L-Ami-Fiduciaire/app/Http/Requests/UpdatePermissionsRequest.php

<?php

namespace App\Http\Requests;

use App\Enums\Permission;
use App\Enums\WorkspaceUserRole;
use Illuminate\Foundation\Http\FormRequest;

class UpdatePermissionsRequest extends FormRequest
{
    /**
     * Determine if the user is authorized to make this request.
     * Only Owners can update permissions — Managers with can_manage_team CANNOT.
     */
    public function authorize(): bool
    {
        $workspaceUser = $this->user()->currentWorkspaceUser();

        return $workspaceUser->role->is(WorkspaceUserRole::Owner);
    }

    /**
     * Get the validation rules that apply to the request.
     *
     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
     */
    public function rules(): array
    {
        return [
            'permissions' => ['required', 'array'],
            'permissions.*' => ['boolean'],
        ];
    }

    /**
     * Configure the validator instance.
     */
    public function withValidator(\Illuminate\Validation\Validator $validator): void
    {
        $validator->after(function (\Illuminate\Validation\Validator $validator) {
            $permissions = $this->input('permissions', []);
            $validKeys = Permission::getValues();

            foreach (array_keys($permissions) as $key) {
                if (! in_array($key, $validKeys, true)) {
                    $validator->errors()->add(
                        'permissions',
                        "Invalid permission key: {$key}"
                    );
                }
            }

            // Ensure ALL permission keys are present to prevent silent permission loss
            $missingKeys = array_diff($validKeys, array_keys($permissions));
            if (! empty($missingKeys)) {
                $validator->errors()->add(
                    'permissions',
                    'Missing permission keys: '.implode(', ', $missingKeys)
                );
            }
        });
    }

    /**
     * Handle a failed authorization attempt.
     */
    protected function failedAuthorization(): void
    {
        abort(404);
    }
}