ladill-frontdesk/app/Services/Frontdesk/FrontdeskPermissions.php

<?php

namespace App\Services\Frontdesk;

use App\Models\Member;

class FrontdeskPermissions
{
    /** @var array<string, list<string>> */
    protected array $roleAbilities = [
        'super_admin' => ['*'],
        'org_admin' => ['*'],
        'branch_admin' => [
            'dashboard.view', 'visits.view', 'visits.manage', 'visitors.view', 'visitors.manage',
            'hosts.view', 'hosts.manage', 'kiosk.use', 'security.view', 'security.checkout', 'security.verify',
            'settings.view', 'admin.branches.view', 'admin.desks.view', 'admin.desks.manage',
            'watchlist.view', 'watchlist.manage', 'audit.view', 'audit.export',
            'devices.view', 'devices.manage', 'reports.view', 'reports.export',
        ],
        'receptionist' => [
            'dashboard.view', 'visits.view', 'visits.manage', 'visitors.view', 'visitors.manage',
            'hosts.view', 'kiosk.use', 'watchlist.view', 'devices.view',
        ],
        'security_officer' => [
            'dashboard.view', 'visits.view', 'visitors.view', 'security.view', 'security.checkout', 'security.verify',
            'watchlist.view', 'audit.view',
        ],
        'host' => [
            'dashboard.view', 'visits.view', 'visitors.view', 'host.portal',
        ],
        'auditor' => [
            'dashboard.view', 'visits.view', 'visitors.view', 'security.view', 'settings.view',
            'audit.view', 'audit.export', 'watchlist.view', 'compliance.restore',
            'reports.view', 'reports.export',
        ],
    ];

    public function can(?Member $member, string $ability): bool
    {
        if ($member === null) {
            return false;
        }

        $abilities = $this->roleAbilities[$member->role] ?? [];

        if (in_array('*', $abilities, true)) {
            return true;
        }

        return in_array($ability, $abilities, true);
    }

    public function isAdmin(?Member $member): bool
    {
        return $member !== null && in_array($member->role, ['super_admin', 'org_admin'], true);
    }

    public function managesBranches(?Member $member): bool
    {
        return $this->can($member, 'admin.branches.manage');
    }
}