TenantAtlas/app/Services/Auth/WorkspaceRoleCapabilityMap.php

<?php

namespace App\Services\Auth;

use App\Support\Auth\Capabilities;
use App\Support\Auth\WorkspaceRole;

/**
 * Workspace Role to Capability Mapping (Single Source of Truth)
 *
 * This class defines which capabilities each workspace role has.
 * All capability strings MUST be references from the Capabilities registry.
 */
class WorkspaceRoleCapabilityMap
{
    /**
     * @var array<string, array<int, string>>
     */
    private static array $roleCapabilities = [
        WorkspaceRole::Owner->value => [
            Capabilities::WORKSPACE_VIEW,
            Capabilities::WORKSPACE_MANAGE,
            Capabilities::WORKSPACE_ARCHIVE,
            Capabilities::WORKSPACE_MEMBERSHIP_VIEW,
            Capabilities::WORKSPACE_MEMBERSHIP_MANAGE,
            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD,
        ],

        WorkspaceRole::Manager->value => [
            Capabilities::WORKSPACE_VIEW,
            Capabilities::WORKSPACE_MEMBERSHIP_VIEW,
            Capabilities::WORKSPACE_MEMBERSHIP_MANAGE,
            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD,
        ],

        WorkspaceRole::Operator->value => [
            Capabilities::WORKSPACE_VIEW,
            Capabilities::WORKSPACE_MEMBERSHIP_VIEW,
        ],

        WorkspaceRole::Readonly->value => [
            Capabilities::WORKSPACE_VIEW,
        ],
    ];

    /**
     * @return array<string>
     */
    public static function getCapabilities(WorkspaceRole|string $role): array
    {
        $roleValue = $role instanceof WorkspaceRole ? $role->value : $role;

        return self::$roleCapabilities[$roleValue] ?? [];
    }

    /**
     * @return array<string>
     */
    public static function rolesWithCapability(string $capability): array
    {
        $roles = [];

        foreach (self::$roleCapabilities as $role => $capabilities) {
            if (in_array($capability, $capabilities, true)) {
                $roles[] = $role;
            }
        }

        return $roles;
    }

    public static function hasCapability(WorkspaceRole|string $role, string $capability): bool
    {
        return in_array($capability, self::getCapabilities($role), true);
    }
}