From b059d5a260b4d8a850229132a33d3a4d3c378658 Mon Sep 17 00:00:00 2001
From: Yoga Pangestu <ypangestu976@gmail.com>
Date: Sat, 2 May 2026 00:21:55 +0700
Subject: [PATCH] feat: restrict Developer role visibility and management in
 user modules

---
 .../Admin/Master/UserController.php           |  9 +++---
 tests/Feature/Admin/Master/UserTest.php       | 31 +++++++++++++++++--
 2 files changed, 32 insertions(+), 8 deletions(-)

diff --git a/app/Http/Controllers/Admin/Master/UserController.php b/app/Http/Controllers/Admin/Master/UserController.php
index 93db334..9961e8e 100644
--- a/app/Http/Controllers/Admin/Master/UserController.php
+++ b/app/Http/Controllers/Admin/Master/UserController.php
@@ -19,8 +19,7 @@ class UserController extends Controller
     public function index(): Response
     {
         return Inertia::render('admin/master/user/index', [
-            'users' => User::with(['profile', 'roles'])->latest()->paginate(10),
-            'roles' => Role::all(),
+            'users' => User::with(['profile', 'roles'])->whereDoesntHave('roles', fn ($query) => $query->where('name', 'Developer'))->latest()->paginate(10),
             'defaultPassword' => config('auth.password_default', 'password'),
         ]);
     }
@@ -28,7 +27,7 @@ public function index(): Response
     public function create(): Response
     {
         return Inertia::render('admin/master/user/create', [
-            'roles' => Role::all(),
+            'roles' => Role::where('name', '!=', 'Developer')->get(),
         ]);
     }
 
@@ -41,7 +40,7 @@ public function store(UserRequest $request): RedirectResponse
                 $user = User::create([
                     'username' => $validated['username'],
                     'email' => $validated['email'],
-                    'password' => Hash::make(config('auth.password_default')),
+                    'password' => Hash::make(config('auth.password_default', 'password')),
                 ]);
 
                 $user->profile()->create([
@@ -79,7 +78,7 @@ public function edit(User $user): Response
 
         return Inertia::render('admin/master/user/edit', [
             'user' => $user,
-            'roles' => Role::all(),
+            'roles' => Role::where('name', '!=', 'Developer')->get(),
         ]);
     }
 
diff --git a/tests/Feature/Admin/Master/UserTest.php b/tests/Feature/Admin/Master/UserTest.php
index 242922c..ab3a6c8 100644
--- a/tests/Feature/Admin/Master/UserTest.php
+++ b/tests/Feature/Admin/Master/UserTest.php
@@ -50,17 +50,38 @@
             ->assertInertia(fn ($page) => $page
                 ->component('admin/master/user/index')
                 ->has('users', fn ($page) => $page->has('data')->etc())
-                ->has('roles')
                 ->has('defaultPassword')
             );
     });
 
+    it('excludes users with Developer role from index', function () {
+        $developerRole = Role::create(['name' => 'Developer']);
+        $developer = User::factory()->create();
+        $developer->assignRole($developerRole);
+
+        $regularUser = User::factory()->create();
+
+        get(route('user.index'))
+            ->assertOk()
+            ->assertInertia(fn ($page) => $page
+                ->has('users.data', fn ($data) => $data
+                    ->each(fn ($user) => $user->where('id', fn ($id) => $id !== $developer->id)->etc())
+                    ->etc()
+                )
+            );
+    });
+
     it('can access user create page', function () {
+        Role::create(['name' => 'Developer']);
+        Role::create(['name' => 'Admin']);
+
         get(route('user.create'))
             ->assertOk()
             ->assertInertia(fn ($page) => $page
                 ->component('admin/master/user/create')
-                ->has('roles')
+                ->has('roles', fn ($roles) => $roles
+                    ->each(fn ($role) => $role->where('name', fn ($name) => $name !== 'Developer')->etc())
+                )
             );
     });
 
@@ -105,6 +126,8 @@
     });
 
     it('can access user edit page', function () {
+        Role::create(['name' => 'Developer']);
+        Role::create(['name' => 'Admin']);
         $user = User::factory()->create();
 
         get(route('user.edit', $user))
@@ -112,7 +135,9 @@
             ->assertInertia(fn ($page) => $page
                 ->component('admin/master/user/edit')
                 ->has('user')
-                ->has('roles')
+                ->has('roles', fn ($roles) => $roles
+                    ->each(fn ($role) => $role->where('name', fn ($name) => $name !== 'Developer')->etc())
+                )
             );
     });