Skip to content

[Permissions]: Enforce permissions in Quotes module #498

@nielsdrost7

Description

@nielsdrost7

Overview

Quotes is the second most permission-rich module after Invoices. All access control must move to Spatie permissions.

Permissions to enforce

Permission Where to enforce
view-quotes QuoteResource::canViewAny()
create-quotes QuoteResource::canCreate()
edit-quotes Edit page, table Edit action
delete-quotes Soft delete action, bulk delete
download-quotes Download PDF action
print-quotes Print action
email-quotes Email/send action
mark-sent-quotes Mark as sent action
approve-quotes Approve action
reject-quotes Reject action
duplicate-quotes Duplicate/copy action
convert-to-invoice-quotes Convert to invoice action
import-quotes Import action
export-quotes Export action
archive-quotes Archive action

Acceptance criteria

  • Each action above is hidden/disabled based on the corresponding permission
  • approve-quotes and reject-quotes are restricted to admin and above
  • client role can only view, download, and print their own quotes
  • convert-to-invoice-quotes is hidden for client_admin and below
  • No hasRole() calls remain in Quotes module Filament files

Files to update

  • Modules/Quotes/Filament/Company/Resources/QuoteResource.php and sub-directories

Dependencies

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions