From 5b7a41927b28d79bd8964574c0d7fd3a25d7389d Mon Sep 17 00:00:00 2001
From: admin <aysuser00@gmail.com>
Date: Wed, 1 Jul 2026 10:02:32 +0800
Subject: [PATCH] Add Leave Balances and Biometric Attendance menu items for
 employees and handle view-only permissions

---
 .../BiometricAttendanceController.php         | 23 ++++++++++++++++++-
 .../Controllers/LeaveBalanceController.php    |  6 ++---
 resources/js/components/app-sidebar.tsx       | 18 +++++++++++++++
 3 files changed, 43 insertions(+), 4 deletions(-)

diff --git a/app/Http/Controllers/BiometricAttendanceController.php b/app/Http/Controllers/BiometricAttendanceController.php
index 35310c2e2..8b29a5a7d 100644
--- a/app/Http/Controllers/BiometricAttendanceController.php
+++ b/app/Http/Controllers/BiometricAttendanceController.php
@@ -144,12 +144,22 @@ class BiometricAttendanceController extends Controller
 
     public function index(Request $request)
     {
-        if (!Auth::user()->can('manage-biometric-attendance')) {
+        if (!Auth::user()->can('manage-biometric-attendance') && !Auth::user()->can('view-biometric-attendance')) {
             return redirect()->back()->with('error', __('Permission Denied.'));
         }
 
         $query = \App\Models\BiometricAttendance::with(['branch']);
 
+        // Filter by user type if employee
+        if (Auth::user()->type === 'employee') {
+            $biometricEmpId = Auth::user()->employee?->biometric_emp_id;
+            if (empty($biometricEmpId)) {
+                $query->whereRaw('1 = 0');
+            } else {
+                $query->where('biometric_emp_id', $biometricEmpId);
+            }
+        }
+
         // Filter by dates
         if ($request->has('start_date') && !empty($request->start_date)) {
             $query->whereDate('punch_time', '>=', $request->start_date);
@@ -278,6 +288,17 @@ class BiometricAttendanceController extends Controller
                 ], 403);
             }
 
+            // If user is an employee, verify they are viewing their own record
+            if (Auth::user()->type === 'employee') {
+                $biometricEmpId = Auth::user()->employee?->biometric_emp_id;
+                if (empty($biometricEmpId) || $biometricEmpId !== $employeeCode) {
+                    return response()->json([
+                        'success' => false,
+                        'message' => 'Permission denied'
+                    ], 403);
+                }
+            }
+
             $employee = Employee::with('shift')->where('biometric_emp_id', $employeeCode)->first();
 
             // Fetch records +/- 1 day around the requested work date to catch cross-midnight punches
diff --git a/app/Http/Controllers/LeaveBalanceController.php b/app/Http/Controllers/LeaveBalanceController.php
index 2c9d58841..c8bac12c9 100644
--- a/app/Http/Controllers/LeaveBalanceController.php
+++ b/app/Http/Controllers/LeaveBalanceController.php
@@ -16,12 +16,12 @@ class LeaveBalanceController extends Controller
 {
     public function index(Request $request)
     {
-        if (Auth::user()->can('manage-leave-balances')) {
+        if (Auth::user()->can('manage-leave-balances') || Auth::user()->can('view-leave-balances')) {
             $query = LeaveBalance::with(['employee', 'leaveType', 'leavePolicy', 'creator'])
                 ->where(function ($q) {
                     if (Auth::user()->can('manage-any-leave-balances')) {
                         $q->whereIn('created_by',  getCompanyAndUsersId());
-                    } elseif (Auth::user()->can('manage-own-leave-balances')) {
+                    } elseif (Auth::user()->can('manage-own-leave-balances') || Auth::user()->can('view-leave-balances') || Auth::user()->type === 'employee') {
                         $q->where('created_by', Auth::id())->orWhere('employee_id', Auth::id());
                     } else {
                         $q->whereRaw('1 = 0');
@@ -115,7 +115,7 @@ class LeaveBalanceController extends Controller
         // Get employees for filter dropdown (compatible with getFilteredEmployees logic)
         $employeeQuery = Employee::whereIn('created_by', getCompanyAndUsersId());
 
-        if (Auth::user()->can('manage-own-leave-balances') && !Auth::user()->can('manage-any-leave-balances')) {
+        if ((Auth::user()->can('manage-own-leave-balances') || Auth::user()->can('view-leave-balances') || Auth::user()->type === 'employee') && !Auth::user()->can('manage-any-leave-balances')) {
             $employeeQuery->where(function ($q) {
                 $q->where('created_by', Auth::id())->orWhere('user_id', Auth::id());
             });
diff --git a/resources/js/components/app-sidebar.tsx b/resources/js/components/app-sidebar.tsx
index 06daad795..6396ce1d8 100755
--- a/resources/js/components/app-sidebar.tsx
+++ b/resources/js/components/app-sidebar.tsx
@@ -1006,6 +1006,24 @@ export function AppSidebar() {
             icon: DollarSign,
         });
 
+        // Leave Balances (only if employee has permission)
+        if (hasPermission(permissions, 'view-leave-balances') || hasPermission(permissions, 'manage-own-leave-balances') || hasPermission(permissions, 'manage-leave-balances')) {
+            items.push({
+                title: t('Leave Balances'),
+                href: route('hr.leave-balances.index'),
+                icon: CalendarDays,
+            });
+        }
+
+        // Biometric Attendance (only if employee has permission)
+        if (hasPermission(permissions, 'view-biometric-attendance') || hasPermission(permissions, 'manage-own-biometric-attendance') || hasPermission(permissions, 'manage-biometric-attendance')) {
+            items.push({
+                title: t('Biometric Attendance'),
+                href: route('hr.biometric-attendance.index'),
+                icon: Fingerprint,
+            });
+        }
+
         return items;
     };