From 3860c5d24cbe9cf6be08e90a8cfd72b40e5e2050 Mon Sep 17 00:00:00 2001
From: F4ilji <F4ilj@yandex.ru>
Date: Thu, 16 Jul 2026 14:09:30 +0500
Subject: [PATCH] =?UTF-8?q?fix(permissions):=20remove=20direct=20user=20pe?=
 =?UTF-8?q?rmission=20sync=20=E2=80=94=20roles=20only?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

UpdateUserAction and CreateUserAction were calling syncPermissions()
which wrote to model_has_permissions table directly. This meant
permissions persisted even after being removed from the role.

Now users only get permissions through their roles.
---
 .../Dashboard/Actions/Users/CreateUserAction.php          | 5 -----
 .../Dashboard/Actions/Users/UpdateUserAction.php          | 8 +-------
 2 files changed, 1 insertion(+), 12 deletions(-)

diff --git a/app/Containers/Dashboard/Actions/Users/CreateUserAction.php b/app/Containers/Dashboard/Actions/Users/CreateUserAction.php
index db99863..739b474 100644
--- a/app/Containers/Dashboard/Actions/Users/CreateUserAction.php
+++ b/app/Containers/Dashboard/Actions/Users/CreateUserAction.php
@@ -19,11 +19,6 @@ class CreateUserAction
             $user->syncRoles($data['roles']);
         }
 
-        // Назначение разрешений если переданы
-        if (isset($data['permissions']) && is_array($data['permissions'])) {
-            $user->syncPermissions($data['permissions']);
-        }
-
         return $user->load(['roles', 'permissions']);
     }
 
diff --git a/app/Containers/Dashboard/Actions/Users/UpdateUserAction.php b/app/Containers/Dashboard/Actions/Users/UpdateUserAction.php
index faf6ed8..61bc18e 100644
--- a/app/Containers/Dashboard/Actions/Users/UpdateUserAction.php
+++ b/app/Containers/Dashboard/Actions/Users/UpdateUserAction.php
@@ -19,9 +19,8 @@ class UpdateUserAction
             unset($data['password']);
         }
 
-        // Извлекаем роли и пермисшены — они не в $fillable и не колонки таблицы
+        // Извлекаем роли — они не в $fillable и не колонки таблицы
         $roles = $data['roles'] ?? null;
-        $permissions = $data['permissions'] ?? null;
         unset($data['roles'], $data['permissions']);
 
         $user->update($data);
@@ -31,11 +30,6 @@ class UpdateUserAction
             $user->syncRoles($roles);
         }
 
-        // Синхронизация разрешений
-        if ($permissions !== null && is_array($permissions)) {
-            $user->syncPermissions($permissions);
-        }
-
         return $user->fresh(['roles', 'permissions']);
     }