceController extends Controller
     {
         $this->authorizeAccess($request, $advance);
         $types = AdvanceType::orderBy('name')->get();
-        $users = $request->user()->hasRole('pracownik')
+        $users = $request->user()->can('extended_view')
-            ? collect()
+            ? User::orderBy('name')->orderBy('surname')->get()
-            : User::orderBy('name')->orderBy('surname')->get();
+            : collect([$request->user()]);
 
         return view('zaliczki.edit', compact('advance', 'types', 'users'));
     }
@@ -100,6 +100,6 @@ class AdvanceController extends Controller
 
     private function authorizeAccess(Request $request, Advance $advance): void
     {
-        abort_if($request->user()->hasRole('pracownik') && $advance->user_id !== $request->user()->id, 403);
+        abort_if(! $request->user()->can('extended_view') && $advance->user_id !== $request->user()->id, 403);
     }
 }

app/Http/Controllers/DashboardController.php

@@ -16,7 +16,7 @@ class DashboardController extends Controller
     {
         $user = auth()->user();
 
-        $showAllDashboard = $user?->hasPermissionTo('show_all_dashbaord') ?? false;
+        $showAllDashboard = $user?->hasPermissionTo('extended_view') ?? false;
 
         if (! $showAllDashboard) {
             $myVehicles = $user->vehicles()->orderBy('brand')->orderBy('model')->get();

app/Http/Controllers/UserController.php

@@ -24,6 +24,10 @@ class UserController extends Controller
 
             $query = User::with('roles')->whereNull('deleted_at');
 
+            if (! $request->user()->can('extended_view')) {
+                $query->whereKey($request->user()->id);
+            }
+
             // Wyszukiwanie w imieniu, nazwisku i adresie email
             if ($search) {
                 $query->where(function ($q) use ($search) {
@@ -56,6 +60,10 @@ class UserController extends Controller
 
         $query = User::with('roles')->onlyTrashed();
 
+        if (! $request->user()->can('extended_view')) {
+            $query->whereKey($request->user()->id);
+        }
+
         if ($search) {
             $query->where(function ($q) use ($search) {
                 $q->where('name', 'like', "%{$search}%")
@@ -117,6 +125,7 @@ class UserController extends Controller
      */
     public function show(User $user)
     {
+        $this->authorizeUserAccess($user);
         $user->load(['roles', 'advances.type']);
 
         return view('users.show', [
@@ -127,6 +136,7 @@ class UserController extends Controller
 
     public function edit(User $user)
     {
+        $this->authorizeUserAccess($user);
         $roles = Role::all();
 
         return view('users.edit', compact('user', 'roles'));
@@ -137,6 +147,7 @@ class UserController extends Controller
      */
     public function update(Request $request, User $user)
     {
+        $this->authorizeUserAccess($user);
         $validated = $request->validate([
             'name'    => ['required', 'string', 'max:255'],
             'surname' => ['required', 'string', 'max:255'],
@@ -161,6 +172,7 @@ class UserController extends Controller
      */
     public function destroy(User $user)
     {
+        $this->authorizeUserAccess($user);
         // Blokada usunięcia samego siebie
         if (auth()->id() === $user->id) {
             return redirect()->back()->with('error', 'Nie możesz usunąć własnego konta!');
@@ -174,8 +186,14 @@ class UserController extends Controller
     public function restore($userId)
     {
         $user = User::withTrashed()->findOrFail($userId);
+        $this->authorizeUserAccess($user);
         $user->restore();
 
         return redirect()->route('users.deleted')->with('status', 'Użytkownik został przywrócony.');
     }
+
+    private function authorizeUserAccess(User $user): void
+    {
+        abort_unless(auth()->user()->can('extended_view') || auth()->id() === $user->id, 403);
+    }
 }

app/Http/Controllers/VehicleController.php

@@ -13,7 +13,7 @@ class VehicleController extends Controller
     {
         $query = Vehicle::with('user');
 
-        if ($request->user()->hasRole('pracownik')) {
+        if (! $request->user()->can('extended_view')) {
             $query->where('user_id', $request->user()->id);
         }
 
@@ -34,7 +34,7 @@ class VehicleController extends Controller
         }
 
         $vehicles = $query->orderBy('brand')->orderBy('registration_number')->paginate(15)->withQueryString();
-        $users = User::orderBy('name')->orderBy('surname')->get();
+        $users = $this->availableUsers($request);
 
         return view('flota', compact('vehicles', 'users'));
     }
@@ -43,7 +43,7 @@ class VehicleController extends Controller
     {
         $this->authorizeVehicleManagement($request);
 
-        $users = User::orderBy('name')->orderBy('surname')->get();
+        $users = $this->availableUsers($request);
 
         return view('flota.create', compact('users'));
     }
@@ -52,6 +52,10 @@ class VehicleController extends Controller
     {
         $this->authorizeVehicleManagement($request);
 
+        if (! $request->user()->can('extended_view')) {
+            $request->merge(['user_id' => $request->user()->id]);
+        }
+
         $validated = $request->validate([
             'brand' => ['required', 'string', 'max:255'],
             'model' => ['nullable', 'string', 'max:255'],
@@ -87,6 +91,10 @@ class VehicleController extends Controller
         $this->authorizeVehicleManagement($request);
         $this->authorizeVehicleAccess($request, $vehicle);
 
+        if (! $request->user()->can('extended_view')) {
+            $request->merge(['user_id' => $request->user()->id]);
+        }
+
         $validated = $request->validate([
             'brand' => ['required', 'string', 'max:255'],
             'model' => ['nullable', 'string', 'max:255'],
@@ -124,8 +132,15 @@ class VehicleController extends Controller
 
     private function authorizeVehicleAccess(Request $request, Vehicle $vehicle): void
     {
-        if ($request->user()->hasRole('pracownik') && $vehicle->user_id !== $request->user()->id) {
+        if (! $request->user()->can('extended_view') && $vehicle->user_id !== $request->user()->id) {
             abort(403);
         }
     }
+
+    private function availableUsers(Request $request)
+    {
+        return $request->user()->can('extended_view')
+            ? User::orderBy('name')->orderBy('surname')->get()
+            : User::whereKey($request->user()->id)->get();
+    }
 }

app/Http/Requests/StoreAdvanceRequest.php

@@ -23,7 +23,7 @@ class StoreAdvanceRequest extends FormRequest
 
     protected function prepareForValidation(): void
     {
-        if ($this->user()?->hasRole('pracownik')) {
+        if (! $this->user()?->can('extended_view')) {
             $this->merge(['user_id' => $this->user()->id]);
         }
     }

database/migrations/2026_09_04_000003_rename_show_all_dashboard_permission.php

@@ -0,0 +1,32 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+use Spatie\Permission\PermissionRegistrar;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        $permissionsTable = config('permission.table_names.permissions', 'permissions');
+
+        DB::table($permissionsTable)
+            ->where('name', 'show_all_dashbaord')
+            ->where('guard_name', 'web')
+            ->update(['name' => 'extended_view', 'updated_at' => now()]);
+
+        app(PermissionRegistrar::class)->forgetCachedPermissions();
+    }
+
+    public function down(): void
+    {
+        $permissionsTable = config('permission.table_names.permissions', 'permissions');
+
+        DB::table($permissionsTable)
+            ->where('name', 'extended_view')
+            ->where('guard_name', 'web')
+            ->update(['name' => 'show_all_dashbaord', 'updated_at' => now()]);
+
+        app(PermissionRegistrar::class)->forgetCachedPermissions();
+    }
+};

database/seeders/DatabaseSeeder.php

@@ -24,7 +24,7 @@ class DatabaseSeeder extends Seeder
             'zaliczki_access',
             'users_access',
             'setting_access',
-            'show_all_dashbaord',
+            'extended_view',
         ];
 
         foreach ($permissions as $permission) {
@@ -42,7 +42,7 @@ class DatabaseSeeder extends Seeder
         $kierownikRole->syncPermissions([
             'users_access',
             'setting_access',
-            'show_all_dashbaord',
+            'extended_view',
             'raporty_access',
             'flota_access',
             'zaliczki_access',

tests/Feature/AdvanceTest.php

@@ -17,8 +17,8 @@ function userWithAdvanceAccess(string $roleName = 'pracownik'): User
     $role->givePermissionTo('zaliczki_access');
 
     if ($roleName === 'kierownik') {
-        Permission::firstOrCreate(['name' => 'show_all_dashbaord']);
+        Permission::firstOrCreate(['name' => 'extended_view']);
-        $role->givePermissionTo('show_all_dashbaord');
+        $role->givePermissionTo('extended_view');
     }
 
     $user->assignRole($role);
@@ -246,10 +246,11 @@ test('manager can filter advances by text type and date range', function () {
 
 test('manager can open employee profile and see current advance balance', function () {
     Permission::firstOrCreate(['name' => 'users_access']);
+    Permission::firstOrCreate(['name' => 'extended_view']);
 
     $manager = User::factory()->create();
     $managerRole = Role::firstOrCreate(['name' => 'kierownik']);
-    $managerRole->givePermissionTo(['zaliczki_access', 'users_access']);
+    $managerRole->givePermissionTo(['zaliczki_access', 'users_access', 'extended_view']);
     $manager->assignRole($managerRole);
 
     $employee = User::factory()->create(['name' => 'Jan', 'surname' => 'Kowalski']);

tests/Feature/UserSoftDeleteTest.php

@@ -6,11 +6,12 @@ use Spatie\Permission\Models\Role;
 
 test('user can be soft deleted and hidden from the list', function () {
     Permission::firstOrCreate(['name' => 'users_access']);
+    Permission::firstOrCreate(['name' => 'extended_view']);
 
     $admin = User::factory()->create();
     $adminRole = Role::firstOrCreate(['name' => 'admin']);
     $admin->assignRole($adminRole);
-    $admin->givePermissionTo('users_access');
+    $admin->givePermissionTo(['users_access', 'extended_view']);
 
     $user = User::factory()->create();
 
@@ -25,11 +26,12 @@ test('user can be soft deleted and hidden from the list', function () {
 
 test('deleted users can be listed and restored', function () {
     Permission::firstOrCreate(['name' => 'users_access']);
+    Permission::firstOrCreate(['name' => 'extended_view']);
 
     $admin = User::factory()->create();
     $adminRole = Role::firstOrCreate(['name' => 'admin']);
     $admin->assignRole($adminRole);
-    $admin->givePermissionTo('users_access');
+    $admin->givePermissionTo(['users_access', 'extended_view']);
 
     $user = User::factory()->create();
     $user->delete();
@@ -45,11 +47,12 @@ test('deleted users can be listed and restored', function () {
 
 test('edit page does not render nested forms for user actions', function () {
     Permission::firstOrCreate(['name' => 'users_access']);
+    Permission::firstOrCreate(['name' => 'extended_view']);
 
     $admin = User::factory()->create();
     $adminRole = Role::firstOrCreate(['name' => 'admin']);
     $admin->assignRole($adminRole);
-    $admin->givePermissionTo('users_access');
+    $admin->givePermissionTo(['users_access', 'extended_view']);
 
     $user = User::factory()->create();
 

tests/Feature/VehicleTest.php

@@ -16,8 +16,8 @@ function createFleetUser(string $roleName = 'pracownik'): User
     $role->givePermissionTo('flota_access');
 
     if ($roleName === 'kierownik') {
-        Permission::firstOrCreate(['name' => 'show_all_dashbaord']);
+        Permission::firstOrCreate(['name' => 'extended_view']);
-        $role->givePermissionTo('show_all_dashbaord');
+        $role->givePermissionTo('extended_view');
     }
 
     $user->assignRole($role);
@@ -181,10 +181,11 @@ test('dashboard shows vehicles with upcoming technical inspection or oc expiry w
 
 test('employee profile shows assigned vehicle with expire dates and insurance details', function () {
     Permission::firstOrCreate(['name' => 'users_access']);
+    Permission::firstOrCreate(['name' => 'extended_view']);
 
     $manager = User::factory()->create();
     $managerRole = Role::firstOrCreate(['name' => 'kierownik']);
-    $managerRole->givePermissionTo(['users_access', 'flota_access']);
+    $managerRole->givePermissionTo(['users_access', 'flota_access', 'extended_view']);
     $manager->assignRole($managerRole);
 
     $user = User::factory()->create();