# Admin RBAC Quick Reference

## Login Credentials

| Email | Role | Password | Level |
|-------|------|----------|-------|
| admin@cura.test | Super Admin | Admin@123456 | 5 |
| operations@cura.test | Operations Admin | Admin@123456 | 4 |
| finance@cura.test | Finance Admin | Admin@123456 | 3 |
| employer@cura.test | Employer Manager | Admin@123456 | 2 |
| moderator@cura.test | Moderator | Admin@123456 | 1 |

**Admin Panel URL:** http://127.0.0.1:8000/admin/login

---

## Role Access Matrix

```
                    | Super | Ops | Finance | Employer | Moderator
────────────────────┼───────┼─────┼─────────┼──────────┼───────────
Manage Admins       |   ✅   |  ❌  |   ❌    |    ❌    |    ❌
System Settings     |   ✅   |  ✅  |   ❌    |    ❌    |    ❌
Nurses              |   ✅   |  ✅  |   ❌    |    ❌    |    ❌
Employers           |   ✅   |  ✅  |   ❌    |    ✅    |    ❌
Jobs                |   ✅   |  ✅  |   ❌    |    ✅    |    ❌
Bookings            |   ✅   |  ✅  |   ❌    |    ❌    |    ❌
Moderation          |   ✅   |  ✅  |   ❌    |    ❌    |    ✅
Reports             |   ✅   |  ✅  |   ✅    |    ❌    |    ✅
Financial           |   ✅   |  ✅  |   ✅    |    ❌    |    ❌
```

---

## Code Usage Patterns

### Check Permission (Controller)
```php
use App\Traits\AdminAuthorization;

class YourController extends Controller {
    use AdminAuthorization;
    
    public function delete() {
        $this->authorizePermission('delete_admin');
    }
}
```

### Protect Route
```php
Route::delete('/admins/{id}', 'AdminController@delete')
    ->middleware('admin.permission:delete_admin');

Route::post('/nurses', 'NurseController@store')
    ->middleware('admin.role:super_admin,operations_admin');
```

### Check in Blade
```blade
@if(admin_permission('manage_nurses'))
    <button>Manage Nurses</button>
@endif

@if(admin_module_access('finances'))
    <a href="/admin/finances">Financial Module</a>
@endif
```

### Direct Check
```php
auth('admin')->user()->hasPermission('manage_nurses');
auth('admin')->user()->hasModuleAccess('moderation');
auth('admin')->user()->canManage('employers');
```

---

## Available Helper Functions

```php
admin_permission('permission_name')        // Check if has permission
admin_role()                               // Get current role
admin_roles(['role1', 'role2'])           // Check if has role
admin_can('resource')                      // Can manage resource
admin_module_access('module')              // Has module access
all_admin_roles()                          // Get all roles config
role_permissions('super_admin')            // Get role permissions
role_config('super_admin')                 // Get role config
```

---

## Permission Categories

**Admin (5):** manage, create, edit, delete, view_logs
**System (4):** manage_settings, view_settings, manage_db, manage_backups
**Nurses (8):** manage, create, edit, delete, view, verify, approve, suspend
**Employers (8):** manage, create, edit, delete, view, approve, suspend
**Jobs (8):** manage, create, edit, delete, view, approve, suspend
**Bookings (4):** manage, view, approve, reject
**Moderation (4):** moderate, flag, remove, ban
**Reports (6):** view, analytics, export, financial, transactions
**Communication (2):** notifications, email_templates
**Dashboard (1):** view_dashboard

**Total: 49 permissions**

---

## CLI Commands

```bash
# Show all roles and permissions
php artisan admin:show-roles

# Create new admin account
php artisan admin:create

# Cache config
php artisan config:cache

# Clear config cache
php artisan config:clear
```

---

## Testing

```bash
# Test permission system
php test_permissions.php

# Test config
php test_config.php

# Test admin login
php test_admin_login.php
```

---

## Key Files

- **Config:** `config/admin_permissions.php`
- **Service:** `app/Services/AdminPermissionService.php`
- **Middleware:** `app/Http/Middleware/CheckAdminPermission.php`, `CheckAdminRole.php`
- **Trait:** `app/Traits/AdminAuthorization.php`
- **Helpers:** `app/Helpers/AdminPermissionHelpers.php`
- **Documentation:** `ADMIN_RBAC_IMPLEMENTATION.md`, `ADMIN_ROLES_DOCUMENTATION.md`

---

## Role Descriptions

**Super Admin:** Full system control, manage all admins
**Operations Admin:** Run platform operations, approve submissions
**Finance Admin:** Handle transactions and financial reports
**Employer Manager:** Manage employer accounts and jobs
**Moderator:** Monitor and moderate user content

---

## Troubleshooting

### Permissions not working?
1. Run `php artisan config:cache`
2. Clear browser cache
3. Verify admin role in database

### 403 Forbidden error?
1. Check if admin has permission
2. Verify middleware is applied
3. Check role hierarchy

### Config not loading?
1. Run `php artisan config:cache`
2. Check `config/admin_permissions.php` syntax
3. Verify file is in correct directory

---

## Performance Notes

- Config is cached after running `php artisan config:cache`
- Permissions checked from config (fast lookup)
- No database queries for permission checks
- Role hierarchy pre-defined in config

---

## Security Reminders

✅ Always check permissions server-side
✅ Use middleware to protect routes
✅ Don't trust client-side permission checks
✅ Log admin activities
✅ Review permissions regularly
✅ Use strong passwords for admin accounts
✅ Enable two-factor authentication (when implemented)