sls/database/seeders/DatabaseSeeder.php

<?php

namespace Database\Seeders;

use App\Models\User;
use App\Models\App;
use App\Models\Role;
use App\Models\UserAppOverride;
use Illuminate\Database\Console\Seeds\WithoutModelEvents;
use Illuminate\Database\Seeder;
use Illuminate\Support\Facades\Hash;

class DatabaseSeeder extends Seeder
{
    use WithoutModelEvents;

    /**
     * Seed the application's database.
     */
    public function run(): void
    {
        // 1. Seed default administrator
        $admin = User::updateOrCreate(
            ['email' => 'admin@company.com'],
            [
                'name' => 'System Administrator',
                'password' => Hash::make('Admin@123'),
                'role' => 'admin',
            ]
        );

        // 2. Seed default apps
        $outlook = App::updateOrCreate(
            ['name' => 'Outlook'],
            [
                'url' => 'https://outlook.office.com/mail/',
                'icon_svg' => 'outlook',
                'color' => '#0078d4',
                'desc' => 'Access your corporate mail, calendar, and contacts instantly.',
                'tag' => 'Microsoft 365'
            ]
        );

        $teams = App::updateOrCreate(
            ['name' => 'Microsoft Teams'],
            [
                'url' => 'https://teams.microsoft.com/v2/',
                'icon_svg' => 'teams',
                'color' => '#6264a7',
                'desc' => 'Chat, meet, call, and collaborate with your team.',
                'tag' => 'Microsoft 365'
            ]
        );

        $keka = App::updateOrCreate(
            ['name' => 'Keka HR'],
            [
                'url' => 'https://sentientgeeks.keka.com/',
                'icon_svg' => 'keka',
                'color' => '#f27059',
                'desc' => 'Manage timesheets, leaves, payroll, and performance tasks.',
                'tag' => 'HR Portal'
            ]
        );

        // 3. Seed default roles
        $pmRole = Role::updateOrCreate(
            ['name' => 'Project Manager'],
            ['description' => 'Oversees projects, budgets, and milestones.']
        );

        $leadRole = Role::updateOrCreate(
            ['name' => 'Team Lead'],
            ['description' => 'Manages dev teams and assigns work items.']
        );

        $salesRole = Role::updateOrCreate(
            ['name' => 'Sales Team'],
            ['description' => 'Drives client acquisition and manages CRM leads.']
        );

        $devRole = Role::updateOrCreate(
            ['name' => 'Developer'],
            ['description' => 'Writes code and builds features.']
        );

        $internRole = Role::updateOrCreate(
            ['name' => 'Intern'],
            ['description' => 'Learning and assisting on project modules.']
        );

        $hrRole = Role::updateOrCreate(
            ['name' => 'HR Manager'],
            ['description' => 'Handles recruitment, payroll, and employee relations.']
        );

        // 4. Assign apps/services to specific roles
        // HR has access to Outlook, Teams, and Keka
        $hrRole->apps()->sync([$outlook->id, $teams->id, $keka->id]);

        // Developers have access to Outlook and Teams
        $devRole->apps()->sync([$outlook->id, $teams->id]);

        // Team Leads have access to Outlook and Teams
        $leadRole->apps()->sync([$outlook->id, $teams->id]);

        // Project Managers have access to Outlook and Teams
        $pmRole->apps()->sync([$outlook->id, $teams->id]);

        // Sales Team has access to Teams
        $salesRole->apps()->sync([$teams->id]);

        // Interns have access to Teams (no Outlook, no Keka)
        $internRole->apps()->sync([$teams->id]);

        // 5. Seed default standard users and assign roles
        // John Doe (Developer & Team Lead) - Test multiple roles
        $user1 = User::updateOrCreate(
            ['email' => 'user@company.com'],
            [
                'name' => 'John Doe User',
                'role' => 'user',
                'microsoft_id' => 'mock-microsoft-id-123',
            ]
        );
        $user1->roles()->sync([$devRole->id, $leadRole->id]);

        // Jane Smith (HR Manager)
        $user2 = User::updateOrCreate(
            ['email' => 'hr@company.com'],
            [
                'name' => 'Jane Smith HR',
                'role' => 'user',
                'microsoft_id' => 'mock-microsoft-id-456',
            ]
        );
        $user2->roles()->sync([$hrRole->id]);

        // 6. Seed user-specific overrides for testing
        // John Doe (Developer & Team Lead - has Outlook and Teams via roles)
        // Scenario A: Revoke Outlook for John Doe (even though Developer role grants it)
        UserAppOverride::updateOrCreate(
            ['user_id' => $user1->id, 'app_id' => $outlook->id],
            ['type' => 'deny']
        );

        // Scenario B: Add Keka HR as an extra service for John Doe (irrespective of Developer role)
        UserAppOverride::updateOrCreate(
            ['user_id' => $user1->id, 'app_id' => $keka->id],
            ['type' => 'allow']
        );
    }
}