From 7b0605a705a57a2f03a1287e0e9ebe24fb61e9ee Mon Sep 17 00:00:00 2001
From: dvappnnt <aysuser00@gmail.com>
Date: Mon, 13 Apr 2026 14:53:10 +0800
Subject: [PATCH] employee role seed

---
 app/Http/Controllers/RoleController.php       |  24 ++++-
 config/role-permissions.php                   |   5 +-
 .../seeders/RestrictEmployeeRoleSeeder.php    |  92 ++++++++++++++++++
 .../media/avatars/avatar_1776062912.jpg       | Bin 0 -> 4253 bytes
 resources/js/components/app-sidebar.tsx       |   6 +-
 routes/web.php                                |   4 +-
 6 files changed, 119 insertions(+), 12 deletions(-)
 create mode 100644 database/seeders/RestrictEmployeeRoleSeeder.php
 create mode 100644 public/uploads/media/avatars/avatar_1776062912.jpg

diff --git a/app/Http/Controllers/RoleController.php b/app/Http/Controllers/RoleController.php
index 6e08ba79c..487160d35 100644
--- a/app/Http/Controllers/RoleController.php
+++ b/app/Http/Controllers/RoleController.php
@@ -44,7 +44,7 @@ class RoleController extends BaseController
 
     }
 
-    private function getFilteredPermissions()
+    private function getFilteredPermissions($targetRole = null)
     {
         $user = Auth::user();
         $userType = $user->type ?? 'company';
@@ -54,8 +54,15 @@ class RoleController extends BaseController
             return Permission::all()->groupBy('module');
         }
 
-        // Get allowed modules for current user role
-        $allowedModules = config('role-permissions.' . $userType, config('role-permissions.company'));
+        // Determine the module list to use. 
+        // If we are editing an 'employee' role specifically, use that list.
+        $targetType = $userType;
+        if ($targetRole && $targetRole->name === 'employee') {
+            $targetType = 'employee';
+        }
+
+        // Get allowed modules for target role type
+        $allowedModules = config('role-permissions.' . $targetType, config('role-permissions.company'));
 
         // Filter permissions by allowed modules
         $query = Permission::whereIn('module', $allowedModules);
@@ -92,8 +99,15 @@ class RoleController extends BaseController
             return $permissions;
         }
 
-        // Get allowed modules for current user role
-        $allowedModules = config('role-permissions.' . $userType, config('role-permissions.company'));
+        // Determine the module list to use.
+        $targetType = $userType;
+        $roleName = $role ? $role->name : Str::slug(request()->label);
+        if ($roleName === 'employee') {
+            $targetType = 'employee';
+        }
+
+        // Get allowed modules for target type
+        $allowedModules = config('role-permissions.' . $targetType, config('role-permissions.company'));
         if (!is_array($allowedModules)) {
             $allowedModules = [];
         }
diff --git a/config/role-permissions.php b/config/role-permissions.php
index 21f64b5b8..c702ce80d 100644
--- a/config/role-permissions.php
+++ b/config/role-permissions.php
@@ -114,5 +114,8 @@ return [
         'calendar',
         'custom_questions',
         'career'
-    ]
+    ],
+    'employee' => [
+        'dashboard', 'announcements', 'holidays', 'calendar', 'attendance_records', 'leave_applications', 'payslips', 'awards', 'trips', 'complaints', 'meetings', 'hr_documents', 'employee_contracts', 'assets', 'employee-trainings', 'employee_goals', 'employee_reviews', 'document_acknowledgments'
+    ],
 ];
diff --git a/database/seeders/RestrictEmployeeRoleSeeder.php b/database/seeders/RestrictEmployeeRoleSeeder.php
new file mode 100644
index 000000000..7160d6468
--- /dev/null
+++ b/database/seeders/RestrictEmployeeRoleSeeder.php
@@ -0,0 +1,92 @@
+<?php
+
+namespace Database\Seeders;
+
+use Illuminate\Database\Seeder;
+use Spatie\Permission\Models\Role;
+use Spatie\Permission\Models\Permission;
+
+class RestrictEmployeeRoleSeeder extends Seeder
+{
+    /**
+     * Run the database seeds.
+     */
+    public function run(): void
+    {
+        // Define the safe set of permissions for an employee
+        $employeePermissions = [
+            // Dashboard
+            'manage-dashboard',
+
+            // Attendance
+            'manage-attendance-records',
+            'manage-own-attendance-records',
+            'clock-in-out',
+            'manage-attendance-regularizations',
+            'manage-own-attendance-regularizations',
+            'create-attendance-regularizations',
+            'view-own-attendance-regularizations',
+
+            // Leaves
+            'manage-leave-applications',
+            'manage-own-leave-applications',
+            'create-leave-applications',
+            'edit-leave-applications',
+            'manage-leave-balances',
+            'manage-own-leave-balances',
+
+            // Payroll
+            'manage-payslips',
+            'manage-own-payslips',
+            'download-payslips',
+
+            // Performance & Goals
+            'manage-employee-goals',
+            'manage-own-employee-goals',
+            'manage-employee-reviews',
+            'manage-own-employee-reviews',
+            'manage-performance-indicators',
+            'manage-own-performance-indicators',
+
+            // Documents & Contracts
+            'manage-hr-documents',
+            'manage-own-hr-documents',
+            'manage-employee-contracts',
+            'manage-own-employee-contracts',
+            'manage-document-acknowledgments',
+            'manage-own-document-acknowledgments',
+            'acknowledge-document-acknowledgments',
+
+            // Assets
+            'manage-assets',
+            'manage-own-assets',
+
+            // Social & Communication
+            'manage-announcements',
+            'manage-own-announcements',
+            'manage-holidays',
+            'view-calendar',
+            'manage-meetings',
+            'manage-own-meetings',
+
+            // Training
+            'manage-employee-trainings',
+            'manage-own-employee-trainings',
+        ];
+
+        // Find all roles named 'employee'
+        $roles = Role::where('name', 'employee')->get();
+
+        foreach ($roles as $role) {
+            $this->command->info("Restricting permissions for role: {$role->name} (ID: {$role->id}, Company: {$role->company_id})");
+            
+            // Filter only permissions that actually exist in the database
+            $validPermissions = Permission::whereIn('name', $employeePermissions)->pluck('name')->toArray();
+            
+            // Sync permissions (this removes old ones and adds new ones)
+            $role->syncPermissions($validPermissions);
+        }
+
+        $this->command->info('Done! All employee roles have been restricted.');
+    }
+}
diff --git a/public/uploads/media/avatars/avatar_1776062912.jpg b/public/uploads/media/avatars/avatar_1776062912.jpg
new file mode 100644
index 0000000000000000000000000000000000000000..928f20fbfe1fac8327c7bb062d7bf213d55760c8
GIT binary patch
literal 4253
zcmb7HcUV)|62GCB2!sxbbfiN9gd!l)6hcC;5?vsn2Q)NAK@=CIDAI|rMvZ`k5(yyE
zWkn&NAR=8ws<MD|q)A?a@9n-n-al{dcfa|anYlA_=ALurUivWo3m{-?ZDS39Kmc%>
zaRKy2;D$qBcw~4)VEB0%9ZhY(z}yDO#s)Ac@Cb`C;A?G;wAA*|*4FmXHPqH&aBU10
z3T1M*A=KdCW8Z@@6pCeXs3GjY&Q}M<d`=tVe=yYch3OmsI7|o5l*9FP5A*<i5;SaM
zVR6pE$==$=&gvjNP-mzgE`mh>0B~WEc&Ah5G9I2@GMtkDD<BMT1AKs#k6*-jq_edP
zGt~&6m<Yc}d?*wDLz{yDW1;}iuMy}IhN&Tck{0S@HQsO(wo;DGpZv$}e<E%SHo}jg
zS!Ucv{LbSe0RRMMU~o+2c_tQTU|~EXDF#+&;(%Y+jEQ}JVP<Z^co!!NhD{&?{}%9H
z*!REizhf~>0JbOx9VY*qBC!`4@c_WWLK|S#;Fn^}@nCKs(Kr9d62}3+q?JymH~u5D
zZ3TcTeE{I8|3{{5000mk0O+jui^50$@&~9g_!VFaRLBy=n#e}uKyeB3h=YCk)*-#Z
zo8rMoG-WIl%2k3j<8|f@t4|DCyCdN)(cWShsnDb-xA@z))HC6QWhH6Uu@*vC#}IZp
zW@Vd^$rxY(aC2~SadL2TadPqSaPuA#<v#=lA37{7A|NUwB_}5%B`vL>tgEh|1U)7#
ztzn`8)zddJGLlz2VR^#9Lf6nppXmg|!^3k3d`Oa?Us7LDT2cT1Ci)8i!Ua?TRjeR6
zfCU0#g@EYoz+nJjVFfX_!{5XLV&!0G<76l;1ppQn5QvSP?GP{fFB1?8D;tDeP!`G|
zbkfmB?m}i2r?4o@*(KuI^^CSZ`$Xgwbj>ZD60;soDC+s*mn|4xBtZuu{`SuRAQm=u
zRt|<v8N!Uf%F4?AcM6OM5H>-mkSt72=cKTslh3mG1bq|$vohR3SRud(;DeH_@3GIe
z{yNs%zL;V;OtGa!G3t>L>akhmYdcGt9S~>pfx&Lww99Z-)CS${G<O!bsbER_z?48#
z62PY$GH=M)m}df~Ay2sYRF63dDZ(bk*pq(<m3sLpsdMl`RBjQBG6d$*2;NcQmId+b
z<boEC-jk^;3zC`1E}xd&V!=7cR`!4gFTtLcvRUj0nC3FZRNNVquq-~UTCt^O!T}?X
zU$1`W`%=__Bo|v2&(nJ{v9hxQ9f5eQ!3*|0S*ns;s*)i-osw*4E-oaK!F5*#;A8Pq
za>=LV-BTA0hGBy;36S4vb(*W-Lftp;u#Y6flz1gyyeZe$P<1_GjgQM<ZAUke5PfBK
zU&SggH?>|ga=kS6vD3ikiErtO9$Phjr(%viaciASP2i;|w&jmqNdUlR|9KUhsXEvx
ztku#<^SG?*eRLp8r{HFo$R~86^AD=`<J*L((fl$k!Snsy2oKX)mk&WCgF2CqRaW2m
z`4i>xXE3kwXCF+b5M<=cZkw3}=t)3@6eZcOx4*V4HQ}&JH4EN>2rqOKgVV$)%X&%9
z55`-5^4AR96TTeyYGC&b!1ip|*}MFit#--)ZT0km8*k|EdR^TZ5?6&cQNe%c^vBIY
zgRqJDh7Iqttu;MiV`D<2aHGEl4f^8kE@LO@0P9fS&y-bte6@U$@dW2?yw=M>=NxL`
z=HR*80^~Y1WN>VSqk`h2KD@$n2T&+g<Wwx}HDoEP?<kH$bYtfmJ6o}wCT6H}xS${!
z*V8>iS$>62&!<E`bRWz0D6v<&ynOquyL)5|nW}?ciOm(a19xjv<#G1=eG8f2;p=GL
zx!-G>ee}qFk2ZpTrtC=BuX_NT5!Y^YrzD|QymK-U^J*GBS4%Kg%A2v0_v7R3#?n)y
zU=Fu1onV|9+6;JG3@@@tBap7Q`6@z%jycJM8gbD9^p12;In0D*axMPmXh`b%<-qoV
z-S_)jg7ZE|C+di@xtgcV>gkubx78*^0q$p?zD`~B8`Bco5?!YRBjhzbq7b%0u?YLo
zye$Kp97>&OPFuK5vE!K;+Q_%hQihGEBIMJ2q<;2J#*!j45muesm3-*@ORm$dOAj{s
zo1;nJhU-OU{D$J}Jy1r)k?(7hT2Mycy775!LDQq2>kE4^IEverId381uzjF&b=9Xj
zlQR=sns|R{EiL)LnW)?lL)x6U75=-8V8dc6Z&of5wQ%VQe*qy3x7x5BJkFM<TsiHK
zZXMQ3Yje1yZDXHhf7Yb8eJ$9ZhA^!}df>+9zC;GbLWzwkKEqolRGTmFx{n43sgr5$
zn9xcuTP>H}e0P2C><r!zH>+1fOV;jc{8T|QFR86X5ZzmQl!VnCbWG{D2fzHf-<-8d
z-N-KXB<}3ncXbas5q>|RgnRjlFIfbJ@)KtVShe$Mk7{1q^|yVjf@Z1OVLHDY$}_w4
zHIBb2<jvKp-Kjs;O;?_3I)6z+o@>@xN}M5_>DJr`XmLZJFK=Lj{^-eD_?r61;uEd6
z7?X21cH>*FdcLqD89b+vyh=;kY(z^YgBoOO8X6T7Lz@WOt|23u18aoHj!K%lK~KFw
zmxe*@@GEWugj_={=7?v}oWIomC-PSK2yf&KzustcckkByLUr%B#N@>{i;6jlk7XLA
z@heLK#g!R8%>_paijFpG>QdrbCnhGbIyx|T?m5peYT^9_*`vK|clyt#er|l`OopRO
z45Jamk?J_qr{O&V!%FGpdvsvjF|AP1HM6qwd(WX#&Dqe{<JGv4E$aO2PPbQ9Qj`2X
zD%^H6ejzssk@y}yH$J@I`$Vgviw74YUqaQc8YBj^5iK7INx+gH#5Aa7P7sWv_X^~j
z@>1vkM|tPETe2rnt!6biaf-1;*YsZB&oVKcwWdh9CvxAX1NO9S&)AWZVehV%Oz)L9
zhZdP~c<&KP_=SxWp#q(=eX<E?GjkX%jo=kGr4;hpQxAg5t$bR>i^C`UhA4Hdc|UGv
zq-`31CGNF0g?77Ml;?L}LhOE7#o3ADjvT&FKGD=fxC(BRSW_e4HyLyejS0O`h-oBj
zB+B-q3B}+0icR_&?H9GG|1um0my;?}7OBHq{*KT*!J3XrSYftIVbQTiDPGUIF6tp<
ziVT(i)N~5B%p7=z+c9}Ml_-*tnN9WjQcoU=A-3PS6RLQPJtI4tdXFi=udE!OX$Tto
zD^JO-%(bzP51`29W1NjDy#5TaZsO%TIzE>1B9$anilJS3hhFM<v1F)RPAxj0J#%Xn
zvl@JH#O>YZ%KGQ?;}8A$6i0^0fp;p_!n55k3-O9E_f=Gg3T<8mQQiD3Y}3EDB*2eM
z_M)v6jvMM2k&V(%a1{MmC#A2$d;X-bO6m@DJaf7-z1!;mdYp;iqT%Xte~V6}0}cnJ
zH^(-f`uS3Arf43^)qZb72Y*z#3Yx)adS-V=uL0^@v|>ijNh44a>w_`HZU?0g_p9qT
zv3>R8sI=)fKJVbs+^M&7LqpSB&sR3!acoQHl9S7k-Y*d3-#1WYzD3+65>}fJUwm_g
zO2qMZ-Ci1vaaBDtF$gabnR=Q0aTtA+<R2ePQ=?u@M?u!KY8J1(broKXxnDfe5%L?r
zX>o08bQ9xTO{qR~EYgoWwA*T$#L6pnENEsUD&)A*j}k-Evl>K%@vwpTFtqSOnZtNi
zcGI~p7pN7B*iH4mCv#Sh8>`@FdrJJL$fe8@jZP_D2KY)9o~C?9*{d^pPUnEjLcx0|
z3b`eF>&2qjJ}GDQ{RZ`h)wAO`YDW(qzca$U_gbOx+1sshg`0Mmu6_v^nDYbI2R05X
zXqK8C=53)=Dr50K?y$SV5eubMOYSTcqu}m}$}O|$r3+Hk*2C>?ZXd!@_7=TXQumDQ
zvx3p7S<xDOjglkom`k==W@*oIq9mj6KZyaXpv3+(@+66H8@&_%QSteB#nFxa2I=pj
zbih$6ru|Lq@vJYypu0b!(pL^&EftLW*vH^c5=*6@x8yFh4}mh#1`qeA!Z!pi*O4aS
zJAr7AxR-Nbd&ocu`{<f0w&O^_hM-gJ73=S!e17m3HLmEHVVg(#SJdKkEgP_B?^_Fx
ztyF0}MF;Ostk=aWJ?UB}hMKo8U%))B-CG#a+M(3UEb?Up_`ez~l2p5LBxH7PVdmHi
zN;C;SCit0XJ^90~mU(VQc4>&E3cSJ;%kn>gJmCc;$|c)XK(pXaqtt(uPXjdYZI`l|
zhK<%;l@&*!w67PW^T#!8&-Gf=r{CsY+>;mqp9yM|q`f}h@yRVn;*wLvYEUJDkojm{
znF{a6lu@-jdibqdBHnE#VOHJjRw<Xb11q9UrklQ;r`FpdOO|7*Vqmd0)$`Pb(4uAo
zpADWXhhtx@sgBhSsH>}!eZ25FIX#_yAHwxWXHQ*UG!z<@$Q|P??{0}6S~{k7_`;g$
zpIY6WU75Kkt2$dX%Y}kmqNmu4949Ax<E#Cj4r7zArQ-yWHmF2TOqtW<{S;&8{+rTL
zj1$5|2X<6fHsefE&huch(~xIaYXMOM6%Y5fhPMp0bk)^=M<8v=<o;TW9txcbkn(@L
z5xX{NmfP`heo}cFT^-g!-s#rL#?%SAy$T`)ou3_Dc~?2Ax<|;!vvhYgbZ?}Hc{f#j
zi*1^>_`|qhp&os_Jf|%C<8z9371frH2WgJfm%3<T2*L3duNBe(%sY&qqyJf4wyQW<
zl?ors<EoWb3c5%K0=^orQAI)*a5Q&`o>G0WbP2;tc&{Z>@7Ahrch6?Sjm*#Yf}Mua
zvc8r^T_WfW3|Pnw4;2@rgriK^&RDuSojZo$cy7;Ik>ilFu@nWl`m<(o1KrrPcPScj
z6Y2Jn9i@6^^9;p*KRK|aMcVMq?ZFU^^315^#G%jIjY)1cMPf?taYYoR?Ymuy{c*c=
zAjU{<O#L1#cIQiu>you&#VNekV^Ul6ikHqOHxqsAyRu5vr~yul?u5bfkmj$*m2JZ7
zI@R4tQq-nLo^X+dxjqt!MA-%f7Ey$2`afuNrdHIBJ+<0adt-zR#Pn!Lr8-N96vHr*
z0;AU?6B0TfIV5Ki8WSJP{a~~e377%I*H4bo_Y=)L@@YAboaGZVey!6(T+HtPi(;z>
z|5>=eT)L<mLFH~BZ<Z7+zp8&p=ACFUOf@}W?rxw}@*RQ`!y8x>Xh?V}FPCJ-F#^p{
zy9*L!dw3TlASIZ<bqix`#-*(YPT+ca)HvCUO&na$FTkSC?cFT^dYjNU3j<`@4LX5a
Lf{gzf`pCZkbVf*8

literal 0
HcmV?d00001

diff --git a/resources/js/components/app-sidebar.tsx b/resources/js/components/app-sidebar.tsx
index 9dcd946a7..ae3d46c4b 100755
--- a/resources/js/components/app-sidebar.tsx
+++ b/resources/js/components/app-sidebar.tsx
@@ -74,11 +74,7 @@ export function AppSidebar() {
             icon: Settings,
         },
 
-        {
-            title: t('Currency'),
-            href: route('currencies.index'),
-            icon: DollarSign,
-        },
+
         {
             title: t('Referral Program'),
             href: route('referral.index'),
diff --git a/routes/web.php b/routes/web.php
index 4bae04af6..809ee2e68 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -136,7 +136,9 @@ use App\Http\Controllers\ChatGptController;
 use Illuminate\Support\Facades\Route;
 use Inertia\Inertia;
 
-Route::get('/', [LandingPageController::class, 'show'])->name('home');
+Route::get('/', function () {
+    return redirect()->route('login');
+})->name('home');
 
 // Public form submission routes