presseportale/database/seeders/RolesAndPermissionsSeeder.php

<?php

namespace Database\Seeders;

use App\Authorization\Permission as PermissionCatalog;
use Illuminate\Database\Seeder;
use Spatie\Permission\Models\Permission;
use Spatie\Permission\Models\Role;

class RolesAndPermissionsSeeder extends Seeder
{
    /**
     * Seed the application's database.
     */
    public function run(): void
    {
        $roles = [
            'admin',
            'editor',
            'customer',
            'api-only',
        ];

        foreach ($roles as $role) {
            Role::firstOrCreate(['name' => $role]);
        }

        // Kanonischer Permission-Katalog inkl. Rollen-Zuordnung: siehe
        // App\Authorization\Permission. Schreibende CRM-/Verwaltungsrechte gehen
        // nur an `admin` (Befund H2); der `editor` behält reine Content-Rechte.
        $permissions = PermissionCatalog::all();

        foreach ($permissions as $permission) {
            Permission::firstOrCreate(['name' => $permission]);
        }

        Role::findByName('admin')->syncPermissions($permissions);
        Role::findByName('editor')->syncPermissions(PermissionCatalog::editor());
        Role::findByName('customer')->syncPermissions(PermissionCatalog::customer());
        Role::findByName('api-only')->syncPermissions(PermissionCatalog::apiOnly());
    }
}