presseportale/app/Authorization/Permission.php

<?php

namespace App\Authorization;

use App\Services\Admin\AdminSystemHealth;

/**
 * Zentraler Katalog der Spatie-Permissions. Einzige Quelle für die
 * Permission-Namen und die Rollen-Zuordnung — genutzt vom
 * RolesAndPermissionsSeeder und von der Betriebsüberwachung
 * ({@see AdminSystemHealth}). Blade-/Route-Gates verwenden
 * weiterhin die String-Literale (Laravel-idiomatisch), deren kanonische
 * Definition aber hier liegt.
 */
final class Permission
{
    public const PressReleasesRead = 'press-releases:read';

    public const PressReleasesWrite = 'press-releases:write';

    public const PressReleasesPublish = 'press-releases:publish';

    public const PressReleaseImagesWrite = 'press-release-images:write';

    public const CompaniesRead = 'companies:read';

    public const CompaniesWrite = 'companies:write';

    public const CategoriesManage = 'categories:manage';

    public const FooterCodesManage = 'footer-codes:manage';

    public const BillingManage = 'billing:manage';

    public const ComplianceManage = 'compliance:manage';

    public const SettingsManage = 'settings:manage';

    public const NewsletterSubscribe = 'newsletter:subscribe';

    public const UsersManage = 'users:manage';

    public const RolesManage = 'roles:manage';

    public const ApiImmediatePublication = 'api:immediate-publication';

    /**
     * Alle existierenden Permissions.
     *
     * @return list<string>
     */
    public static function all(): array
    {
        return [
            self::PressReleasesRead,
            self::PressReleasesWrite,
            self::PressReleasesPublish,
            self::PressReleaseImagesWrite,
            self::CompaniesRead,
            self::CompaniesWrite,
            self::CategoriesManage,
            self::FooterCodesManage,
            self::BillingManage,
            self::ComplianceManage,
            self::SettingsManage,
            self::NewsletterSubscribe,
            self::UsersManage,
            self::RolesManage,
            self::ApiImmediatePublication,
        ];
    }

    /**
     * Nur an `admin` vergebene Verwaltungsrechte (Befund H2). Basis für den
     * Deployment-Check „Berechtigungen ausgerollt".
     *
     * @return list<string>
     */
    public static function adminOnly(): array
    {
        return [
            self::CompaniesWrite,
            self::CategoriesManage,
            self::FooterCodesManage,
            self::BillingManage,
            self::ComplianceManage,
            self::SettingsManage,
            self::UsersManage,
            self::RolesManage,
        ];
    }

    /**
     * Permissions der Rolle `editor` (Content-Rolle ohne destruktive/Verwaltung).
     *
     * @return list<string>
     */
    public static function editor(): array
    {
        return [
            self::PressReleasesRead,
            self::PressReleasesWrite,
            self::PressReleasesPublish,
            self::PressReleaseImagesWrite,
            self::CompaniesRead,
            self::NewsletterSubscribe,
        ];
    }

    /**
     * Permissions der Rolle `customer`.
     *
     * @return list<string>
     */
    public static function customer(): array
    {
        return [
            self::PressReleasesRead,
            self::PressReleasesWrite,
            self::PressReleaseImagesWrite,
            self::CompaniesRead,
            self::NewsletterSubscribe,
        ];
    }

    /**
     * Permissions der Rolle `api-only`.
     *
     * @return list<string>
     */
    public static function apiOnly(): array
    {
        return [
            self::PressReleasesRead,
            self::PressReleasesWrite,
            self::PressReleaseImagesWrite,
            self::CompaniesRead,
            self::NewsletterSubscribe,
        ];
    }
}