📄 RolePermissionSeeder.php

<?php

namespace Database\Seeders;

use Illuminate\Database\Seeder;
use Spatie\Permission\Models\Permission;
use Spatie\Permission\Models\Role;
use Spatie\Permission\PermissionRegistrar;

/**
 * RolePermissionSeeder
 *
 * Creates the 5 Phase 1 roles and assigns permissions.
 *
 * Roles:
 *   super_admin     — full access, bypasses all policy checks
 *   vendor          — manage own products, orders, shop profile
 *   customer        — browse, cart, checkout, own orders
 *   delivery_agent  — update shipping status, mark delivered
 *   moderator       — review content, manage categories (no financial access)
 */
class RolePermissionSeeder extends Seeder
{
    public function run(): void
    {
        // Reset cached roles and permissions
        app()[PermissionRegistrar::class]->forgetCachedPermissions();

        // ── Define permissions ────────────────────────────────────────────────
        $permissions = [
            // Products
            'products.view', 'products.create', 'products.update', 'products.delete',
            'products.publish',

            // Categories & Brands
            'categories.manage', 'brands.manage',

            // Orders
            'orders.view', 'orders.view_all', 'orders.update_status',
            'orders.cancel', 'orders.refund',

            // Vendors
            'vendors.view', 'vendors.approve', 'vendors.suspend',

            // Users
            'users.view', 'users.manage',

            // Reports & Analytics
            'analytics.view', 'analytics.view_all',

            // Settings
            'settings.manage',

            // Delivery
            'delivery.update_shipping', 'delivery.mark_delivered',
        ];

        foreach ($permissions as $permission) {
            Permission::firstOrCreate(['name' => $permission, 'guard_name' => 'web']);
        }

        // ── Create roles & assign permissions ─────────────────────────────────

        // super_admin — gets everything via Gate::before() in AuthServiceProvider
        $superAdmin = Role::firstOrCreate(['name' => 'super_admin', 'guard_name' => 'web']);
        $superAdmin->syncPermissions(Permission::all());

        // vendor — manage own shop
        $vendor = Role::firstOrCreate(['name' => 'vendor', 'guard_name' => 'web']);
        $vendor->syncPermissions([
            'products.view', 'products.create', 'products.update', 'products.delete', 'products.publish',
            'orders.view', 'orders.update_status',
            'analytics.view',
        ]);

        // customer — shop only
        $customer = Role::firstOrCreate(['name' => 'customer', 'guard_name' => 'web']);
        $customer->syncPermissions([
            'orders.view',
        ]);

        // delivery_agent
        $deliveryAgent = Role::firstOrCreate(['name' => 'delivery_agent', 'guard_name' => 'web']);
        $deliveryAgent->syncPermissions([
            'orders.view',
            'delivery.update_shipping',
            'delivery.mark_delivered',
        ]);

        // moderator — content moderation
        $moderator = Role::firstOrCreate(['name' => 'moderator', 'guard_name' => 'web']);
        $moderator->syncPermissions([
            'products.view', 'products.update',
            'categories.manage', 'brands.manage',
            'vendors.view',
            'users.view',
            'analytics.view_all',
        ]);

        $this->command?->info('✅ Roles and permissions seeded:');
        $this->command?->line('   super_admin | vendor | customer | delivery_agent | moderator');
    }
}