Add per-store managers for Woo Business accounts.

Agencies can invite store-scoped managers via Identity, with access limited to one WooCommerce store while owners retain full multi-store control.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Auth/SsoLoginController.php

@@ -131,6 +131,8 @@ class SsoLoginController extends Controller
         $request->session()->regenerate();
         $request->session()->forget('sso.attempts');
 
+        app(\App\Services\Woo\TeamMemberProvisioner::class)->sync($user);
+
         return $this->finishCallback($request, $intended, null, $popup);
     }
 

app/Http/Controllers/Woo/Concerns/ResolvesWooContext.php

@@ -4,6 +4,7 @@ namespace App\Http\Controllers\Woo\Concerns;
 
 use App\Models\User;
 use App\Models\WooStore;
+use App\Models\WooStoreMember;
 use App\Support\CurrentWooStore;
 use Illuminate\Http\Request;
 
@@ -14,9 +15,33 @@ trait ResolvesWooContext
         return ladill_account() ?? $request->user();
     }
 
+    protected function actor(Request $request): User
+    {
+        return $request->user();
+    }
+
+    protected function wooMember(Request $request): ?WooStoreMember
+    {
+        return $request->attributes->get('woo.member');
+    }
+
+    /** @return list<int>|null */
+    protected function storeScope(Request $request): ?array
+    {
+        return $request->attributes->get('woo.storeIds');
+    }
+
+    protected function isStoreOwner(Request $request): bool
+    {
+        return $this->wooMember($request) === null;
+    }
+
     protected function currentStore(Request $request): ?WooStore
     {
-        return app(CurrentWooStore::class)->resolve($this->accountUser($request));
+        return app(CurrentWooStore::class)->resolve(
+            $this->accountUser($request),
+            $this->storeScope($request),
+        );
     }
 
     protected function currentStoreOrFail(Request $request): WooStore
@@ -29,10 +54,18 @@ trait ResolvesWooContext
 
     protected function authorizedStore(Request $request, int $storeId): WooStore
     {
-        return WooStore::query()
+        $store = WooStore::query()
             ->where('user_id', $this->accountUser($request)->id)
             ->whereKey($storeId)
             ->where('status', WooStore::STATUS_ACTIVE)
             ->firstOrFail();
+
+        abort_unless(
+            app(\App\Services\Woo\WooStoreMemberResolver::class)
+                ->canAccessStore($this->actor($request), (string) $this->accountUser($request)->public_id, $store->id),
+            404,
+        );
+
+        return $store;
     }
 }

app/Http/Controllers/Woo/ConnectWordPressController.php

@@ -4,7 +4,6 @@ namespace App\Http\Controllers\Woo;
 
 use App\Http\Controllers\Controller;
 use App\Http\Controllers\Woo\Concerns\ResolvesWooContext;
-use App\Http\Controllers\Woo\Concerns\ResolvesWooContext;
 use App\Models\WooStore;
 use App\Services\Woo\InstallTokenService;
 use App\Services\Woo\SubscriptionService;
@@ -24,6 +23,8 @@ class ConnectWordPressController extends Controller
 
     public function start(Request $request): RedirectResponse|View
     {
+        abort_if($this->wooMember($request), 403);
+
         $validated = $request->validate([
             'site_url' => ['required', 'url', 'max:500'],
             'return_url' => ['required', 'url', 'max:2048'],
@@ -53,12 +54,14 @@ class ConnectWordPressController extends Controller
 
     public function complete(Request $request): RedirectResponse|View
     {
+        abort_if($this->wooMember($request), 403);
+
         $pending = (array) $request->session()->pull('woo.connect', []);
         if ($pending === []) {
             return redirect()->route('woo.dashboard');
         }
 
-        $user = $request->user();
+        $user = $this->accountUser($request);
         abort_if(! $user, 401);
 
         $siteUrl = (string) ($pending['site_url'] ?? '');

app/Http/Controllers/Woo/ProController.php

@@ -21,6 +21,7 @@ class ProController extends Controller
 
     public function index(Request $request): View
     {
+        $this->guardBillingOwner($request);
         $user = $this->accountUser($request);
         $planKey = $this->subscriptions->planKey($user);
 
@@ -44,6 +45,7 @@ class ProController extends Controller
 
     public function subscribe(Request $request): RedirectResponse
     {
+        $this->guardBillingOwner($request);
         [$ok, $message] = $this->subscriptions->subscribe($this->accountUser($request));
 
         return redirect()->route('woo.pro.index')->with($ok ? 'success' : 'error', $message);
@@ -51,6 +53,7 @@ class ProController extends Controller
 
     public function subscribeEnterprise(Request $request): RedirectResponse
     {
+        $this->guardBillingOwner($request);
         [$ok, $message] = $this->subscriptions->subscribeEnterprise($this->accountUser($request));
 
         return redirect()->route('woo.pro.index')->with($ok ? 'success' : 'error', $message);
@@ -58,6 +61,7 @@ class ProController extends Controller
 
     public function subscribePrepaid(Request $request, BillingClient $billing): RedirectResponse
     {
+        $this->guardBillingOwner($request);
         $validated = $request->validate([
             'plan' => ['required', 'in:pro,enterprise'],
             'months' => ['required', 'integer', 'in:6,12,24'],
@@ -137,8 +141,14 @@ class ProController extends Controller
 
     public function cancel(Request $request): RedirectResponse
     {
+        $this->guardBillingOwner($request);
         [$ok, $message] = $this->subscriptions->cancel($this->accountUser($request));
 
         return redirect()->route('woo.pro.index')->with($ok ? 'success' : 'error', $message);
     }
+
+    private function guardBillingOwner(Request $request): void
+    {
+        abort_if($this->wooMember($request), 403);
+    }
 }

app/Http/Controllers/Woo/SettingsController.php

@@ -3,12 +3,40 @@
 namespace App\Http\Controllers\Woo;
 
 use App\Http\Controllers\Controller;
+use App\Http\Controllers\Woo\Concerns\ResolvesWooContext;
+use App\Models\WooStore;
+use App\Models\WooStoreMember;
+use App\Services\Woo\SubscriptionService;
 use Illuminate\View\View;
 
 class SettingsController extends Controller
 {
+    use ResolvesWooContext;
+
+    public function __construct(private SubscriptionService $subscriptions) {}
+
     public function edit(): View
     {
-        return view('woo.settings');
+        $account = ladill_account() ?? auth()->user();
+        $ownerRef = (string) $account?->public_id;
+        $storeScope = request()->attributes->get('woo.storeIds');
+
+        $stores = $account
+            ? WooStore::query()
+                ->where('user_id', $account->id)
+                ->where('status', WooStore::STATUS_ACTIVE)
+                ->when($storeScope !== null, fn ($q) => $q->whereIn('id', $storeScope))
+                ->orderBy('site_name')
+                ->get()
+            : collect();
+
+        return view('woo.settings', [
+            'teamStores' => $stores,
+            'members' => $ownerRef !== ''
+                ? WooStoreMember::owned($ownerRef)->with('store')->orderBy('created_at')->get()
+                : collect(),
+            'roles' => config('woo.roles', []),
+            'hasStoreTeamFeatures' => $account ? $this->subscriptions->canManageStoreTeam($account) : false,
+        ]);
     }
 }

app/Http/Controllers/Woo/StoreController.php

@@ -23,23 +23,28 @@ class StoreController extends Controller
     public function index(Request $request): View
     {
         $user = $this->accountUser($request);
+        $storeScope = $this->storeScope($request);
+
         $stores = WooStore::query()
             ->where('user_id', $user->id)
+            ->when($storeScope !== null, fn ($q) => $q->whereIn('id', $storeScope))
             ->latest('updated_at')
             ->get();
 
         return view('woo.stores.index', [
             'stores' => $stores,
-            'currentStore' => $this->currentStore->resolve($user),
+            'currentStore' => $this->currentStore->resolve($user, $storeScope),
             'hasPaidPlan' => $this->subscriptions->hasPaidPlan($user),
             'storeCount' => $this->subscriptions->connectedStoreCount($user),
             'storeLimit' => $this->subscriptions->maxStores($user),
-            'canConnectMore' => $this->subscriptions->canConnectStore($user),
+            'canConnectMore' => $this->isStoreOwner($request) && $this->subscriptions->canConnectStore($user),
+            'isStoreOwner' => $this->isStoreOwner($request),
         ]);
     }
 
     public function destroy(Request $request, WooStore $store): RedirectResponse
     {
+        abort_if(! $this->isStoreOwner($request), 403);
         abort_if($store->user_id !== $this->accountUser($request)->id, 403);
 
         $store->update(['status' => WooStore::STATUS_DISCONNECTED]);

app/Http/Controllers/Woo/StoreMemberController.php

@@ -0,0 +1,119 @@
+<?php
+
+namespace App\Http\Controllers\Woo;
+
+use App\Http\Controllers\Controller;
+use App\Http\Controllers\Woo\Concerns\ResolvesWooContext;
+use App\Models\WooStore;
+use App\Models\WooStoreMember;
+use App\Services\Identity\IdentityTeamClient;
+use App\Services\Woo\SubscriptionService;
+use App\Services\Woo\WooStoreMemberResolver;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Validation\Rule;
+
+class StoreMemberController extends Controller
+{
+    use ResolvesWooContext;
+
+    public function __construct(
+        private SubscriptionService $subscriptions,
+        private WooStoreMemberResolver $members,
+    ) {}
+
+    public function store(Request $request, IdentityTeamClient $identity): RedirectResponse
+    {
+        if ($redirect = $this->guardManage($request)) {
+            return $redirect;
+        }
+
+        $owner = (string) $this->accountUser($request)->public_id;
+
+        $validated = $request->validate([
+            'email' => ['required', 'email', 'max:255'],
+            'woo_store_id' => [
+                'required',
+                'integer',
+                Rule::exists('woo_stores', 'id')->where(fn ($q) => $q
+                    ->where('user_id', $this->accountUser($request)->id)
+                    ->where('status', WooStore::STATUS_ACTIVE)),
+            ],
+        ]);
+
+        $email = strtolower(trim($validated['email']));
+        $actor = $this->actor($request);
+
+        if ($email === strtolower((string) $actor->email)) {
+            return back()->withErrors(['email' => 'You cannot invite yourself.']);
+        }
+
+        try {
+            $identity->inviteAppMember(
+                $owner,
+                $email,
+                ['woo'],
+                [
+                    'woo' => [
+                        'role' => WooStoreMember::ROLE_MANAGER,
+                        'store_id' => (int) $validated['woo_store_id'],
+                    ],
+                ],
+            );
+        } catch (\Throwable $e) {
+            return back()->withInput()->with('error', $e->getMessage());
+        }
+
+        WooStoreMember::updateOrCreate(
+            [
+                'owner_ref' => $owner,
+                'user_ref' => $email,
+                'woo_store_id' => (int) $validated['woo_store_id'],
+            ],
+            [
+                'role' => WooStoreMember::ROLE_MANAGER,
+            ],
+        );
+
+        return redirect()
+            ->route('woo.settings')
+            ->withFragment('store-team')
+            ->with('success', 'Invitation sent to '.$email.'.');
+    }
+
+    public function destroy(Request $request, WooStoreMember $member): RedirectResponse
+    {
+        if ($redirect = $this->guardManage($request)) {
+            return $redirect;
+        }
+
+        abort_unless($member->owner_ref === (string) $this->accountUser($request)->public_id, 404);
+
+        $actor = $this->actor($request);
+        if ($member->user_ref === $actor->public_id || $member->user_ref === strtolower((string) $actor->email)) {
+            return redirect()->route('woo.settings')->withFragment('store-team')->with('error', 'You cannot remove yourself.');
+        }
+
+        $member->delete();
+
+        return redirect()
+            ->route('woo.settings')
+            ->withFragment('store-team')
+            ->with('success', 'Store manager removed.');
+    }
+
+    private function guardManage(Request $request): ?RedirectResponse
+    {
+        if (! $this->members->canManageStoreTeam($this->wooMember($request), (string) $this->accountUser($request)->public_id, $this->actor($request))) {
+            abort(403);
+        }
+
+        $account = $this->accountUser($request);
+        if (! $this->subscriptions->canManageStoreTeam($account)) {
+            return redirect()->route('woo.pro.index')
+                ->with('upsell', 'Per-store managers require Ladill Woo Manager Business.');
+        }
+
+        return null;
+    }
+}

app/Http/Controllers/Woo/StoreSwitchController.php

@@ -18,7 +18,11 @@ class StoreSwitchController extends Controller
             'store' => ['required', 'integer'],
         ]);
 
-        $stores->switch($this->accountUser($request), (int) $validated['store']);
+        $stores->switch(
+            $this->accountUser($request),
+            (int) $validated['store'],
+            $this->storeScope($request),
+        );
 
         return redirect()->back();
     }

app/Http/Middleware/SetActingAccount.php

@@ -2,8 +2,11 @@
 
 namespace App\Http\Middleware;
 
+use App\Models\User;
+use App\Models\WooStore;
 use Closure;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\View;
 use Symfony\Component\HttpFoundation\Response;
 
 class SetActingAccount
@@ -11,9 +14,48 @@ class SetActingAccount
     public function handle(Request $request, Closure $next): Response
     {
         if ($user = $request->user()) {
-            $request->attributes->set('actingAccount', $user);
+            $accountId = (int) $request->session()->get('ladill_account', $user->id);
+
+            if (! $user->canAccessAccount($accountId)) {
+                $accountId = $user->id;
+                $request->session()->put('ladill_account', $accountId);
+            }
+
+            $accountId = $this->preferEmployerAccount($request, $user, $accountId);
+
+            $account = $accountId === $user->id ? $user : (User::find($accountId) ?? $user);
+
+            $request->attributes->set('actingAccount', $account);
+
+            View::share('actingAccount', $account);
+            View::share('accessibleAccounts', $user->accessibleAccounts());
         }
 
         return $next($request);
     }
+
+    private function preferEmployerAccount(Request $request, User $user, int $accountId): int
+    {
+        if ($accountId !== $user->id) {
+            return $accountId;
+        }
+
+        if (WooStore::query()->where('user_id', $user->id)->where('status', WooStore::STATUS_ACTIVE)->exists()) {
+            return $accountId;
+        }
+
+        $membership = $user->wooMemberships()->first();
+        if (! $membership) {
+            return $accountId;
+        }
+
+        $employer = User::where('public_id', $membership->owner_ref)->first();
+        if ($employer && $user->canAccessAccount($employer->id)) {
+            $request->session()->put('ladill_account', $employer->id);
+
+            return $employer->id;
+        }
+
+        return $accountId;
+    }
 }

app/Http/Middleware/SetWooStoreMemberContext.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Models\User;
+use App\Services\Woo\SubscriptionService;
+use App\Services\Woo\WooStoreMemberResolver;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\View;
+use Symfony\Component\HttpFoundation\Response;
+
+class SetWooStoreMemberContext
+{
+    public function __construct(
+        private WooStoreMemberResolver $members,
+        private SubscriptionService $subscriptions,
+    ) {}
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (! $user = $request->user()) {
+            return $next($request);
+        }
+
+        $account = ladill_account() ?? $user;
+        $ownerRef = (string) $account->public_id;
+        $member = $this->members->memberFor($user, $ownerRef);
+        $storeIds = $this->members->accessibleStoreIds($user, $ownerRef);
+
+        $request->attributes->set('woo.member', $member);
+        $request->attributes->set('woo.storeIds', $storeIds);
+
+        $canManageTeam = $this->members->canManageStoreTeam($member, $ownerRef, $user)
+            && $this->subscriptions->canManageStoreTeam($account);
+
+        View::share('wooMember', $member);
+        View::share('wooStoreScope', $storeIds);
+        View::share('canManageStoreTeam', $canManageTeam);
+        View::share('isStoreOwner', $member === null);
+
+        return $next($request);
+    }
+}

app/Models/User.php

@@ -7,6 +7,7 @@ use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
+use Illuminate\Support\Collection;
 use Laravel\Sanctum\HasApiTokens;
 
 /** Thin local mirror of the platform identity (auth.ladill.com owns users). */
@@ -33,6 +34,34 @@ class User extends Authenticatable
         return $this->hasMany(WooStore::class);
     }
 
+    public function wooMemberships(): HasMany
+    {
+        return $this->hasMany(WooStoreMember::class, 'user_ref', 'public_id');
+    }
+
+    public function canAccessAccount(int $accountId): bool
+    {
+        if ($accountId === $this->id) {
+            return true;
+        }
+
+        $account = self::find($accountId);
+
+        return $account !== null
+            && $this->wooMemberships()->where('owner_ref', $account->public_id)->exists();
+    }
+
+    /** @return Collection<int, User> */
+    public function accessibleAccounts(): Collection
+    {
+        $ownerRefs = $this->wooMemberships()->pluck('owner_ref')->all();
+
+        return collect([$this])
+            ->merge(self::whereIn('public_id', $ownerRefs)->get())
+            ->unique('id')
+            ->values();
+    }
+
     public function avatarUrl(): ?string
     {
         $url = trim((string) $this->avatar_url);

app/Models/WooStoreMember.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class WooStoreMember extends Model
+{
+    public const ROLE_MANAGER = 'manager';
+
+    protected $fillable = [
+        'owner_ref',
+        'user_ref',
+        'woo_store_id',
+        'role',
+    ];
+
+    public function store(): BelongsTo
+    {
+        return $this->belongsTo(WooStore::class, 'woo_store_id');
+    }
+
+    public function hasRole(string ...$roles): bool
+    {
+        return in_array($this->role, $roles, true);
+    }
+
+    public function scopeOwned(Builder $query, string $ownerRef): Builder
+    {
+        return $query->where('owner_ref', $ownerRef);
+    }
+}

app/Providers/AppServiceProvider.php

@@ -17,16 +17,17 @@ class AppServiceProvider extends ServiceProvider
 
     public function boot(): void
     {
-        View::composer(['partials.sidebar', 'partials.topbar', 'partials.mobile-bottom-nav', 'partials.store-switcher-menu'], function ($view) {
+        View::composer(['partials.sidebar', 'partials.topbar', 'partials.mobile-bottom-nav', 'partials.store-switcher-menu', 'partials.store-switcher'], function ($view) {
             $account = ladill_account() ?? auth()->user();
             $svc = app(SubscriptionService::class);
             $stores = app(CurrentWooStore::class);
+            $storeIds = request()->attributes->get('woo.storeIds');
 
             $view->with('isPro', $account ? $svc->isPro($account) : false);
             $view->with('hasPaidPlan', $account ? $svc->hasPaidPlan($account) : false);
             $view->with('isEnterprise', $account ? $svc->isEnterprise($account) : false);
-            $view->with('wooActiveStores', $account ? $stores->activeStores($account) : collect());
-            $view->with('currentWooStore', $account ? $stores->resolve($account) : null);
+            $view->with('wooActiveStores', $account ? $stores->activeStores($account, $storeIds) : collect());
+            $view->with('currentWooStore', $account ? $stores->resolve($account, $storeIds) : null);
         });
 
         View::composer(['partials.topbar'], function ($view) {

app/Services/Identity/IdentityTeamClient.php

@@ -0,0 +1,64 @@
+<?php
+
+namespace App\Services\Identity;
+
+use Illuminate\Http\Client\Response;
+use Illuminate\Support\Facades\Http;
+use RuntimeException;
+
+class IdentityTeamClient
+{
+    /**
+     * @param  list<string>  $apps
+     * @param  array<string, mixed>  $metadata
+     *
+     * @return array<string, mixed>
+     */
+    public function inviteAppMember(
+        string $ownerPublicId,
+        string $email,
+        array $apps,
+        array $metadata = [],
+        string $role = 'member',
+    ): array {
+        $response = $this->request('post', '/identity/team/invite', [
+            'owner' => $ownerPublicId,
+            'email' => strtolower(trim($email)),
+            'apps' => $apps,
+            'role' => $role,
+            'metadata' => $metadata,
+        ]);
+
+        return (array) $response->json('data', []);
+    }
+
+    /** @return list<array<string, mixed>> */
+    public function teamAccess(string $userPublicId): array
+    {
+        $response = $this->request('get', '/identity/team/access', [
+            'user' => $userPublicId,
+        ]);
+
+        return (array) $response->json('data', []);
+    }
+
+    private function request(string $method, string $path, array $query = []): Response
+    {
+        $url = rtrim((string) config('identity.api_url'), '/').$path;
+        $key = config('identity.api_key');
+
+        if ($url === '' || ! is_string($key) || $key === '') {
+            throw new RuntimeException('Identity API is not configured.');
+        }
+
+        $response = Http::withToken($key)
+            ->timeout(10)
+            ->{$method}($url, $query);
+
+        if (! $response->successful()) {
+            throw new RuntimeException($response->json('message') ?: 'Identity API request failed.');
+        }
+
+        return $response;
+    }
+}

app/Services/Woo/SubscriptionService.php

@@ -123,6 +123,11 @@ class SubscriptionService
         return $this->productCount($user) < $this->maxProducts($user);
     }
 
+    public function canManageStoreTeam(User $user): bool
+    {
+        return $this->isEnterprise($user);
+    }
+
     public function canIngestProduct(User $user, WooStore $store, int $externalId): bool
     {
         if ($this->isPro($user)) {

app/Services/Woo/TeamMemberProvisioner.php

@@ -0,0 +1,56 @@
+<?php
+
+namespace App\Services\Woo;
+
+use App\Models\User;
+use App\Models\WooStoreMember;
+use App\Services\Identity\IdentityTeamClient;
+
+class TeamMemberProvisioner
+{
+    public function __construct(
+        protected IdentityTeamClient $identity,
+    ) {}
+
+    public function sync(User $user): void
+    {
+        WooStoreMember::query()
+            ->where('user_ref', strtolower((string) $user->email))
+            ->update(['user_ref' => $user->public_id]);
+
+        try {
+            $access = $this->identity->teamAccess($user->public_id);
+        } catch (\Throwable) {
+            return;
+        }
+
+        foreach ($access as $grant) {
+            if (($grant['self'] ?? false) || ($grant['full_access'] ?? false)) {
+                continue;
+            }
+
+            $apps = (array) ($grant['apps'] ?? []);
+            if (! in_array('woo', $apps, true)) {
+                continue;
+            }
+
+            $meta = (array) data_get($grant, 'metadata.woo', []);
+            $storeId = (int) ($meta['store_id'] ?? 0);
+
+            if ($storeId <= 0) {
+                continue;
+            }
+
+            WooStoreMember::updateOrCreate(
+                [
+                    'owner_ref' => (string) ($grant['account'] ?? $user->public_id),
+                    'user_ref' => $user->public_id,
+                    'woo_store_id' => $storeId,
+                ],
+                [
+                    'role' => (string) ($meta['role'] ?? WooStoreMember::ROLE_MANAGER),
+                ],
+            );
+        }
+    }
+}

app/Services/Woo/WooStoreMemberResolver.php

@@ -0,0 +1,69 @@
+<?php
+
+namespace App\Services\Woo;
+
+use App\Models\User;
+use App\Models\WooStoreMember;
+use Illuminate\Support\Collection;
+
+class WooStoreMemberResolver
+{
+    public function isAccountOwner(User $actor, string $ownerRef): bool
+    {
+        return $actor->public_id === $ownerRef;
+    }
+
+    public function memberFor(User $actor, string $ownerRef): ?WooStoreMember
+    {
+        if ($this->isAccountOwner($actor, $ownerRef)) {
+            return null;
+        }
+
+        return WooStoreMember::query()
+            ->where('owner_ref', $ownerRef)
+            ->where('user_ref', $actor->public_id)
+            ->first();
+    }
+
+    /** @return list<int> */
+    public function accessibleStoreIds(User $actor, string $ownerRef): ?array
+    {
+        if ($this->isAccountOwner($actor, $ownerRef)) {
+            return null;
+        }
+
+        $ids = WooStoreMember::query()
+            ->where('owner_ref', $ownerRef)
+            ->where('user_ref', $actor->public_id)
+            ->pluck('woo_store_id')
+            ->map(fn ($id) => (int) $id)
+            ->unique()
+            ->values()
+            ->all();
+
+        abort_if($ids === [], 403, 'You do not have access to this Woo Manager account.');
+
+        return $ids;
+    }
+
+    public function canAccessStore(User $actor, string $ownerRef, int $storeId): bool
+    {
+        $scope = $this->accessibleStoreIds($actor, $ownerRef);
+
+        return $scope === null || in_array($storeId, $scope, true);
+    }
+
+    public function canManageStoreTeam(?WooStoreMember $member, string $ownerRef, User $actor): bool
+    {
+        return $this->isAccountOwner($actor, $ownerRef);
+    }
+
+    /** @return Collection<int, WooStoreMember> */
+    public function membershipsFor(User $actor): Collection
+    {
+        return WooStoreMember::query()
+            ->where('user_ref', $actor->public_id)
+            ->with('store')
+            ->get();
+    }
+}

app/Support/CurrentWooStore.php

@@ -10,27 +10,40 @@ class CurrentWooStore
 {
     public const SESSION_KEY = 'woo.current_store_id';
 
-    public function activeStores(User $user): Collection
+    /** @param  list<int>|null  $allowedStoreIds */
+    public function activeStores(User $account, ?array $allowedStoreIds = null): Collection
     {
-        return WooStore::query()
-            ->where('user_id', $user->id)
+        $query = WooStore::query()
+            ->where('user_id', $account->id)
             ->where('status', WooStore::STATUS_ACTIVE)
             ->orderBy('site_name')
-            ->orderBy('site_url')
-            ->get();
+            ->orderBy('site_url');
+
+        if ($allowedStoreIds !== null) {
+            $query->whereIn('id', $allowedStoreIds);
+        }
+
+        return $query->get();
     }
 
-    public function resolve(?User $user): ?WooStore
+    /** @param  list<int>|null  $allowedStoreIds */
+    public function resolve(?User $account, ?array $allowedStoreIds = null): ?WooStore
     {
-        if (! $user) {
+        if (! $account) {
             return null;
         }
 
-        $stores = $this->activeStores($user);
+        $stores = $this->activeStores($account, $allowedStoreIds);
         if ($stores->isEmpty()) {
             return null;
         }
 
+        if ($allowedStoreIds !== null && count($allowedStoreIds) === 1) {
+            session([self::SESSION_KEY => $stores->first()->id]);
+
+            return $stores->first();
+        }
+
         $selectedId = (int) session(self::SESSION_KEY, 0);
         $store = $stores->firstWhere('id', $selectedId);
         if ($store) {
@@ -43,13 +56,19 @@ class CurrentWooStore
         return $first;
     }
 
-    public function switch(User $user, int $storeId): WooStore
+    /** @param  list<int>|null  $allowedStoreIds */
+    public function switch(User $account, int $storeId, ?array $allowedStoreIds = null): WooStore
     {
-        $store = WooStore::query()
-            ->where('user_id', $user->id)
+        $query = WooStore::query()
+            ->where('user_id', $account->id)
             ->whereKey($storeId)
-            ->where('status', WooStore::STATUS_ACTIVE)
-            ->firstOrFail();
+            ->where('status', WooStore::STATUS_ACTIVE);
+
+        if ($allowedStoreIds !== null) {
+            $query->whereIn('id', $allowedStoreIds);
+        }
+
+        $store = $query->firstOrFail();
 
         session([self::SESSION_KEY => $store->id]);