# Application Permissions

This document outlines the granular permissions defined in the application and their intended effects within the Filament admin panel.

## Users (`*_users`)

- `view_any_users`:
    - See the "Users" item in the navigation sidebar (under "Admin Management").
    - Access the main User list/table page (`/admin/users`).
- `create_users`:
    - See the "New user" button on the User list page.
    - Access the User creation form (`/admin/users/create`).
- `update_users`:
    - See the "Edit" action button for each user in the table.
    - Access the User edit form (`/admin/users/{record}/edit`).
    - *(Often implies the ability to view the specific user's details within the edit form).*
- `delete_users`:
    - See the "Delete" action button for individual users.
    - See the "Delete selected" bulk action checkbox/button on the User list page.
    - Perform single or bulk deletion of users.
- `assign_roles`:
    - *(Currently not enforced by default)* Intended to control visibility/usability of the "Assign Roles" field within the User edit form. Requires adding `->visible(fn () => Auth::user()->can('assign_roles'))` to the field in `UserResource::form()` for enforcement.

## Employees (`*_employees`)

- `view_any_employees`:
    - See the "Employees" item in the navigation sidebar (under "Admin Management").
    - Access the main Employee list/table page (`/admin/employees`).
- `create_employees`:
    - See the "New employee" button.
    - Access the Employee creation form (`/admin/employees/create`).
- `update_employees`:
    - See the "Edit" action.
    - Access the Employee edit form (`/admin/employees/{record}/edit`).
- `delete_employees`:
    - See the "Delete" action.
    - See and use the "Delete selected" bulk action.
    - Perform single or bulk deletion.

## Roles (`*_roles`)

- `view_any_roles`:
    - See the "Roles" item in the navigation sidebar (under "Admin Management").
    - Access the main Role list/table page (`/admin/roles`).
- `create_roles`:
    - See the "New role" button.
    - Access the Role creation form (`/admin/roles/create`).
- `update_roles`:
    - See the "Edit" action (except for the "Super Admin" role).
    - Access the Role edit form (`/admin/roles/{record}/edit`) for roles other than Super Admin.
- `delete_roles`:
    - See the "Delete" action (except for the "Super Admin" role).
    - See and use the "Delete selected" bulk action.
    - Perform single or bulk deletion (excluding Super Admin).

## Settings (`*_settings` - Applies to Departments, Offices, Groups)

- `view_any_settings`:
    - See the "Departments", "Offices", and "Groups" items in the navigation sidebar (under "Settings").
    - Access the main list/table pages for Departments, Offices, and Groups.
- `create_settings`:
    - See the "New department", "New office", "New group" buttons.
    - Access the creation forms for these resources.
- `update_settings`:
    - See the "Edit" action for Departments, Offices, and Groups.
    - Access the edit forms for these resources.
- `delete_settings`:
    - See the "Delete" action for Departments, Offices, and Groups.
    - See and use the "Delete selected" bulk actions.
    - Perform single or bulk deletion.

## Documents (`*_documents`) - *Future Use*

- These permissions currently exist but **do nothing** until the `DocumentResource` is created and permission checks are added.

## Memos (`*_memos`) - *Future Use*

- These permissions currently exist but **do nothing** until the `MemoResource` is created and permission checks are added.
- `approve_memos`: Will likely control a custom action or status change within the Memo workflow.

---

*Note: The "Super Admin" role currently has all permissions assigned and bypasses individual checks.*