Initial Ladill Frontdesk release with deploy pipeline.

Visitor management app with SSO, kiosk, badges, reports, and Gitea CI deploy to frontdesk.ladill.com. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-27 20:37:15 +00:00
commit 9e2d79936c
284 changed files with 29134 additions and 0 deletions
@@ -0,0 +1,62 @@
+<?php
+
+namespace App\Services\Frontdesk;
+
+use App\Models\Member;
+
+class FrontdeskPermissions
+{
+    /** @var array<string, list<string>> */
+    protected array $roleAbilities = [
+        'super_admin' => ['*'],
+        'org_admin' => ['*'],
+        'branch_admin' => [
+            'dashboard.view', 'visits.view', 'visits.manage', 'visitors.view', 'visitors.manage',
+            'hosts.view', 'hosts.manage', 'kiosk.use', 'security.view', 'security.checkout', 'security.verify',
+            'settings.view', 'admin.branches.view', 'admin.desks.view', 'admin.desks.manage',
+            'watchlist.view', 'watchlist.manage', 'audit.view', 'audit.export',
+            'devices.view', 'devices.manage', 'reports.view', 'reports.export',
+        ],
+        'receptionist' => [
+            'dashboard.view', 'visits.view', 'visits.manage', 'visitors.view', 'visitors.manage',
+            'hosts.view', 'kiosk.use', 'watchlist.view', 'devices.view',
+        ],
+        'security_officer' => [
+            'dashboard.view', 'visits.view', 'visitors.view', 'security.view', 'security.checkout', 'security.verify',
+            'watchlist.view', 'audit.view',
+        ],
+        'host' => [
+            'dashboard.view', 'visits.view', 'visitors.view', 'host.portal',
+        ],
+        'auditor' => [
+            'dashboard.view', 'visits.view', 'visitors.view', 'security.view', 'settings.view',
+            'audit.view', 'audit.export', 'watchlist.view', 'compliance.restore',
+            'reports.view', 'reports.export',
+        ],
+    ];
+
+    public function can(?Member $member, string $ability): bool
+    {
+        if ($member === null) {
+            return false;
+        }
+
+        $abilities = $this->roleAbilities[$member->role] ?? [];
+
+        if (in_array('*', $abilities, true)) {
+            return true;
+        }
+
+        return in_array($ability, $abilities, true);
+    }
+
+    public function isAdmin(?Member $member): bool
+    {
+        return $member !== null && in_array($member->role, ['super_admin', 'org_admin'], true);
+    }
+
+    public function managesBranches(?Member $member): bool
+    {
+        return $this->can($member, 'admin.branches.manage');
+    }
+}