TenantAtlas/app/Support/Auth/Capabilities.php

<?php

namespace App\Support\Auth;

/**
 * Canonical Capability Registry
 *
 * This is the single source of truth for all capability strings in the system.
 * All role-to-capability mappings must reference only these constants.
 */
class Capabilities
{
    // Tenants
    public const TENANT_VIEW = 'tenant.view';

    public const TENANT_MANAGE = 'tenant.manage';

    public const TENANT_DELETE = 'tenant.delete';

    public const TENANT_SYNC = 'tenant.sync';

    // Tenant memberships
    public const TENANT_MEMBERSHIP_VIEW = 'tenant_membership.view';

    public const TENANT_MEMBERSHIP_MANAGE = 'tenant_membership.manage';

    // Optional mappings (no Graph resolution in v1)
    public const TENANT_ROLE_MAPPING_VIEW = 'tenant_role_mapping.view';

    public const TENANT_ROLE_MAPPING_MANAGE = 'tenant_role_mapping.manage';

    // Providers (existing gate names used throughout the app)
    public const PROVIDER_VIEW = 'provider.view';

    public const PROVIDER_MANAGE = 'provider.manage';

    public const PROVIDER_RUN = 'provider.run';

    // Audit
    public const AUDIT_VIEW = 'audit.view';

    /**
     * Get all capability constants
     *
     * @return array<string>
     */
    public static function all(): array
    {
        $reflection = new \ReflectionClass(self::class);

        return array_values($reflection->getConstants());
    }
}