# Roles and Permissions

Venue Events Manager uses custom role-based access control (RBAC). Permissions are assigned to roles; users receive permissions through their roles.

## Permission Naming

Format: `{resource}.{action}`

Examples: `bookings.confirm`, `invoices.void`, `attachments.manage`

## Default Roles

| Role | Slug | Purpose |
|------|------|---------|
| System Administrator | `system-administrator` | Full access including users, roles, settings |
| Events and Sales Officer | `events-sales-officer` | Customers, bookings, quotes, products, packages |
| Reservations Officer | `reservations-officer` | Spaces, availability, booking reservations |
| Finance Officer | `finance-officer` | Invoices, payments, reports |
| Operations User | `operations-user` | Day-to-day spaces and bookings (limited) |
| Management User | `management-user` | Read-only oversight and reports |

## Permission Matrix

### Dashboard

| Permission | Admin | Sales | Reservations | Finance | Operations | Management |
|------------|:-----:|:-----:|:------------:|:-------:|:----------:|:----------:|
| dashboard.view | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |

### Customers

| Permission | Admin | Sales | Reservations | Finance | Operations | Management |
|------------|:-----:|:-----:|:------------:|:-------:|:----------:|:----------:|
| customers.view | ✓ | ✓ | ✓ | ✓ | | ✓ |
| customers.create | ✓ | ✓ | | | | |
| customers.update | ✓ | ✓ | | | | |
| customers.archive | ✓ | ✓ | | | | |

### Spaces

| Permission | Admin | Sales | Reservations | Finance | Operations | Management |
|------------|:-----:|:-----:|:------------:|:-------:|:----------:|:----------:|
| spaces.view | ✓ | ✓ | ✓ | | ✓ | ✓ |
| spaces.create | ✓ | | ✓ | | | |
| spaces.update | ✓ | | ✓ | | | |
| spaces.archive | ✓ | | | | | |
| spaces.block | ✓ | | ✓ | | | |

### Bookings

| Permission | Admin | Sales | Reservations | Finance | Operations | Management |
|------------|:-----:|:-----:|:------------:|:-------:|:----------:|:----------:|
| bookings.view | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| bookings.create | ✓ | ✓ | ✓ | | | |
| bookings.update | ✓ | ✓ | ✓ | | ✓ | |
| bookings.confirm | ✓ | ✓ | ✓ | | | |
| bookings.cancel | ✓ | ✓ | ✓ | | | |
| bookings.override_conflict | ✓ | | | | | |

### Quotations

| Permission | Admin | Sales | Reservations | Finance | Operations | Management |
|------------|:-----:|:-----:|:------------:|:-------:|:----------:|:----------:|
| quotations.view | ✓ | ✓ | | ✓ | | ✓ |
| quotations.create | ✓ | ✓ | | | | |
| quotations.update | ✓ | ✓ | | | | |
| quotations.issue | ✓ | ✓ | | | | |
| quotations.accept | ✓ | ✓ | | | | |
| quotations.convert | ✓ | ✓ | | | | |

### Invoices

| Permission | Admin | Sales | Reservations | Finance | Operations | Management |
|------------|:-----:|:-----:|:------------:|:-------:|:----------:|:----------:|
| invoices.view | ✓ | | | ✓ | | ✓ |
| invoices.create | ✓ | | | ✓ | | |
| invoices.update | ✓ | | | ✓ | | |
| invoices.issue | ✓ | | | ✓ | | |
| invoices.void | ✓ | | | ✓ | | |

### Payments

| Permission | Admin | Sales | Reservations | Finance | Operations | Management |
|------------|:-----:|:-----:|:------------:|:-------:|:----------:|:----------:|
| payments.view | ✓ | | | ✓ | | ✓ |
| payments.create | ✓ | | | ✓ | | |
| payments.reverse | ✓ | | | ✓ | | |

### Products & Packages

| Permission | Admin | Sales | Reservations | Finance | Operations | Management |
|------------|:-----:|:-----:|:------------:|:-------:|:----------:|:----------:|
| products.view | ✓ | ✓ | | | | ✓ |
| products.create | ✓ | ✓ | | | | |
| products.update | ✓ | ✓ | | | | |
| products.archive | ✓ | ✓ | | | | |
| packages.view | ✓ | ✓ | | | | ✓ |
| packages.create | ✓ | ✓ | | | | |
| packages.update | ✓ | ✓ | | | | |
| packages.archive | ✓ | ✓ | | | | |

### Reports & Administration

| Permission | Admin | Sales | Reservations | Finance | Operations | Management |
|------------|:-----:|:-----:|:------------:|:-------:|:----------:|:----------:|
| reports.view | ✓ | | | ✓ | | ✓ |
| reports.export | ✓ | | | ✓ | | ✓ |
| users.manage | ✓ | | | | | |
| roles.manage | ✓ | | | | | |
| settings.manage | ✓ | | | | | |
| audit.view | ✓ | | | | | ✓ |

### Attachments & Notifications

| Permission | Admin | Sales | Reservations | Finance | Operations | Management |
|------------|:-----:|:-----:|:------------:|:-------:|:----------:|:----------:|
| attachments.manage | ✓ | ✓ | ✓ | ✓ | | |
| notifications.view | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |

## Attachments Access

- **Upload / delete:** requires `attachments.manage`
- **Download:** requires view permission on the related record (e.g. `bookings.view` for booking attachments) OR `attachments.manage`

## Managing Roles

Administrators with `roles.manage` can edit role permissions in **Admin → Roles**.

Users with `users.manage` assign roles in **Admin → Users**.

## Implementation Notes

- Route middleware: `permission:slug`
- Controller authorization: Laravel policies calling `User::hasPermission()`
- Blade: `@can('action', $model)` directives

Seed source: `database/seeders/RolesAndPermissionsSeeder.php`
