# Spatie Permission System Usage

## Overview
This system uses Spatie Laravel Permission package for role-based access control. The `/acc-transactions/toggle-has-bill` route is protected with the `transaction-toggle-bill` permission.

## Quick Setup

### 1. Run Migration and Seeder
```bash
php artisan migrate
php artisan db:seed --class=TransactionPermissionsSeeder
```

### 2. Assign Permission to User
```php
// Give specific permission to user
$user->givePermissionTo('transaction-toggle-bill');

// Or assign via role
$user->assignRole('admin'); // if admin role has the permission
```

### 3. Check Permission in Blade
```php
@can('transaction-toggle-bill')
    <button onclick="toggleBill({{ $transaction->id }})">Toggle Bill</button>
@endcan
```

### 4. Check Permission in Controller
```php
if (auth()->user()->can('transaction-toggle-bill')) {
    // User can toggle billing status
}
```

## Available Permissions

### Transaction Permissions
- `transaction-list` - View transaction list
- `transaction-create` - Create transactions
- `transaction-edit` - Edit transactions
- `transaction-delete` - Delete transactions
- `transaction-view` - View transaction details
- `transaction-approve` - Approve transactions
- `transaction-toggle-bill` - Toggle billing status
- `transaction-export` - Export transactions
- `transaction-report` - Generate reports

### Action Type Permissions
- `action-type-list` - View action types
- `action-type-create` - Create action types
- `action-type-edit` - Edit action types
- `action-type-delete` - Delete action types

## Route Protection

The route is protected with:
```php
Route::post('/toggle-has-bill', [AccTransactionController::class, 'toggleHasBill'])
    ->middleware('permission:transaction-toggle-bill')
    ->name('acc-transactions.toggleHasBill');
```

## Testing

### Test Permission Assignment
```php
// In tinker
$user = User::find(1);
$user->givePermissionTo('transaction-toggle-bill');
$user->can('transaction-toggle-bill'); // Should return true
```

### Test API Call
```bash
curl -X POST /acc-transactions/toggle-has-bill \
  -H "Content-Type: application/json" \
  -d '{"transaction_id": 1, "has_bills": true}'
```

## Common Commands

```bash
# Clear permission cache
php artisan permission:cache-reset

# Check user permissions
php artisan tinker
>>> User::find(1)->getAllPermissions();

# Assign permission to role
php artisan tinker
>>> Role::find(1)->givePermissionTo('transaction-toggle-bill');
```