timebank-cc-public/database/seeders/PermissionRoleSeeder.php

<?php

namespace Database\Seeders;

use Illuminate\Database\Seeder;
use Illuminate\Support\Facades\DB;
use Spatie\Permission\Models\Permission;
use Spatie\Permission\Models\Role;
use Spatie\Permission\PermissionRegistrar;

class PermissionRoleSeeder extends Seeder
{
    /**
     * Create the initial roles and permissions.
     * To re-seed this PermissionRoleSeeder after any changes use:
     * php artisan db:seed --class=PermissionRoleSeeder
     *
     * @return void
     */
    public function run()
    {
        // Reset cached roles and permissions
        app()[PermissionRegistrar::class]->forgetCachedPermissions();

        // Disable foreign key constraints
        DB::statement('SET FOREIGN_KEY_CHECKS=0;');

        // Truncate the tables in case you are re-seeding
        DB::table('role_has_permissions')->truncate();
        DB::table('roles')->truncate();
        DB::table('permissions')->truncate();
        // Comment line below to preserve the existing roles attached to the models
        //DB::table('model_has_roles')->truncate();
        // Comment line below to preserve the existing permissions attached to the  models
        //DB::table('model_has_permissions')->truncate();

        // Re-enable foreign key constraints
        DB::statement('SET FOREIGN_KEY_CHECKS=1;');

        // Permission naming convention: "{action} {resource}"
        //
        // Actions per resource (low-risk → high-risk):
        //   view       – read-only access to the manage screen
        //   create     – add new records
        //   update     – edit existing records
        //   publish    – make a record publicly visible
        //   unpublish  – hide a published record
        //   delete     – remove records (soft or hard)
        //   send       – irreversible external dispatch (mailings only)
        //   manage     – umbrella for all of the above
        //
        // Adding a new resource: follow the same pattern, add all applicable
        // action permissions plus the "manage {resource}" umbrella.

        // Posts
        Permission::create(['name' => 'view posts']);
        Permission::create(['name' => 'create posts']);
        Permission::create(['name' => 'update posts']);
        Permission::create(['name' => 'publish posts']);
        Permission::create(['name' => 'unpublish posts']);
        Permission::create(['name' => 'delete posts']);
        Permission::create(['name' => 'manage posts']); // all of the above

        // Tags
        Permission::create(['name' => 'view tags']);
        Permission::create(['name' => 'create tags']);
        Permission::create(['name' => 'update tags']);
        Permission::create(['name' => 'delete tags']);
        Permission::create(['name' => 'manage tags']);

        // Categories
        Permission::create(['name' => 'view categories']);
        Permission::create(['name' => 'create categories']);
        Permission::create(['name' => 'update categories']);
        Permission::create(['name' => 'delete categories']);
        Permission::create(['name' => 'manage categories']);

        // Calls
        Permission::create(['name' => 'view calls']);
        Permission::create(['name' => 'create calls']);
        Permission::create(['name' => 'update calls']);
        Permission::create(['name' => 'publish calls']);
        Permission::create(['name' => 'unpublish calls']);
        Permission::create(['name' => 'delete calls']);
        Permission::create(['name' => 'manage calls']);

        // Mailings
        Permission::create(['name' => 'view mailings']);
        Permission::create(['name' => 'create mailings']);
        Permission::create(['name' => 'update mailings']);
        Permission::create(['name' => 'send mailings']);   // schedule/send — irreversible
        Permission::create(['name' => 'delete mailings']);
        Permission::create(['name' => 'manage mailings']);

        // Users
        Permission::create(['name' => 'view users']);
        Permission::create(['name' => 'create users']);
        Permission::create(['name' => 'update users']);
        Permission::create(['name' => 'delete users']);
        Permission::create(['name' => 'manage users']);

        // User projects
        Permission::create(['name' => 'view user_projects']);
        Permission::create(['name' => 'create user_projects']);
        Permission::create(['name' => 'update user_projects']);
        Permission::create(['name' => 'delete user_projects']);
        Permission::create(['name' => 'manage user_projects']);

        // Organizations
        Permission::create(['name' => 'view organizations']);
        Permission::create(['name' => 'create organizations']);
        Permission::create(['name' => 'update organizations']);
        Permission::create(['name' => 'delete organizations']);
        Permission::create(['name' => 'manage organizations']);

        // Banks
        Permission::create(['name' => 'view banks']);
        Permission::create(['name' => 'create banks']);
        Permission::create(['name' => 'update banks']);
        Permission::create(['name' => 'delete banks']);
        Permission::create(['name' => 'manage banks']);

        // Admins
        Permission::create(['name' => 'view admins']);
        Permission::create(['name' => 'create admins']);
        Permission::create(['name' => 'update admins']);
        Permission::create(['name' => 'delete admins']);
        Permission::create(['name' => 'manage admins']);

        // Accounts
        Permission::create(['name' => 'view accounts']);
        Permission::create(['name' => 'create accounts']);
        Permission::create(['name' => 'update accounts']);
        Permission::create(['name' => 'delete accounts']);
        Permission::create(['name' => 'manage accounts']);

        // Cross-resource umbrellas
        Permission::create(['name' => 'manage profiles']);    // all profile types combined
        Permission::create(['name' => 'manage permissions']); // spatie permissions table
        Permission::create(['name' => 'manage roles']);        // admin_roles table

        // create roles and assign existing permissions
        $siteEditor = Role::create(['name' => 'site-editor']);
        $siteEditor->givePermissionTo('manage posts');
        $siteEditor->givePermissionTo('manage tags');
        $siteEditor->givePermissionTo('manage categories');
        $siteEditor->givePermissionTo('manage calls');

        $bankAdmin = Role::create(['name' => 'bank-manager']);
        $bankAdmin->givePermissionTo('manage users');
        $bankAdmin->givePermissionTo('manage user_projects');
        $bankAdmin->givePermissionTo('manage organizations');
        $bankAdmin->givePermissionTo('manage accounts');

        $admin = Role::create(['name' => 'admin']);
        $admin->givePermissionTo('manage posts');
        $admin->givePermissionTo('manage tags');
        $admin->givePermissionTo('manage categories');
        $admin->givePermissionTo('manage calls');
        $admin->givePermissionTo('manage mailings');
        $admin->givePermissionTo('manage users');
        $admin->givePermissionTo('manage user_projects');
        $admin->givePermissionTo('manage organizations');
        $admin->givePermissionTo('manage banks');
        $admin->givePermissionTo('manage admins');
        $admin->givePermissionTo('manage profiles');
        $admin->givePermissionTo('manage accounts');
        $admin->givePermissionTo('manage permissions');
        $admin->givePermissionTo('manage roles');


        $organizationCoordinator = Role::create(['name' => 'organization-coordinator']);
        $organizationCoordinator->givePermissionTo('manage organizations');

        $bankCoordinator = Role::create(['name' => 'bank-coordinator']);
        $bankCoordinator->givePermissionTo('manage banks');

        $superAdmin = Role::create(['name' => 'super-admin']);
        // Gets all permissions via Gate::before rule; see AuthServiceProvider


        // // create demo users
        // $user = \App\Models\User::factory()->create([
        //     'name' => 'Example User',
        //     'email' => 'test@example.com',
        // ]);
        // $user->assignRole($siteEditor);

        // $user = \App\Models\User::factory()->create([
        //     'name' => 'Example Admin User',
        //     'email' => 'admin@example.com',
        // ]);
        // $user->assignRole($bankAdmin);

        // $user = \App\Models\User::factory()->create([
        //     'name' => 'Example Super-Admin User',
        //     'email' => 'superadmin@example.com',
        // ]);
        // $user->assignRole($role3);
    }
}