feat: add UserLevel enum and integrate it in User Modal, UserResource and UserFactory

app/Filament/Resources/UserResource.php

@@ -2,16 +2,14 @@
 
 namespace App\Filament\Resources;
 
-use BackedEnum;
+use App\enum\UserLevel;
-use UnitEnum;
-use Illuminate\Support\Facades\DB;
 use App\Filament\Resources\UserResource\Pages\CreateUser;
 use App\Filament\Resources\UserResource\Pages\EditUser;
 use App\Filament\Resources\UserResource\Pages\ListUsers;
 use App\Filament\Resources\UserResource\RelationManagers\LogsRelationManager;
 use App\Filament\Resources\UserResource\RelationManagers\UsageLogsRelationManager;
 use App\Models\User;
-use Exception;
+use BackedEnum;
 use Filament\Actions\BulkAction;
 use Filament\Actions\BulkActionGroup;
 use Filament\Actions\DeleteBulkAction;
@@ -22,12 +20,14 @@ use Filament\Forms\Components\TextInput;
 use Filament\Notifications\Notification;
 use Filament\Resources\Resource;
 use Filament\Schemas\Schema;
-use Filament\Tables\Columns\BadgeColumn;
 use Filament\Tables\Columns\IconColumn;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Filters\SelectFilter;
 use Filament\Tables\Table;
 use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+use UnitEnum;
 
 class UserResource extends Resource
 {
@@ -75,12 +75,10 @@ class UserResource extends Resource
                     ->displayFormat('Y-m-d H:i:s'),
                 Select::make('level')
                     ->label('User Level')
-                    ->options([
+                    ->options(UserLevel::class)
-                        0 => 'Normal User',
+                    ->enum(UserLevel::class)
-                        1 => 'Banned',
+                    ->required()
-                        9 => 'Super Admin',
+                    ->helperText('Select the appropriate user level. Super Admin has full system access.'),
-                    ])
-                    ->required(),
 
             ]);
     }
@@ -100,19 +98,12 @@ class UserResource extends Resource
                     ->falseColor('danger')
                     ->getStateUsing(fn ($record): bool => ! is_null($record->email_verified_at))
                     ->sortable(),
-                BadgeColumn::make('level')
+                TextColumn::make('level')
                     ->label('User Level')
-                    ->getStateUsing(fn($record): string => match ($record->level) {
+                    ->badge()
-                        0 => 'Normal User',
+                    ->getStateUsing(fn ($record): string => $record->level->getLabel())
-                        1 => 'Banned',
+                    ->color(fn ($record): string => $record->level->getColor())
-                        9 => 'Super Admin',
+                    ->icon(fn ($record): string => $record->level->getIcon())
-                        default => 'Unknown', // In case some invalid level exists
-                    })
-                    ->colors([
-                        'success' => fn ($state): bool => $state === 'Normal User',
-                        'danger' => fn ($state): bool => $state === 'Banned',
-                        'warning' => fn ($state): bool => $state === 'Super Admin',
-                    ])
                     ->sortable(),
                 TextColumn::make('stripe_id')->label('Stripe ID')->copyable(),
                 TextColumn::make('pm_last_four')->label('Card Last 4'),
@@ -120,6 +111,9 @@ class UserResource extends Resource
             ])
             ->defaultSort('created_at', 'desc')
             ->filters([
+                SelectFilter::make('level')
+                    ->label('User Level')
+                    ->options(UserLevel::class),
                 SelectFilter::make('subscription_status')
                     ->label('Subscription Status')
                     ->options([
@@ -162,14 +156,37 @@ class UserResource extends Resource
                     BulkAction::make('updateLevel')
                         ->label('Update User Level')
                         ->action(function (Collection $records, array $data): void {
+                            $newLevel = (int) $data['new_level'];
 
-                            $newLevel = $data['new_level'];
+                            // Prevent bulk updating to Super Admin level for security
-                            throw_if($newLevel === 9, Exception::class, 'User level cannot be 9 or higher.');
+                            if ($newLevel === UserLevel::SUPERADMIN->value) {
+                                $message = 'Cannot bulk assign Super Admin level for security reasons.';
+
+                                Log::warning('Attempted bulk Super Admin assignment', [
+                                    'user_ids' => $records->pluck('id')->toArray(),
+                                    'attempted_level' => $newLevel,
+                                    'ip' => request()->ip(),
+                                ]);
+
+                                Notification::make()
+                                    ->title('Security Restriction')
+                                    ->body($message)
+                                    ->danger()
+                                    ->send();
+
+                                return;
+                            }
 
                             DB::table('users')
                                 ->whereIn('id', $records->pluck('id'))
                                 ->update(['level' => $newLevel]);
 
+                            Log::info('Bulk user level update completed', [
+                                'user_ids' => $records->pluck('id')->toArray(),
+                                'new_level' => $newLevel,
+                                'updated_by' => auth()->id(),
+                            ]);
+
                             Notification::make()
                                 ->title('User Level Updated')
                                 ->body('The selected users\' levels have been updated successfully.')
@@ -179,15 +196,18 @@ class UserResource extends Resource
                         ->icon('heroicon-o-pencil')
                         ->color('primary')
                         ->modalHeading('Select User Level')
-                        ->modalSubheading('Please choose the user level to apply to the selected users.')
+                        ->modalDescription('Please choose the user level to apply to the selected users.')
+                        ->modalSubmitActionLabel('Update Level')
+                        ->modalCancelActionLabel('Cancel')
                         ->form([
                             Select::make('new_level')
                                 ->label('Select User Level')
                                 ->options([
-                                    0 => 'Unban (Normal User)',
+                                    UserLevel::NORMALUSER->value => UserLevel::NORMALUSER->getLabel(),
-                                    1 => 'Ban',
+                                    UserLevel::BANNEDUSER->value => UserLevel::BANNEDUSER->getLabel(),
                                 ])
-                                ->required(),
+                                ->required()
+                                ->helperText('Super Admin level cannot be assigned via bulk action for security.'),
                         ]),
                 ]),
             ]);

app/Models/User.php

@@ -2,7 +2,7 @@
 
 namespace App\Models;
 
-// use Illuminate\Contracts\Auth\MustVerifyEmail;
+use App\enum\UserLevel;
 use Database\Factories\UserFactory;
 use Filament\Models\Contracts\FilamentUser;
 use Filament\Panel;
@@ -52,6 +52,7 @@ class User extends Authenticatable implements FilamentUser, MustVerifyEmail
         return [
             'email_verified_at' => 'datetime',
             'password' => 'hashed',
+            'level' => UserLevel::class,
         ];
     }
 
@@ -65,7 +66,63 @@ class User extends Authenticatable implements FilamentUser, MustVerifyEmail
 
     public function canAccessPanel(Panel $panel): bool
     {
-        return str_ends_with($this->email, '@zemail.me') && $this->level === 9 && $this->hasVerifiedEmail();
+        return str_ends_with($this->email, '@zemail.me') && $this->level === UserLevel::SUPERADMIN && $this->hasVerifiedEmail();
+    }
+
+    /**
+     * Scope to query only super admin users.
+     */
+    public function scopeIsSuperAdmin($query)
+    {
+        return $query->where('level', UserLevel::SUPERADMIN->value);
+    }
+
+    /**
+     * Scope to query only normal users.
+     */
+    public function scopeIsNormalUser($query)
+    {
+        return $query->where('level', UserLevel::NORMALUSER->value);
+    }
+
+    /**
+     * Scope to query only banner users.
+     */
+    public function scopeIsBannerUser($query)
+    {
+        return $query->where('level', UserLevel::BANNEDUSER->value);
+    }
+
+    /**
+     * Check if user is a super admin.
+     */
+    public function isSuperAdmin(): bool
+    {
+        return $this->level === UserLevel::SUPERADMIN;
+    }
+
+    /**
+     * Check if user is a normal user.
+     */
+    public function isNormalUser(): bool
+    {
+        return $this->level === UserLevel::NORMALUSER;
+    }
+
+    /**
+     * Check if user is a banner user.
+     */
+    public function isBannerUser(): bool
+    {
+        return $this->level === UserLevel::BANNEDUSER;
+    }
+
+    /**
+     * Get user level name.
+     */
+    public function getLevelName(): string
+    {
+        return $this->level->name;
     }
 
     public function tickets(): HasMany

app/enum/UserLevel.php

@@ -0,0 +1,67 @@
+<?php
+
+namespace App\enum;
+
+enum UserLevel: int
+{
+    case SUPERADMIN = 9;
+    case NORMALUSER = 0;
+    case BANNEDUSER = 1;
+
+    /**
+     * Get the user-friendly label for the enum value.
+     */
+    public function getLabel(): string
+    {
+        return match ($this) {
+            self::SUPERADMIN => 'Super Admin',
+            self::NORMALUSER => 'Normal User',
+            self::BANNEDUSER => 'Banned User',
+        };
+    }
+
+    /**
+     * Get the color for the enum value (for UI display).
+     */
+    public function getColor(): string
+    {
+        return match ($this) {
+            self::SUPERADMIN => 'danger',    // Red for highest privilege
+            self::NORMALUSER => 'success',    // Green for regular users
+            self::BANNEDUSER => 'warning',     // Yellow/Orange for banned users
+        };
+    }
+
+    /**
+     * Get the icon for the enum value.
+     */
+    public function getIcon(): string
+    {
+        return match ($this) {
+            self::SUPERADMIN => 'heroicon-o-shield-check',
+            self::NORMALUSER => 'heroicon-o-user',
+            self::BANNEDUSER => 'heroicon-o-no-symbol',
+        };
+    }
+
+    /**
+     * Get all options as array for select fields.
+     */
+    public static function getSelectOptions(): array
+    {
+        return collect(self::cases())->mapWithKeys(fn ($case) => [
+            $case->value => $case->getLabel(),
+        ])->toArray();
+    }
+
+    /**
+     * Get the badge configuration for Filament.
+     */
+    public function getBadge(): array
+    {
+        return [
+            'name' => $this->getLabel(),
+            'color' => $this->getColor(),
+        ];
+    }
+}

database/factories/UserFactory.php

@@ -2,6 +2,7 @@
 
 namespace Database\Factories;
 
+use App\enum\UserLevel;
 use App\Models\User;
 use Illuminate\Database\Eloquent\Factories\Factory;
 use Illuminate\Support\Facades\Hash;
@@ -30,7 +31,7 @@ class UserFactory extends Factory
             'email_verified_at' => now(),
             'password' => static::$password ??= Hash::make('password'),
             'remember_token' => Str::random(10),
-            'level' => 0,
+            'level' => UserLevel::NORMALUSER->value,
         ];
     }
 
@@ -43,4 +44,35 @@ class UserFactory extends Factory
             'email_verified_at' => null,
         ]);
     }
+
+    /**
+     * Create a super admin user.
+     */
+    public function superAdmin(): static
+    {
+        return $this->state(fn (array $attributes): array => [
+            'level' => UserLevel::SUPERADMIN->value,
+            'email' => 'admin@zemail.me',
+        ]);
+    }
+
+    /**
+     * Create a normal user.
+     */
+    public function normalUser(): static
+    {
+        return $this->state(fn (array $attributes): array => [
+            'level' => UserLevel::NORMALUSER->value,
+        ]);
+    }
+
+    /**
+     * Create a banned user.
+     */
+    public function bannedUser(): static
+    {
+        return $this->state(fn (array $attributes): array => [
+            'level' => UserLevel::BANNEDUSER->value,
+        ]);
+    }
 }

database/seeders/UserSeeder.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace Database\Seeders;
+
+use App\Models\User;
+use Illuminate\Database\Seeder;
+
+class UserSeeder extends Seeder
+{
+    /**
+     * Run the database seeds.
+     */
+    public function run(): void
+    {
+        // Create super admin user
+        User::factory()->superAdmin()->create([
+            'name' => 'Super Admin',
+            'email' => 'admin@zemail.me',
+        ]);
+
+        // Create normal users
+        User::factory()->normalUser()->count(5)->create();
+
+        // Create banned users
+        User::factory()->bannedUser()->count(2)->create();
+    }
+}