Fix Host portal showing for users without a linked host profile.

Only show the sidebar link when a host record is linked to the signed-in user, and redirect direct visits to the dashboard with a clear message instead of a 403 page.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Frontdesk/HostPortalController.php

@@ -6,10 +6,10 @@ use App\Http\Controllers\Controller;
 use App\Http\Controllers\Frontdesk\Concerns\ScopesToAccount;
 use App\Models\Host;
 use App\Models\Visit;
-use App\Services\Frontdesk\FrontdeskPermissions;
 use App\Services\Frontdesk\OrganizationResolver;
 use App\Services\Frontdesk\VisitLifecycleService;
 use App\Services\Frontdesk\VisitScheduleService;
+use Illuminate\Http\Exceptions\HttpResponseException;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\View\View;
@@ -114,17 +114,15 @@ class HostPortalController extends Controller
 
     protected function resolveLinkedHost(Request $request): Host
     {
-        $permissions = app(FrontdeskPermissions::class);
-        $member = $this->member($request);
-
-        abort_unless(
-            $permissions->can($member, 'host.portal') || app(OrganizationResolver::class)->hostFor($request->user()) !== null,
-            403,
-        );
-
         $host = app(OrganizationResolver::class)->hostFor($request->user());
 
-        abort_unless($host, 403, 'No host profile linked to your account.');
+        if (! $host) {
+            throw new HttpResponseException(
+                redirect()
+                    ->route('frontdesk.dashboard')
+                    ->with('error', 'No host profile is linked to your account. Ask an administrator to link your Ladill user on the Hosts screen.'),
+            );
+        }
 
         $this->authorizeOwner($request, $host);
 

resources/views/partials/sidebar.blade.php

@@ -32,7 +32,7 @@
              'icon' => '<path stroke-linecap="round" stroke-linejoin="round" d="M10.5 1.5H8.25A2.25 2.25 0 0 0 6 3.75v16.5a2.25 2.25 0 0 0 2.25 2.25h7.5A2.25 2.25 0 0 0 18 20.25V3.75a2.25 2.25 0 0 0-2.25-2.25H13.5m-3 0V3h3V1.5m-3 0h3m-3 18.75h3" />'],
         ];
 
-        if ($permissions->can($member, 'host.portal') || $linkedHost) {
+        if ($linkedHost) {
             $nav[] = ['name' => 'Host portal', 'route' => route('frontdesk.host.index'), 'active' => request()->routeIs('frontdesk.host.*'),
              'icon' => '<path stroke-linecap="round" stroke-linejoin="round" d="M15.75 6a3.75 3.75 0 1 1-7.5 0 3.75 3.75 0 0 1 7.5 0ZM4.501 20.118a7.5 7.5 0 0 1 14.998 0A17.933 17.933 0 0 1 12 21.75c-2.676 0-5.216-.584-7.499-1.632Z" />'];
         }

tests/Feature/FrontdeskPhase6Test.php

@@ -81,6 +81,32 @@ class FrontdeskPhase6Test extends TestCase
             ->assertSee('Phase6 Host');
     }
 
+    public function test_org_admin_without_linked_host_cannot_access_host_portal(): void
+    {
+        $admin = User::create([
+            'public_id' => 'phase6-admin-001',
+            'name' => 'Org Admin',
+            'email' => 'admin@example.com',
+        ]);
+
+        Member::create([
+            'owner_ref' => $this->user->public_id,
+            'organization_id' => $this->organization->id,
+            'user_ref' => $admin->public_id,
+            'role' => 'org_admin',
+        ]);
+
+        $this->actingAs($admin)
+            ->get(route('frontdesk.dashboard'))
+            ->assertOk()
+            ->assertDontSee('Host portal', false);
+
+        $this->actingAs($admin)
+            ->get(route('frontdesk.host.index'))
+            ->assertRedirect(route('frontdesk.dashboard'))
+            ->assertSessionHas('error');
+    }
+
     public function test_host_can_pre_register_visitor(): void
     {
         $this->actingAs($this->user)