Add per-store managers for Woo Business accounts.

Agencies can invite store-scoped managers via Identity, with access limited to one WooCommerce store while owners retain full multi-store control.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Auth/SsoLoginController.php

@@ -131,6 +131,8 @@ class SsoLoginController extends Controller
         $request->session()->regenerate();
         $request->session()->forget('sso.attempts');
 
+        app(\App\Services\Woo\TeamMemberProvisioner::class)->sync($user);
+
         return $this->finishCallback($request, $intended, null, $popup);
     }
 

app/Http/Controllers/Woo/Concerns/ResolvesWooContext.php

@@ -4,6 +4,7 @@ namespace App\Http\Controllers\Woo\Concerns;
 
 use App\Models\User;
 use App\Models\WooStore;
+use App\Models\WooStoreMember;
 use App\Support\CurrentWooStore;
 use Illuminate\Http\Request;
 
@@ -14,9 +15,33 @@ trait ResolvesWooContext
         return ladill_account() ?? $request->user();
     }
 
+    protected function actor(Request $request): User
+    {
+        return $request->user();
+    }
+
+    protected function wooMember(Request $request): ?WooStoreMember
+    {
+        return $request->attributes->get('woo.member');
+    }
+
+    /** @return list<int>|null */
+    protected function storeScope(Request $request): ?array
+    {
+        return $request->attributes->get('woo.storeIds');
+    }
+
+    protected function isStoreOwner(Request $request): bool
+    {
+        return $this->wooMember($request) === null;
+    }
+
     protected function currentStore(Request $request): ?WooStore
     {
-        return app(CurrentWooStore::class)->resolve($this->accountUser($request));
+        return app(CurrentWooStore::class)->resolve(
+            $this->accountUser($request),
+            $this->storeScope($request),
+        );
     }
 
     protected function currentStoreOrFail(Request $request): WooStore
@@ -29,10 +54,18 @@ trait ResolvesWooContext
 
     protected function authorizedStore(Request $request, int $storeId): WooStore
     {
-        return WooStore::query()
+        $store = WooStore::query()
             ->where('user_id', $this->accountUser($request)->id)
             ->whereKey($storeId)
             ->where('status', WooStore::STATUS_ACTIVE)
             ->firstOrFail();
+
+        abort_unless(
+            app(\App\Services\Woo\WooStoreMemberResolver::class)
+                ->canAccessStore($this->actor($request), (string) $this->accountUser($request)->public_id, $store->id),
+            404,
+        );
+
+        return $store;
     }
 }

app/Http/Controllers/Woo/ConnectWordPressController.php

@@ -4,7 +4,6 @@ namespace App\Http\Controllers\Woo;
 
 use App\Http\Controllers\Controller;
 use App\Http\Controllers\Woo\Concerns\ResolvesWooContext;
-use App\Http\Controllers\Woo\Concerns\ResolvesWooContext;
 use App\Models\WooStore;
 use App\Services\Woo\InstallTokenService;
 use App\Services\Woo\SubscriptionService;
@@ -24,6 +23,8 @@ class ConnectWordPressController extends Controller
 
     public function start(Request $request): RedirectResponse|View
     {
+        abort_if($this->wooMember($request), 403);
+
         $validated = $request->validate([
             'site_url' => ['required', 'url', 'max:500'],
             'return_url' => ['required', 'url', 'max:2048'],
@@ -53,12 +54,14 @@ class ConnectWordPressController extends Controller
 
     public function complete(Request $request): RedirectResponse|View
     {
+        abort_if($this->wooMember($request), 403);
+
         $pending = (array) $request->session()->pull('woo.connect', []);
         if ($pending === []) {
             return redirect()->route('woo.dashboard');
         }
 
-        $user = $request->user();
+        $user = $this->accountUser($request);
         abort_if(! $user, 401);
 
         $siteUrl = (string) ($pending['site_url'] ?? '');

app/Http/Controllers/Woo/ProController.php

@@ -21,6 +21,7 @@ class ProController extends Controller
 
     public function index(Request $request): View
     {
+        $this->guardBillingOwner($request);
         $user = $this->accountUser($request);
         $planKey = $this->subscriptions->planKey($user);
 
@@ -44,6 +45,7 @@ class ProController extends Controller
 
     public function subscribe(Request $request): RedirectResponse
     {
+        $this->guardBillingOwner($request);
         [$ok, $message] = $this->subscriptions->subscribe($this->accountUser($request));
 
         return redirect()->route('woo.pro.index')->with($ok ? 'success' : 'error', $message);
@@ -51,6 +53,7 @@ class ProController extends Controller
 
     public function subscribeEnterprise(Request $request): RedirectResponse
     {
+        $this->guardBillingOwner($request);
         [$ok, $message] = $this->subscriptions->subscribeEnterprise($this->accountUser($request));
 
         return redirect()->route('woo.pro.index')->with($ok ? 'success' : 'error', $message);
@@ -58,6 +61,7 @@ class ProController extends Controller
 
     public function subscribePrepaid(Request $request, BillingClient $billing): RedirectResponse
     {
+        $this->guardBillingOwner($request);
         $validated = $request->validate([
             'plan' => ['required', 'in:pro,enterprise'],
             'months' => ['required', 'integer', 'in:6,12,24'],
@@ -137,8 +141,14 @@ class ProController extends Controller
 
     public function cancel(Request $request): RedirectResponse
     {
+        $this->guardBillingOwner($request);
         [$ok, $message] = $this->subscriptions->cancel($this->accountUser($request));
 
         return redirect()->route('woo.pro.index')->with($ok ? 'success' : 'error', $message);
     }
+
+    private function guardBillingOwner(Request $request): void
+    {
+        abort_if($this->wooMember($request), 403);
+    }
 }

app/Http/Controllers/Woo/SettingsController.php

@@ -3,12 +3,40 @@
 namespace App\Http\Controllers\Woo;
 
 use App\Http\Controllers\Controller;
+use App\Http\Controllers\Woo\Concerns\ResolvesWooContext;
+use App\Models\WooStore;
+use App\Models\WooStoreMember;
+use App\Services\Woo\SubscriptionService;
 use Illuminate\View\View;
 
 class SettingsController extends Controller
 {
+    use ResolvesWooContext;
+
+    public function __construct(private SubscriptionService $subscriptions) {}
+
     public function edit(): View
     {
-        return view('woo.settings');
+        $account = ladill_account() ?? auth()->user();
+        $ownerRef = (string) $account?->public_id;
+        $storeScope = request()->attributes->get('woo.storeIds');
+
+        $stores = $account
+            ? WooStore::query()
+                ->where('user_id', $account->id)
+                ->where('status', WooStore::STATUS_ACTIVE)
+                ->when($storeScope !== null, fn ($q) => $q->whereIn('id', $storeScope))
+                ->orderBy('site_name')
+                ->get()
+            : collect();
+
+        return view('woo.settings', [
+            'teamStores' => $stores,
+            'members' => $ownerRef !== ''
+                ? WooStoreMember::owned($ownerRef)->with('store')->orderBy('created_at')->get()
+                : collect(),
+            'roles' => config('woo.roles', []),
+            'hasStoreTeamFeatures' => $account ? $this->subscriptions->canManageStoreTeam($account) : false,
+        ]);
     }
 }

app/Http/Controllers/Woo/StoreController.php

@@ -23,23 +23,28 @@ class StoreController extends Controller
     public function index(Request $request): View
     {
         $user = $this->accountUser($request);
+        $storeScope = $this->storeScope($request);
+
         $stores = WooStore::query()
             ->where('user_id', $user->id)
+            ->when($storeScope !== null, fn ($q) => $q->whereIn('id', $storeScope))
             ->latest('updated_at')
             ->get();
 
         return view('woo.stores.index', [
             'stores' => $stores,
-            'currentStore' => $this->currentStore->resolve($user),
+            'currentStore' => $this->currentStore->resolve($user, $storeScope),
             'hasPaidPlan' => $this->subscriptions->hasPaidPlan($user),
             'storeCount' => $this->subscriptions->connectedStoreCount($user),
             'storeLimit' => $this->subscriptions->maxStores($user),
-            'canConnectMore' => $this->subscriptions->canConnectStore($user),
+            'canConnectMore' => $this->isStoreOwner($request) && $this->subscriptions->canConnectStore($user),
+            'isStoreOwner' => $this->isStoreOwner($request),
         ]);
     }
 
     public function destroy(Request $request, WooStore $store): RedirectResponse
     {
+        abort_if(! $this->isStoreOwner($request), 403);
         abort_if($store->user_id !== $this->accountUser($request)->id, 403);
 
         $store->update(['status' => WooStore::STATUS_DISCONNECTED]);

app/Http/Controllers/Woo/StoreMemberController.php

@@ -0,0 +1,119 @@
+<?php
+
+namespace App\Http\Controllers\Woo;
+
+use App\Http\Controllers\Controller;
+use App\Http\Controllers\Woo\Concerns\ResolvesWooContext;
+use App\Models\WooStore;
+use App\Models\WooStoreMember;
+use App\Services\Identity\IdentityTeamClient;
+use App\Services\Woo\SubscriptionService;
+use App\Services\Woo\WooStoreMemberResolver;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Validation\Rule;
+
+class StoreMemberController extends Controller
+{
+    use ResolvesWooContext;
+
+    public function __construct(
+        private SubscriptionService $subscriptions,
+        private WooStoreMemberResolver $members,
+    ) {}
+
+    public function store(Request $request, IdentityTeamClient $identity): RedirectResponse
+    {
+        if ($redirect = $this->guardManage($request)) {
+            return $redirect;
+        }
+
+        $owner = (string) $this->accountUser($request)->public_id;
+
+        $validated = $request->validate([
+            'email' => ['required', 'email', 'max:255'],
+            'woo_store_id' => [
+                'required',
+                'integer',
+                Rule::exists('woo_stores', 'id')->where(fn ($q) => $q
+                    ->where('user_id', $this->accountUser($request)->id)
+                    ->where('status', WooStore::STATUS_ACTIVE)),
+            ],
+        ]);
+
+        $email = strtolower(trim($validated['email']));
+        $actor = $this->actor($request);
+
+        if ($email === strtolower((string) $actor->email)) {
+            return back()->withErrors(['email' => 'You cannot invite yourself.']);
+        }
+
+        try {
+            $identity->inviteAppMember(
+                $owner,
+                $email,
+                ['woo'],
+                [
+                    'woo' => [
+                        'role' => WooStoreMember::ROLE_MANAGER,
+                        'store_id' => (int) $validated['woo_store_id'],
+                    ],
+                ],
+            );
+        } catch (\Throwable $e) {
+            return back()->withInput()->with('error', $e->getMessage());
+        }
+
+        WooStoreMember::updateOrCreate(
+            [
+                'owner_ref' => $owner,
+                'user_ref' => $email,
+                'woo_store_id' => (int) $validated['woo_store_id'],
+            ],
+            [
+                'role' => WooStoreMember::ROLE_MANAGER,
+            ],
+        );
+
+        return redirect()
+            ->route('woo.settings')
+            ->withFragment('store-team')
+            ->with('success', 'Invitation sent to '.$email.'.');
+    }
+
+    public function destroy(Request $request, WooStoreMember $member): RedirectResponse
+    {
+        if ($redirect = $this->guardManage($request)) {
+            return $redirect;
+        }
+
+        abort_unless($member->owner_ref === (string) $this->accountUser($request)->public_id, 404);
+
+        $actor = $this->actor($request);
+        if ($member->user_ref === $actor->public_id || $member->user_ref === strtolower((string) $actor->email)) {
+            return redirect()->route('woo.settings')->withFragment('store-team')->with('error', 'You cannot remove yourself.');
+        }
+
+        $member->delete();
+
+        return redirect()
+            ->route('woo.settings')
+            ->withFragment('store-team')
+            ->with('success', 'Store manager removed.');
+    }
+
+    private function guardManage(Request $request): ?RedirectResponse
+    {
+        if (! $this->members->canManageStoreTeam($this->wooMember($request), (string) $this->accountUser($request)->public_id, $this->actor($request))) {
+            abort(403);
+        }
+
+        $account = $this->accountUser($request);
+        if (! $this->subscriptions->canManageStoreTeam($account)) {
+            return redirect()->route('woo.pro.index')
+                ->with('upsell', 'Per-store managers require Ladill Woo Manager Business.');
+        }
+
+        return null;
+    }
+}

app/Http/Controllers/Woo/StoreSwitchController.php

@@ -18,7 +18,11 @@ class StoreSwitchController extends Controller
             'store' => ['required', 'integer'],
         ]);
 
-        $stores->switch($this->accountUser($request), (int) $validated['store']);
+        $stores->switch(
+            $this->accountUser($request),
+            (int) $validated['store'],
+            $this->storeScope($request),
+        );
 
         return redirect()->back();
     }

app/Http/Middleware/SetActingAccount.php

@@ -2,8 +2,11 @@
 
 namespace App\Http\Middleware;
 
+use App\Models\User;
+use App\Models\WooStore;
 use Closure;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\View;
 use Symfony\Component\HttpFoundation\Response;
 
 class SetActingAccount
@@ -11,9 +14,48 @@ class SetActingAccount
     public function handle(Request $request, Closure $next): Response
     {
         if ($user = $request->user()) {
-            $request->attributes->set('actingAccount', $user);
+            $accountId = (int) $request->session()->get('ladill_account', $user->id);
+
+            if (! $user->canAccessAccount($accountId)) {
+                $accountId = $user->id;
+                $request->session()->put('ladill_account', $accountId);
+            }
+
+            $accountId = $this->preferEmployerAccount($request, $user, $accountId);
+
+            $account = $accountId === $user->id ? $user : (User::find($accountId) ?? $user);
+
+            $request->attributes->set('actingAccount', $account);
+
+            View::share('actingAccount', $account);
+            View::share('accessibleAccounts', $user->accessibleAccounts());
         }
 
         return $next($request);
     }
+
+    private function preferEmployerAccount(Request $request, User $user, int $accountId): int
+    {
+        if ($accountId !== $user->id) {
+            return $accountId;
+        }
+
+        if (WooStore::query()->where('user_id', $user->id)->where('status', WooStore::STATUS_ACTIVE)->exists()) {
+            return $accountId;
+        }
+
+        $membership = $user->wooMemberships()->first();
+        if (! $membership) {
+            return $accountId;
+        }
+
+        $employer = User::where('public_id', $membership->owner_ref)->first();
+        if ($employer && $user->canAccessAccount($employer->id)) {
+            $request->session()->put('ladill_account', $employer->id);
+
+            return $employer->id;
+        }
+
+        return $accountId;
+    }
 }

app/Http/Middleware/SetWooStoreMemberContext.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Models\User;
+use App\Services\Woo\SubscriptionService;
+use App\Services\Woo\WooStoreMemberResolver;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\View;
+use Symfony\Component\HttpFoundation\Response;
+
+class SetWooStoreMemberContext
+{
+    public function __construct(
+        private WooStoreMemberResolver $members,
+        private SubscriptionService $subscriptions,
+    ) {}
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (! $user = $request->user()) {
+            return $next($request);
+        }
+
+        $account = ladill_account() ?? $user;
+        $ownerRef = (string) $account->public_id;
+        $member = $this->members->memberFor($user, $ownerRef);
+        $storeIds = $this->members->accessibleStoreIds($user, $ownerRef);
+
+        $request->attributes->set('woo.member', $member);
+        $request->attributes->set('woo.storeIds', $storeIds);
+
+        $canManageTeam = $this->members->canManageStoreTeam($member, $ownerRef, $user)
+            && $this->subscriptions->canManageStoreTeam($account);
+
+        View::share('wooMember', $member);
+        View::share('wooStoreScope', $storeIds);
+        View::share('canManageStoreTeam', $canManageTeam);
+        View::share('isStoreOwner', $member === null);
+
+        return $next($request);
+    }
+}

app/Models/User.php

@@ -7,6 +7,7 @@ use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
+use Illuminate\Support\Collection;
 use Laravel\Sanctum\HasApiTokens;
 
 /** Thin local mirror of the platform identity (auth.ladill.com owns users). */
@@ -33,6 +34,34 @@ class User extends Authenticatable
         return $this->hasMany(WooStore::class);
     }
 
+    public function wooMemberships(): HasMany
+    {
+        return $this->hasMany(WooStoreMember::class, 'user_ref', 'public_id');
+    }
+
+    public function canAccessAccount(int $accountId): bool
+    {
+        if ($accountId === $this->id) {
+            return true;
+        }
+
+        $account = self::find($accountId);
+
+        return $account !== null
+            && $this->wooMemberships()->where('owner_ref', $account->public_id)->exists();
+    }
+
+    /** @return Collection<int, User> */
+    public function accessibleAccounts(): Collection
+    {
+        $ownerRefs = $this->wooMemberships()->pluck('owner_ref')->all();
+
+        return collect([$this])
+            ->merge(self::whereIn('public_id', $ownerRefs)->get())
+            ->unique('id')
+            ->values();
+    }
+
     public function avatarUrl(): ?string
     {
         $url = trim((string) $this->avatar_url);

app/Models/WooStoreMember.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class WooStoreMember extends Model
+{
+    public const ROLE_MANAGER = 'manager';
+
+    protected $fillable = [
+        'owner_ref',
+        'user_ref',
+        'woo_store_id',
+        'role',
+    ];
+
+    public function store(): BelongsTo
+    {
+        return $this->belongsTo(WooStore::class, 'woo_store_id');
+    }
+
+    public function hasRole(string ...$roles): bool
+    {
+        return in_array($this->role, $roles, true);
+    }
+
+    public function scopeOwned(Builder $query, string $ownerRef): Builder
+    {
+        return $query->where('owner_ref', $ownerRef);
+    }
+}

app/Providers/AppServiceProvider.php

@@ -17,16 +17,17 @@ class AppServiceProvider extends ServiceProvider
 
     public function boot(): void
     {
-        View::composer(['partials.sidebar', 'partials.topbar', 'partials.mobile-bottom-nav', 'partials.store-switcher-menu'], function ($view) {
+        View::composer(['partials.sidebar', 'partials.topbar', 'partials.mobile-bottom-nav', 'partials.store-switcher-menu', 'partials.store-switcher'], function ($view) {
             $account = ladill_account() ?? auth()->user();
             $svc = app(SubscriptionService::class);
             $stores = app(CurrentWooStore::class);
+            $storeIds = request()->attributes->get('woo.storeIds');
 
             $view->with('isPro', $account ? $svc->isPro($account) : false);
             $view->with('hasPaidPlan', $account ? $svc->hasPaidPlan($account) : false);
             $view->with('isEnterprise', $account ? $svc->isEnterprise($account) : false);
-            $view->with('wooActiveStores', $account ? $stores->activeStores($account) : collect());
-            $view->with('currentWooStore', $account ? $stores->resolve($account) : null);
+            $view->with('wooActiveStores', $account ? $stores->activeStores($account, $storeIds) : collect());
+            $view->with('currentWooStore', $account ? $stores->resolve($account, $storeIds) : null);
         });
 
         View::composer(['partials.topbar'], function ($view) {

app/Services/Identity/IdentityTeamClient.php

@@ -0,0 +1,64 @@
+<?php
+
+namespace App\Services\Identity;
+
+use Illuminate\Http\Client\Response;
+use Illuminate\Support\Facades\Http;
+use RuntimeException;
+
+class IdentityTeamClient
+{
+    /**
+     * @param  list<string>  $apps
+     * @param  array<string, mixed>  $metadata
+     *
+     * @return array<string, mixed>
+     */
+    public function inviteAppMember(
+        string $ownerPublicId,
+        string $email,
+        array $apps,
+        array $metadata = [],
+        string $role = 'member',
+    ): array {
+        $response = $this->request('post', '/identity/team/invite', [
+            'owner' => $ownerPublicId,
+            'email' => strtolower(trim($email)),
+            'apps' => $apps,
+            'role' => $role,
+            'metadata' => $metadata,
+        ]);
+
+        return (array) $response->json('data', []);
+    }
+
+    /** @return list<array<string, mixed>> */
+    public function teamAccess(string $userPublicId): array
+    {
+        $response = $this->request('get', '/identity/team/access', [
+            'user' => $userPublicId,
+        ]);
+
+        return (array) $response->json('data', []);
+    }
+
+    private function request(string $method, string $path, array $query = []): Response
+    {
+        $url = rtrim((string) config('identity.api_url'), '/').$path;
+        $key = config('identity.api_key');
+
+        if ($url === '' || ! is_string($key) || $key === '') {
+            throw new RuntimeException('Identity API is not configured.');
+        }
+
+        $response = Http::withToken($key)
+            ->timeout(10)
+            ->{$method}($url, $query);
+
+        if (! $response->successful()) {
+            throw new RuntimeException($response->json('message') ?: 'Identity API request failed.');
+        }
+
+        return $response;
+    }
+}

app/Services/Woo/SubscriptionService.php

@@ -123,6 +123,11 @@ class SubscriptionService
         return $this->productCount($user) < $this->maxProducts($user);
     }
 
+    public function canManageStoreTeam(User $user): bool
+    {
+        return $this->isEnterprise($user);
+    }
+
     public function canIngestProduct(User $user, WooStore $store, int $externalId): bool
     {
         if ($this->isPro($user)) {

app/Services/Woo/TeamMemberProvisioner.php

@@ -0,0 +1,56 @@
+<?php
+
+namespace App\Services\Woo;
+
+use App\Models\User;
+use App\Models\WooStoreMember;
+use App\Services\Identity\IdentityTeamClient;
+
+class TeamMemberProvisioner
+{
+    public function __construct(
+        protected IdentityTeamClient $identity,
+    ) {}
+
+    public function sync(User $user): void
+    {
+        WooStoreMember::query()
+            ->where('user_ref', strtolower((string) $user->email))
+            ->update(['user_ref' => $user->public_id]);
+
+        try {
+            $access = $this->identity->teamAccess($user->public_id);
+        } catch (\Throwable) {
+            return;
+        }
+
+        foreach ($access as $grant) {
+            if (($grant['self'] ?? false) || ($grant['full_access'] ?? false)) {
+                continue;
+            }
+
+            $apps = (array) ($grant['apps'] ?? []);
+            if (! in_array('woo', $apps, true)) {
+                continue;
+            }
+
+            $meta = (array) data_get($grant, 'metadata.woo', []);
+            $storeId = (int) ($meta['store_id'] ?? 0);
+
+            if ($storeId <= 0) {
+                continue;
+            }
+
+            WooStoreMember::updateOrCreate(
+                [
+                    'owner_ref' => (string) ($grant['account'] ?? $user->public_id),
+                    'user_ref' => $user->public_id,
+                    'woo_store_id' => $storeId,
+                ],
+                [
+                    'role' => (string) ($meta['role'] ?? WooStoreMember::ROLE_MANAGER),
+                ],
+            );
+        }
+    }
+}

app/Services/Woo/WooStoreMemberResolver.php

@@ -0,0 +1,69 @@
+<?php
+
+namespace App\Services\Woo;
+
+use App\Models\User;
+use App\Models\WooStoreMember;
+use Illuminate\Support\Collection;
+
+class WooStoreMemberResolver
+{
+    public function isAccountOwner(User $actor, string $ownerRef): bool
+    {
+        return $actor->public_id === $ownerRef;
+    }
+
+    public function memberFor(User $actor, string $ownerRef): ?WooStoreMember
+    {
+        if ($this->isAccountOwner($actor, $ownerRef)) {
+            return null;
+        }
+
+        return WooStoreMember::query()
+            ->where('owner_ref', $ownerRef)
+            ->where('user_ref', $actor->public_id)
+            ->first();
+    }
+
+    /** @return list<int> */
+    public function accessibleStoreIds(User $actor, string $ownerRef): ?array
+    {
+        if ($this->isAccountOwner($actor, $ownerRef)) {
+            return null;
+        }
+
+        $ids = WooStoreMember::query()
+            ->where('owner_ref', $ownerRef)
+            ->where('user_ref', $actor->public_id)
+            ->pluck('woo_store_id')
+            ->map(fn ($id) => (int) $id)
+            ->unique()
+            ->values()
+            ->all();
+
+        abort_if($ids === [], 403, 'You do not have access to this Woo Manager account.');
+
+        return $ids;
+    }
+
+    public function canAccessStore(User $actor, string $ownerRef, int $storeId): bool
+    {
+        $scope = $this->accessibleStoreIds($actor, $ownerRef);
+
+        return $scope === null || in_array($storeId, $scope, true);
+    }
+
+    public function canManageStoreTeam(?WooStoreMember $member, string $ownerRef, User $actor): bool
+    {
+        return $this->isAccountOwner($actor, $ownerRef);
+    }
+
+    /** @return Collection<int, WooStoreMember> */
+    public function membershipsFor(User $actor): Collection
+    {
+        return WooStoreMember::query()
+            ->where('user_ref', $actor->public_id)
+            ->with('store')
+            ->get();
+    }
+}

app/Support/CurrentWooStore.php

@@ -10,27 +10,40 @@ class CurrentWooStore
 {
     public const SESSION_KEY = 'woo.current_store_id';
 
-    public function activeStores(User $user): Collection
+    /** @param  list<int>|null  $allowedStoreIds */
+    public function activeStores(User $account, ?array $allowedStoreIds = null): Collection
     {
-        return WooStore::query()
-            ->where('user_id', $user->id)
+        $query = WooStore::query()
+            ->where('user_id', $account->id)
             ->where('status', WooStore::STATUS_ACTIVE)
             ->orderBy('site_name')
-            ->orderBy('site_url')
-            ->get();
+            ->orderBy('site_url');
+
+        if ($allowedStoreIds !== null) {
+            $query->whereIn('id', $allowedStoreIds);
+        }
+
+        return $query->get();
     }
 
-    public function resolve(?User $user): ?WooStore
+    /** @param  list<int>|null  $allowedStoreIds */
+    public function resolve(?User $account, ?array $allowedStoreIds = null): ?WooStore
     {
-        if (! $user) {
+        if (! $account) {
             return null;
         }
 
-        $stores = $this->activeStores($user);
+        $stores = $this->activeStores($account, $allowedStoreIds);
         if ($stores->isEmpty()) {
             return null;
         }
 
+        if ($allowedStoreIds !== null && count($allowedStoreIds) === 1) {
+            session([self::SESSION_KEY => $stores->first()->id]);
+
+            return $stores->first();
+        }
+
         $selectedId = (int) session(self::SESSION_KEY, 0);
         $store = $stores->firstWhere('id', $selectedId);
         if ($store) {
@@ -43,13 +56,19 @@ class CurrentWooStore
         return $first;
     }
 
-    public function switch(User $user, int $storeId): WooStore
+    /** @param  list<int>|null  $allowedStoreIds */
+    public function switch(User $account, int $storeId, ?array $allowedStoreIds = null): WooStore
     {
-        $store = WooStore::query()
-            ->where('user_id', $user->id)
+        $query = WooStore::query()
+            ->where('user_id', $account->id)
             ->whereKey($storeId)
-            ->where('status', WooStore::STATUS_ACTIVE)
-            ->firstOrFail();
+            ->where('status', WooStore::STATUS_ACTIVE);
+
+        if ($allowedStoreIds !== null) {
+            $query->whereIn('id', $allowedStoreIds);
+        }
+
+        $store = $query->firstOrFail();
 
         session([self::SESSION_KEY => $store->id]);
 

bootstrap/app.php

@@ -23,6 +23,7 @@ return Application::configure(basePath: dirname(__DIR__))
         $middleware->web(append: [
             \App\Http\Middleware\InjectBootSplash::class,
             \App\Http\Middleware\SetActingAccount::class,
+            \App\Http\Middleware\SetWooStoreMemberContext::class,
         ]);
         $middleware->alias([
             'platform.session' => \App\Http\Middleware\EnsurePlatformSession::class,

config/woo.php

@@ -35,6 +35,10 @@ return [
         'max_products' => (int) env('WOO_FREE_MAX_PRODUCTS', 20),
     ],
 
+    'roles' => [
+        'manager' => 'Store manager — assigned store only',
+    ],
+
     'upgrade_banner' => [
         'title' => 'Unlock Woo Manager Pro or Business',
         'description' => 'Multiple stores and unlimited products — from GHS 49/mo.',

database/migrations/2026_07_08_150000_create_woo_store_members_table.php

@@ -0,0 +1,27 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('woo_store_members', function (Blueprint $table) {
+            $table->id();
+            $table->string('owner_ref')->index();
+            $table->string('user_ref')->index();
+            $table->foreignId('woo_store_id')->constrained('woo_stores')->cascadeOnDelete();
+            $table->string('role', 30)->default('manager');
+            $table->timestamps();
+
+            $table->unique(['owner_ref', 'user_ref', 'woo_store_id']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('woo_store_members');
+    }
+};

resources/views/woo/settings.blade.php

@@ -2,6 +2,8 @@
     <x-slot name="title">Settings</x-slot>
 
     <x-settings.page description="Account links and preferences for Woo Manager.">
+        @include('woo.settings._store-team-section')
+
         <x-settings.card title="Integrations">
             <p class="text-sm text-slate-600">See which WooCommerce marketing and shipping extensions are installed on your store.</p>
             <a href="{{ route('woo.integrations.index') }}"

resources/views/woo/settings/_store-team-section.blade.php

@@ -0,0 +1,79 @@
+@if (! empty($isStoreOwner))
+    <x-settings.card id="store-team" title="Store managers" description="Invite a client or teammate to manage one WooCommerce store in Ladill — they cannot see your other stores. Business plan only.">
+        @if (! empty($canManageStoreTeam) && ($hasStoreTeamFeatures ?? false))
+            <form method="POST" action="{{ route('woo.team.store') }}" class="grid gap-4 md:grid-cols-2">
+                @csrf
+                <div class="md:col-span-2">
+                    <label for="team_email" class="text-sm font-medium text-slate-700">Email address</label>
+                    <input type="email" id="team_email" name="email" value="{{ old('email') }}" required
+                           placeholder="client@example.com"
+                           class="mt-1.5 block w-full rounded-xl border-slate-300 text-sm shadow-sm focus:border-indigo-500 focus:ring-indigo-500">
+                </div>
+                <div class="md:col-span-2">
+                    <label for="team_store_id" class="text-sm font-medium text-slate-700">Store access</label>
+                    <select id="team_store_id" name="woo_store_id" required
+                            class="mt-1.5 block w-full rounded-xl border-slate-300 text-sm shadow-sm focus:border-indigo-500 focus:ring-indigo-500">
+                        <option value="">Select a store…</option>
+                        @foreach ($teamStores as $store)
+                            <option value="{{ $store->id }}" @selected((int) old('woo_store_id') === $store->id)>
+                                {{ $store->site_name ?? parse_url($store->site_url, PHP_URL_HOST) }}
+                            </option>
+                        @endforeach
+                    </select>
+                    <p class="mt-1 text-xs text-slate-400">Managers only see orders, products, and settings for this store.</p>
+                </div>
+                <div class="md:col-span-2 flex justify-end">
+                    <button type="submit" class="rounded-xl bg-indigo-600 px-4 py-2 text-sm font-semibold text-white hover:bg-indigo-700">Send invite</button>
+                </div>
+            </form>
+
+            <div class="mt-6 border-t border-slate-100 pt-5">
+                <h3 class="text-sm font-semibold text-slate-900">Store managers</h3>
+                @if (($members ?? collect())->isEmpty())
+                    <p class="mt-2 text-sm text-slate-500">No store managers yet. Invite a client above.</p>
+                @else
+                    <div class="mt-3 overflow-x-auto">
+                        <table class="min-w-full text-sm">
+                            <thead class="text-left text-xs uppercase text-slate-500">
+                                <tr>
+                                    <th class="pb-2 pr-4">Member</th>
+                                    <th class="pb-2 pr-4">Store</th>
+                                    <th class="pb-2 pr-4">Role</th>
+                                    <th class="pb-2"></th>
+                                </tr>
+                            </thead>
+                            <tbody class="divide-y divide-slate-100">
+                                @foreach ($members as $member)
+                                    @php
+                                        $display = str_contains($member->user_ref, '@')
+                                            ? $member->user_ref
+                                            : (\App\Models\User::where('public_id', $member->user_ref)->value('email') ?? $member->user_ref);
+                                    @endphp
+                                    <tr>
+                                        <td class="py-3 pr-4">{{ $display }}</td>
+                                        <td class="py-3 pr-4">{{ $member->store?->site_name ?? $member->store?->site_url ?? '—' }}</td>
+                                        <td class="py-3 pr-4">{{ $roles[$member->role] ?? $member->role }}</td>
+                                        <td class="py-3 text-right">
+                                            @if ($member->user_ref !== auth()->user()->public_id && $member->user_ref !== strtolower((string) auth()->user()->email))
+                                                <form method="POST" action="{{ route('woo.team.destroy', $member) }}" class="inline" onsubmit="return confirm('Remove this store manager?');">
+                                                    @csrf
+                                                    @method('DELETE')
+                                                    <button type="submit" class="text-red-600 hover:text-red-800">Remove</button>
+                                                </form>
+                                            @endif
+                                        </td>
+                                    </tr>
+                                @endforeach
+                            </tbody>
+                        </table>
+                    </div>
+                @endif
+            </div>
+        @else
+            <p class="rounded-xl bg-amber-50 px-4 py-3 text-sm text-amber-900">
+                Per-store managers require
+                <a href="{{ route('woo.pro.index') }}" class="font-semibold underline">Ladill Woo Manager Business</a>.
+            </p>
+        @endif
+    </x-settings.card>
+@endif

resources/views/woo/stores/index.blade.php

@@ -14,7 +14,7 @@
             @endif
         </div>
 
-        @if($stores->isEmpty())
+        @if($stores->isEmpty() && ($isStoreOwner ?? true))
             <div class="rounded-2xl border border-indigo-100 bg-indigo-50/60 p-6">
                 <div class="flex flex-wrap items-start justify-between gap-4">
                     <div class="max-w-xl">
@@ -50,20 +50,22 @@
                                 </p>
                             </div>
                             <div class="flex items-center gap-3">
-                                @if($store->status === \App\Models\WooStore::STATUS_ACTIVE)
+                                @if(($isStoreOwner ?? true) && $store->status === \App\Models\WooStore::STATUS_ACTIVE)
                                     @if($currentStore?->id === $store->id)
                                         <span class="rounded-lg bg-indigo-50 px-3 py-1.5 text-xs font-semibold text-indigo-700">Managing now</span>
-                                    @else
+                                    @elseif(($wooActiveStores ?? collect())->count() > 1)
                                         <form method="post" action="{{ route('woo.stores.switch') }}">
                                             @csrf
                                             <input type="hidden" name="store" value="{{ $store->id }}">
                                             <button type="submit" class="rounded-lg border border-slate-200 px-3 py-1.5 text-xs font-semibold text-slate-700 hover:bg-slate-50">Switch to this store</button>
                                         </form>
                                     @endif
+                                    @if($isStoreOwner ?? true)
                                     <form method="post" action="{{ route('woo.stores.destroy', $store) }}" onsubmit="return confirm('Disconnect this store?')">
                                         @csrf @method('delete')
                                         <button type="submit" class="rounded-lg border border-red-200 px-3 py-1.5 text-xs font-semibold text-red-600 hover:bg-red-50">Disconnect</button>
                                     </form>
+                                    @endif
                                 @endif
                             </div>
                         </div>

routes/web.php

@@ -11,6 +11,7 @@ use App\Http\Controllers\Woo\IntegrationController;
 use App\Http\Controllers\Woo\OrderController;
 use App\Http\Controllers\Woo\ProductController;
 use App\Http\Controllers\Woo\ProController;
+use App\Http\Controllers\Woo\StoreMemberController;
 use App\Http\Controllers\Woo\SettingsController;
 use App\Http\Controllers\Woo\StoreController;
 use App\Http\Controllers\Woo\StoreSwitchController;
@@ -65,6 +66,8 @@ Route::middleware(['auth', 'platform.session'])->group(function () {
     Route::get('/integrations', [IntegrationController::class, 'index'])->name('woo.integrations.index');
     Route::post('/integrations/refresh', [IntegrationController::class, 'refresh'])->name('woo.integrations.refresh');
     Route::get('/settings', [SettingsController::class, 'edit'])->name('woo.settings');
+    Route::post('/settings/team', [StoreMemberController::class, 'store'])->name('woo.team.store');
+    Route::delete('/settings/team/{member}', [StoreMemberController::class, 'destroy'])->name('woo.team.destroy');
 
     Route::post('/ai/chat', [AiController::class, 'chat'])->middleware('throttle:30,1')->name('woo.ai.chat');
 

tests/Feature/WooStoreTeamTest.php

@@ -0,0 +1,208 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Http\Middleware\EnsurePlatformSession;
+use App\Models\User;
+use App\Models\Woo\ProSubscription;
+use App\Models\WooOrder;
+use App\Models\WooStore;
+use App\Models\WooStoreMember;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Tests\TestCase;
+
+class WooStoreTeamTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->withoutMiddleware(EnsurePlatformSession::class);
+        $this->withoutVite();
+
+        config([
+            'woo.pro.enabled' => true,
+            'billing.api_url' => 'https://billing.test',
+            'billing.api_key' => 'test-key',
+            'identity.api_url' => 'https://identity.test/api',
+            'identity.api_key' => 'test-key',
+        ]);
+    }
+
+    private function owner(): User
+    {
+        return User::factory()->create();
+    }
+
+    private function manager(): User
+    {
+        return User::factory()->create();
+    }
+
+    private function activateBusiness(User $user): void
+    {
+        ProSubscription::create([
+            'user_id' => $user->id,
+            'plan' => ProSubscription::PLAN_ENTERPRISE,
+            'status' => ProSubscription::STATUS_ACTIVE,
+            'price_minor' => 14900,
+            'currency' => 'GHS',
+            'auto_renew' => true,
+            'started_at' => now(),
+            'current_period_end' => now()->addMonth(),
+        ]);
+    }
+
+    public function test_pro_account_cannot_invite_store_manager(): void
+    {
+        $owner = $this->owner();
+        ProSubscription::create([
+            'user_id' => $owner->id,
+            'plan' => ProSubscription::PLAN_PRO,
+            'status' => ProSubscription::STATUS_ACTIVE,
+            'price_minor' => 4900,
+            'currency' => 'GHS',
+            'auto_renew' => true,
+            'started_at' => now(),
+            'current_period_end' => now()->addMonth(),
+        ]);
+
+        $store = WooStore::create([
+            'user_id' => $owner->id,
+            'site_url' => 'https://shop-a.example.com',
+            'site_name' => 'Shop A',
+            'status' => WooStore::STATUS_ACTIVE,
+            'connected_at' => now(),
+        ]);
+
+        $this->actingAs($owner)
+            ->post(route('woo.team.store'), [
+                'email' => 'client@example.com',
+                'woo_store_id' => $store->id,
+            ])
+            ->assertRedirect(route('woo.pro.index'));
+
+        $this->assertDatabaseCount('woo_store_members', 0);
+    }
+
+    public function test_business_owner_can_invite_store_manager(): void
+    {
+        $owner = $this->owner();
+        $this->activateBusiness($owner);
+
+        $store = WooStore::create([
+            'user_id' => $owner->id,
+            'site_url' => 'https://shop-a.example.com',
+            'site_name' => 'Shop A',
+            'status' => WooStore::STATUS_ACTIVE,
+            'connected_at' => now(),
+        ]);
+
+        Http::fake([
+            'identity.test/*' => Http::response(['data' => []], 200),
+        ]);
+
+        $this->actingAs($owner)
+            ->from(route('woo.settings'))
+            ->post(route('woo.team.store'), [
+                'email' => 'client@example.com',
+                'woo_store_id' => $store->id,
+            ])
+            ->assertRedirect(route('woo.settings').'#store-team');
+
+        $this->assertDatabaseHas('woo_store_members', [
+            'owner_ref' => $owner->public_id,
+            'user_ref' => 'client@example.com',
+            'woo_store_id' => $store->id,
+            'role' => WooStoreMember::ROLE_MANAGER,
+        ]);
+    }
+
+    public function test_store_manager_only_sees_assigned_store(): void
+    {
+        $owner = $this->owner();
+        $this->activateBusiness($owner);
+        $manager = $this->manager();
+
+        $storeA = WooStore::create([
+            'user_id' => $owner->id,
+            'site_url' => 'https://shop-a.example.com',
+            'site_name' => 'Shop A',
+            'status' => WooStore::STATUS_ACTIVE,
+            'connected_at' => now(),
+        ]);
+        $storeB = WooStore::create([
+            'user_id' => $owner->id,
+            'site_url' => 'https://shop-b.example.com',
+            'site_name' => 'Shop B',
+            'status' => WooStore::STATUS_ACTIVE,
+            'connected_at' => now(),
+        ]);
+
+        WooStoreMember::create([
+            'owner_ref' => $owner->public_id,
+            'user_ref' => $manager->public_id,
+            'woo_store_id' => $storeA->id,
+            'role' => WooStoreMember::ROLE_MANAGER,
+        ]);
+
+        WooOrder::create([
+            'woo_store_id' => $storeA->id,
+            'external_order_id' => 1,
+            'order_number' => '1001',
+            'customer_name' => 'Customer A',
+            'line_items' => [],
+            'currency' => 'GHS',
+            'total_minor' => 1000,
+        ]);
+        WooOrder::create([
+            'woo_store_id' => $storeB->id,
+            'external_order_id' => 2,
+            'order_number' => '2002',
+            'customer_name' => 'Customer B',
+            'line_items' => [],
+            'currency' => 'GHS',
+            'total_minor' => 2000,
+        ]);
+
+        $this->actingAs($manager)
+            ->withSession(['ladill_account' => $owner->id])
+            ->get(route('woo.orders.index'))
+            ->assertOk()
+            ->assertSee('1001')
+            ->assertSee('Customer A')
+            ->assertDontSee('2002')
+            ->assertDontSee('Customer B');
+    }
+
+    public function test_store_manager_cannot_disconnect_store(): void
+    {
+        $owner = $this->owner();
+        $this->activateBusiness($owner);
+        $manager = $this->manager();
+
+        $store = WooStore::create([
+            'user_id' => $owner->id,
+            'site_url' => 'https://shop-a.example.com',
+            'site_name' => 'Shop A',
+            'status' => WooStore::STATUS_ACTIVE,
+            'connected_at' => now(),
+        ]);
+
+        WooStoreMember::create([
+            'owner_ref' => $owner->public_id,
+            'user_ref' => $manager->public_id,
+            'woo_store_id' => $store->id,
+            'role' => WooStoreMember::ROLE_MANAGER,
+        ]);
+
+        $this->actingAs($manager)
+            ->withSession(['ladill_account' => $owner->id])
+            ->delete(route('woo.stores.destroy', $store))
+            ->assertForbidden();
+
+        $this->assertSame(WooStore::STATUS_ACTIVE, $store->fresh()->status);
+    }
+}