Permisos

public function roles()
{
    return $this->belongsToMany(
        Rol::class,
        'role_permission',
        'permission_id',
        'rol_id'
    );
}

public function handle(Request $request, Closure $next, string $permission): Response
{
    $user = $request->user();

    // Si no hay usuario autenticado, denegar acceso
    if (!$user) {
        return response()->json([
            'success' => false,
            'message' => 'No autenticado'
        ], 401);
    }

    // Admin (rol_id = 1) tiene acceso a todo
    if ($user->rol_id == 1) {
        return $next($request);
    }

    // Verificar si el usuario tiene el permiso
    if (!$user->hasPermission($permission)) {
        return response()->json([
            'success' => false,
            'message' => 'No tienes permiso para realizar esta acción'
        ], 403);
    }

    return $next($request);
}

Route::middleware(['auth:sanctum', 'permission:ventas.create'])
    ->post('/ventas', [VentasController::class, 'store']);

// Forma abreviada
Route::post('/ventas', [VentasController::class, 'store'])
    ->middleware('permission:ventas.create');

$rol = Rol::find(2);
$permission = Permission::where('name', 'ventas.create')->first();

$rol->permissions()->attach($permission->permission_id);

$rol = Rol::find(2);
$permissionIds = Permission::whereIn('name', [
    'ventas.view',
    'ventas.create',
    'productos.view'
])->pluck('permission_id')->toArray();

$rol->permissions()->sync($permissionIds);

$rol = Rol::find(2);
$permission = Permission::where('name', 'ventas.delete')->first();

$rol->permissions()->detach($permission->permission_id);

$rol = Rol::find(2);

if ($rol->hasPermission('ventas.create')) {
    echo "El rol puede crear ventas";
}

$rol = Rol::with('permissions')->find(2);

foreach ($rol->permissions as $permission) {
    echo $permission->display_name . "\n";
}

$permission = Permission::with('roles')
    ->where('name', 'ventas.create')
    ->first();

foreach ($permission->roles as $rol) {
    echo $rol->nombre . "\n";
}

private function insertDefaultPermissions()
{
    $modules = [
        'ventas' => 'Ventas',
        'productos' => 'Productos',
        'clientes' => 'Clientes',
        'proveedores' => 'Proveedores',
        'compras' => 'Compras',
        'cotizaciones' => 'Cotizaciones',
        'empresas' => 'Empresas',
        'usuarios' => 'Usuarios',
        'reportes' => 'Reportes',
    ];

    $actions = [
        'view' => 'Ver',
        'create' => 'Crear',
        'edit' => 'Editar',
        'delete' => 'Eliminar',
    ];

    $permissions = [];
    $now = now();

    foreach ($modules as $moduleKey => $moduleName) {
        foreach ($actions as $actionKey => $actionName) {
            $permissions[] = [
                'name' => "{$moduleKey}.{$actionKey}",
                'display_name' => "{$actionName} {$moduleName}",
                'module' => $moduleKey,
                'action' => $actionKey,
                'description' => "Permiso para {$actionName} en el módulo de {$moduleName}",
                'created_at' => $now,
                'updated_at' => $now,
            ];
        }
    }

    DB::table('permissions')->insert($permissions);
}

use App\Models\Permission;

$module = 'inventario';
$moduleName = 'Inventario';
$actions = [
    'view' => 'Ver',
    'create' => 'Crear',
    'edit' => 'Editar',
    'delete' => 'Eliminar',
];

foreach ($actions as $actionKey => $actionName) {
    Permission::create([
        'name' => "{$module}.{$actionKey}",
        'display_name' => "{$actionName} {$moduleName}",
        'module' => $module,
        'action' => $actionKey,
        'description' => "Permiso para {$actionName} en el módulo de {$moduleName}",
    ]);
}

const response = await fetch('/api/auth/login', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ user: 'admin', password: 'secret' })
});

const data = await response.json();
const permissions = data.permissions; // ['ventas.view', 'ventas.create', ...]

// Guardar en localStorage o estado global
localStorage.setItem('permissions', JSON.stringify(permissions));

// Hook personalizado
function usePermission(permission) {
  const permissions = JSON.parse(localStorage.getItem('permissions') || '[]');
  return permissions.includes(permission);
}

// En un componente
function VentasPage() {
  const canCreate = usePermission('ventas.create');
  const canDelete = usePermission('ventas.delete');

  return (
    <div>
      {canCreate && <button>Crear Venta</button>}
      {canDelete && <button>Eliminar</button>}
    </div>
  );
}

// stores/authStore.js
import { create } from 'zustand';

const useAuthStore = create((set) => ({
  permissions: [],
  setPermissions: (permissions) => set({ permissions }),
  hasPermission: (permission) => {
    const state = useAuthStore.getState();
    return state.permissions.includes(permission);
  },
}));

export default useAuthStore;

public function store(Request $request)
{
    // El middleware ya verificó el permiso
    // pero puede hacer verificaciones adicionales
    
    if (!$request->user()->hasPermission('ventas.create')) {
        abort(403);
    }
    
    // Proceder con la creación
}

public function transferStock(Request $request)
{
    $user = $request->user();
    
    if (!$user->hasAllPermissions(['productos.view', 'productos.edit'])) {
        return response()->json([
            'success' => false,
            'message' => 'Necesitas permisos de ver y editar productos'
        ], 403);
    }
    
    // Proceder con la transferencia
}

public function viewFinancial(Request $request)
{
    $user = $request->user();
    
    if (!$user->hasAnyPermission(['reportes.view', 'ventas.view'])) {
        return response()->json([
            'success' => false,
            'message' => 'No tienes acceso a reportes financieros'
        ], 403);
    }
    
    // Mostrar reporte
}

if (!$user->hasPermission('clientes.delete')) {
    return response()->json([
        'success' => false,
        'message' => 'No tienes permiso para eliminar clientes. Contacta a tu administrador.'
    ], 403);
}

use Illuminate\Support\Facades\Log;

if (!$user->hasPermission($permission)) {
    Log::warning('Intento de acceso denegado', [
        'user_id' => $user->id,
        'permission' => $permission,
        'ip' => $request->ip(),
        'url' => $request->fullUrl()
    ]);
    
    abort(403);
}

if (!$user->hasPermission('ventas.edit')) {
    abort(403);
}

// Verificar que la venta pertenece a la empresa del usuario
$venta = Venta::where('id', $id)
    ->where('id_empresa', $user->id_empresa)
    ->firstOrFail();

$rol->permissions()->attach($permissionId, [
    'expires_at' => now()->addDays(7)
]);