Users & access

Access model: every operational record belongs to one factory/entity. A user sees only the factories ticked below — the factory switcher in the top bar lists only those. Users with a single factory get no switcher at all. Roles cap what they can do within a factory.

users

User	Role	NVMSB Sales (NaVi)	CTSB Factory (CT1)	CTWSB Factory (CTW · PIC/S)	CTCNGZ Factory (Guangzhou)	Modules	Status	Last active

Project Gaia — static mockup in Filament v3 idiom. No backend. Sample users are illustrative; factory columns are the real entities.

Users & access

Invite user

Not saved

Full name

The invite link goes here.

Role

Role caps what the user can do within a factory (spatie/laravel-permission); modules derive from role.

Factory access

NVMSB — Sales (NaVi) CTSB — Factory (CT1) CTWSB — Factory (CTW · PIC/S) CTCNGZ — Factory (Guangzhou)

User sees only ticked factories in the switcher; a single factory ⇒ no switcher at all (Filament tenant menu).

Will get: Make (tasks) · Stock (read) at CTSB — operator dashboard on login.

Personal message (optional)

Users & access — field manifest

Field	Filament component	Type	Source	FK target
User	TextColumn::description(email)	string + email	stored: users.name / users.email	—
Role	TextColumn badge + SelectFilter	enum	stored: model_has_roles (spatie/laravel-permission)	roles.id
Factory access ×4	IconColumn::boolean() per tenant	bool per factory	stored: user_factories pivot (user_id, factory_id)	factories.id
Modules	TextColumn (derived from role permissions)	string list	derived: role → permission set	permissions
Status	TextColumn badge; Action toggle enable/disable	enum Active/Disabled	stored: users.disabled_at	—
Last active	TextColumn::since()	datetime	stored: users.last_active_at	—
Invite	Filament Action modal	action	stored: users (name, email, invited_at, signed invite URL mailed), model_has_roles row, user_factories pivot rows per ticked factory; status Invited until first login sets password (Fortify)	roles.id · factories.id

Engine / architecture notes

Tenancy = factory/entity. Filament Panels multi-tenancy with tenant: Factory. Every operational table (items are global; stock, MOs, SOs, POs, batches, shipments are not) carries factory_id with a global scope bound to the active tenant.
Factory switcher = Filament's tenant menu. It lists only auth()->user()->factories; one factory ⇒ menu hidden, user is pinned.
Items/variants and suppliers are shared masters (global), but stock levels, costs and documents are per-factory — matches Katana's per-location ledger, elevated to per-entity.
NVMSB users creating SOs in factory tenants (current NaVi practice) = grant NVMSB sales role access to the factory tenant with a Sales role — visible on Kevin's row.
QA release role at CTWSB maps to the PIC/S paper flow: software shows batches read-only; wet-ink release stays on paper (current direction).
Roles via spatie/laravel-permission; Filament Shield or manual policies gate Resources per role.