# m7 — login crash fixed + permission checks on views

## 1. The login crash (all non-super roles)
Root cause: the `role` string column shadows the `role()` relationship, so
`$this->role` returns a string (e.g. "aftercare_officer"). `$this->role->permissions()`
was therefore calling a method on a string → "permissions() on string". super_admin
never hit it because `isSuperAdmin()` returns early.

Fix (app/Models/User.php): added `roleModel()` (resolves the Role via `role_id`, cached)
and `roleName()`. Every spot that used `$this->role->...` now uses these:
- `permissionNames()` and `getPermissions()` → `roleModel()->permissions()`
- `hasAnyRole()` / `hasAllRoles()` → `roleName()`
- `@role` Blade directive (AppServiceProvider) and `RoleMiddleware` → `roleName()`
Verified: 0 remaining `->role->permissions` / `->role->name` in app or views.

## 2. Permission checks on the other views
Action buttons are now gated with `@can('<module>.<action>')`, derived from each
button's own route and only applied when that module+action exists in the catalogue
(so no false denials):
- Add/New (→ `.add`), Edit (→ `.edit`), Print/Export/Report (→ `.print`),
  and module action buttons — biometric/forward/notify/discharge/verify (→ `.action`),
  decision (→ `.approve`).
~114 buttons across 80+ prison & probation views, plus the already-gated sidebar &
dashboard. 160 `@can` directives total. All `@can/@endcan` verified balanced.

3 form-heavy pages (admission/edit, discharges/create, discharges/edit) were left
untouched — they have a pre-existing unbalanced `{{ }}` count from inline JS, so they
were skipped rather than risk a bad edit. Gate those buttons by hand if needed.

## 3. Hard URL enforcement (optional, ready)
A `permission` middleware already exists (`->middleware('permission:prison.borstal.edit')`)
and now resolves through the fixed `hasPermission()`. It isn't bulk-applied to routes
(untested), but you can add it to any route/group for hard 403s on direct URLs.

## Run
```bash
php artisan config:clear && php artisan view:clear && php artisan cache:clear
```