From 3bfad9cf427c4244c1c67183a178c6c9c05396c1 Mon Sep 17 00:00:00 2001
From: Sari <sari@openclaw.local>
Date: Mon, 3 Aug 2026 09:58:52 +0700
Subject: [PATCH] =?UTF-8?q?hak=20akses=20konsisten:=20sidebar=20Master=20D?=
 =?UTF-8?q?ata=20pakai=20permission=20per-menu=20(+directive=20canAnyPermi?=
 =?UTF-8?q?ssion);=20FIX=20direktif=20canPermission=20pakai=20canPermissio?=
 =?UTF-8?q?n()=20model=20(sebelumnya=20hanya=20role=20kolom=20=E2=80=94=20?=
 =?UTF-8?q?multi-role=20&=20user=20tanpa=20kolom=20role=20tidak=20dapat=20?=
 =?UTF-8?q?menu)=20+=20test?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/Providers/AppServiceProvider.php       | 26 +++++++++++++---------
 resources/views/layouts/app.blade.php      |  8 ++++++-
 tests/Feature/PermissionManagementTest.php | 22 ++++++++++++++++++
 3 files changed, 44 insertions(+), 12 deletions(-)

diff --git a/app/Providers/AppServiceProvider.php b/app/Providers/AppServiceProvider.php
index ae22a4c..f658255 100644
--- a/app/Providers/AppServiceProvider.php
+++ b/app/Providers/AppServiceProvider.php
@@ -4,7 +4,6 @@ namespace App\Providers;
 
 use Illuminate\Pagination\Paginator;
 use Illuminate\Support\Facades\Blade;
-use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\ServiceProvider;
 
 class AppServiceProvider extends ServiceProvider
@@ -30,17 +29,22 @@ class AppServiceProvider extends ServiceProvider
             if (! $user) {
                 return false;
             }
-            if ($user->role === 'admin') {
-                return true;
+
+            return $user->canPermission($permission);
+        });
+
+        // Blade directive: @canAnyPermission('a', 'b', ...) — true jika user punya SALAH SATU permission
+        Blade::if('canAnyPermission', function (string ...$permissions) {
+            $user = auth()->user();
+            if (! $user) {
+                return false;
             }
-            $rolePermissions = Cache::remember('role_permissions:' . $user->role, 3600, function () use ($user) {
-                return \DB::table('role_permissions')
-                    ->join('permissions', 'role_permissions.permission_id', '=', 'permissions.id')
-                    ->where('role_permissions.role', $user->role)
-                    ->pluck('permissions.key')
-                    ->toArray();
-            });
-            return in_array($permission, $rolePermissions);
+            foreach ($permissions as $permission) {
+                if ($user->canPermission($permission)) {
+                    return true;
+                }
+            }
+            return false;
         });
     }
 }
diff --git a/resources/views/layouts/app.blade.php b/resources/views/layouts/app.blade.php
index 5034a8b..4fbedf6 100644
--- a/resources/views/layouts/app.blade.php
+++ b/resources/views/layouts/app.blade.php
@@ -171,17 +171,23 @@
                 <x-nav-item href="{{ route('reports.violations') }}" icon="file-lines" :active="request()->routeIs('reports.violations*')">Laporan</x-nav-item>
                 @endcanPermission
 
-                @canPermission('categories-manage')
+                @canAnyPermission('categories-manage', 'violation-types-manage', 'thresholds-manage', 'face-register')
                 <div class="pt-4 mt-4 border-t border-gray-200">
                     <p class="px-3 text-xs font-semibold text-gray-500 uppercase tracking-wider">Master Data</p>
                 </div>
+                @endcanAnyPermission
                 @canPermission('face-register')
                 <x-nav-item href="{{ route('face.register') }}" icon="user-plus" :active="request()->routeIs('face.register')">Registrasi Wajah</x-nav-item>
                 @endcanPermission
+                @canPermission('categories-manage')
                 <x-nav-item href="{{ route('settings.categories') }}" icon="tag" :active="request()->routeIs('settings.categories*')">Kategori Pelanggaran</x-nav-item>
+                @endcanPermission
+                @canPermission('violation-types-manage')
                 <x-nav-item href="{{ route('settings.violation-types') }}" icon="list" :active="request()->routeIs('settings.violation-types*')">Jenis Pelanggaran</x-nav-item>
                 <x-nav-item href="{{ route('settings.handling-types') }}" icon="hand-holding-heart" :active="request()->routeIs('settings.handling-types*')">Jenis Penanganan</x-nav-item>
                 <x-nav-item href="{{ route('settings.homeroom') }}" icon="chalkboard-user" :active="request()->routeIs('settings.homeroom*')">Wali Kelas</x-nav-item>
+                @endcanPermission
+                @canPermission('thresholds-manage')
                 <x-nav-item href="{{ route('settings.thresholds') }}" icon="chart-bar" :active="request()->routeIs('settings.thresholds*')">Ambang SP</x-nav-item>
                 @endcanPermission
 
diff --git a/tests/Feature/PermissionManagementTest.php b/tests/Feature/PermissionManagementTest.php
index 95c0719..dd434d3 100644
--- a/tests/Feature/PermissionManagementTest.php
+++ b/tests/Feature/PermissionManagementTest.php
@@ -52,4 +52,26 @@ class PermissionManagementTest extends TestCase
             ->assertSee('view-point-audit')
             ->assertSee('Khusus Admin');
     }
+
+    public function test_menu_sidebar_mengikuti_permission_role(): void
+    {
+        // Role staff dengan akses dashboard + thresholds-manage SAJA
+        $staff = User::factory()->create(['roles' => ['staff']]);
+        $ids = DB::table('permissions')->whereIn('key', ['access-dashboard', 'thresholds-manage'])->pluck('id');
+        foreach ($ids as $pid) {
+            DB::table('role_permissions')->insert([
+                'role' => 'staff',
+                'permission_id' => $pid,
+                'created_at' => now(),
+                'updated_at' => now(),
+            ]);
+        }
+
+        $this->actingAs($staff)
+            ->get('/dashboard')
+            ->assertOk()
+            ->assertSee('Ambang SP')
+            ->assertDontSee('Kategori Pelanggaran')
+            ->assertDontSee('Sinkronisasi');
+    }
 }