Add per-store managers for Woo Business accounts.

Agencies can invite store-scoped managers via Identity, with access limited to one WooCommerce store while owners retain full multi-store control.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Woo/Concerns/ResolvesWooContext.php

@@ -4,6 +4,7 @@ namespace App\Http\Controllers\Woo\Concerns;
 
 use App\Models\User;
 use App\Models\WooStore;
+use App\Models\WooStoreMember;
 use App\Support\CurrentWooStore;
 use Illuminate\Http\Request;
 
@@ -14,9 +15,33 @@ trait ResolvesWooContext
         return ladill_account() ?? $request->user();
     }
 
+    protected function actor(Request $request): User
+    {
+        return $request->user();
+    }
+
+    protected function wooMember(Request $request): ?WooStoreMember
+    {
+        return $request->attributes->get('woo.member');
+    }
+
+    /** @return list<int>|null */
+    protected function storeScope(Request $request): ?array
+    {
+        return $request->attributes->get('woo.storeIds');
+    }
+
+    protected function isStoreOwner(Request $request): bool
+    {
+        return $this->wooMember($request) === null;
+    }
+
     protected function currentStore(Request $request): ?WooStore
     {
-        return app(CurrentWooStore::class)->resolve($this->accountUser($request));
+        return app(CurrentWooStore::class)->resolve(
+            $this->accountUser($request),
+            $this->storeScope($request),
+        );
     }
 
     protected function currentStoreOrFail(Request $request): WooStore
@@ -29,10 +54,18 @@ trait ResolvesWooContext
 
     protected function authorizedStore(Request $request, int $storeId): WooStore
     {
-        return WooStore::query()
+        $store = WooStore::query()
             ->where('user_id', $this->accountUser($request)->id)
             ->whereKey($storeId)
             ->where('status', WooStore::STATUS_ACTIVE)
             ->firstOrFail();
+
+        abort_unless(
+            app(\App\Services\Woo\WooStoreMemberResolver::class)
+                ->canAccessStore($this->actor($request), (string) $this->accountUser($request)->public_id, $store->id),
+            404,
+        );
+
+        return $store;
     }
 }