feat: implement franchisee permissions management; add routes and update UserTypeController for permissions handling

app/Http/Controllers/UserTypeController.php

@@ -8,6 +8,7 @@
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Validation\Rule;
+use App\Models\Permission;
 
 class UserTypeController extends Controller
 {
@@ -107,7 +108,14 @@ public function permissions(int $id): JsonResponse
 
         $assigned = $this->userTypePermissionService->bitsByPermissionIdForType($userType->id);
 
-        $permissions = $this->permissionService->getTree()->map(fn ($perm) => [
+        $permissions = $this->permissionService->getTree()
+            ->when($this->isUnitContext(), fn ($items) => $items->filter(
+                fn ($permission) => str_starts_with($permission->scope, 'franchisee_'),
+            ))
+            ->when(!$this->isUnitContext(), fn ($items) => $items->reject(
+                fn ($permission) => str_starts_with($permission->scope, 'franchisee_'),
+            ))
+            ->map(fn ($perm) => [
             'id'             => $perm->id,
             'scope'          => $perm->scope,
             'description'    => $perm->description,
@@ -147,6 +155,15 @@ public function updatePermissions(Request $request, int $id): JsonResponse
 
         abort_if($userType->is_system, 422, 'As permissões de administradores do sistema não podem ser alteradas.');
 
+        $permissionIds = collect($data['permissions'])->pluck('permission_id')->unique();
+        $validPermissionIds = Permission::query()
+            ->whereIn('id', $permissionIds)
+            ->when($this->isUnitContext(), fn ($query) => $query->where('scope', 'like', 'franchisee\_%'))
+            ->when(!$this->isUnitContext(), fn ($query) => $query->where('scope', 'not like', 'franchisee\_%'))
+            ->pluck('id');
+
+        abort_if($permissionIds->diff($validPermissionIds)->isNotEmpty(), 422, 'Há permissões fora do contexto ativo.');
+
         $this->userTypePermissionService->syncPermissionsForType($userType, $data['permissions']);
 
         return $this->successResponse(message: __('messages.updated'));
@@ -158,4 +175,15 @@ private function scopeKey(): string
 
         return $unitId ? "unit:{$unitId}" : 'franchisor';
     }
+
+    private function isUnitContext(): bool
+    {
+        if (request()->is('api/franchisee/permissions*')) {
+            abort_unless(request()->filled('active_unit_id'), 403, 'Selecione uma unidade válida.');
+
+            return true;
+        }
+
+        return request()->filled('active_unit_id');
+    }
 }

database/seeders/PermissionSeeder.php

@@ -63,6 +63,7 @@ public function run(): void
                 'financial' => 'Financeiro',
                 'packages' => 'Pacotes',
                 'users' => 'Usuários',
+                'permissions' => 'Permissões',
                 'unit' => 'Unidade',
                 'integrations' => 'APIs',
                 'support' => 'Suporte',

routes/authRoutes/franchisee_permissions.php

@@ -0,0 +1,13 @@
+<?php
+
+use App\Http\Controllers\UserTypeController;
+use Illuminate\Support\Facades\Route;
+
+Route::prefix('franchisee/permissions')->controller(UserTypeController::class)->group(function () {
+    Route::get('/groups', 'index')->middleware('permission:franchisee_permissions,view');
+    Route::post('/groups', 'store')->middleware('permission:franchisee_permissions,add');
+    Route::get('/groups/{id}/permissions', 'permissions')->whereNumber('id')->middleware('permission:franchisee_permissions,view');
+    Route::put('/groups/{id}/permissions', 'updatePermissions')->whereNumber('id')->middleware('permission:franchisee_permissions,edit');
+    Route::put('/groups/{id}', 'update')->whereNumber('id')->middleware('permission:franchisee_permissions,edit');
+    Route::delete('/groups/{id}', 'destroy')->whereNumber('id')->middleware('permission:franchisee_permissions,delete');
+});