Enhance role management for managers

app/Http/Controllers/AirlineController.php

@@ -57,6 +57,7 @@ public function foundStore(Request $request)
             'unit_is_lbs'          => $request->boolean('unit_is_lbs'),
             'active'               => true,
             'require_pirep_review' => true,
+            'owner_user_id'        => auth()->id(),
         ]);
 
         $airline->users()->attach(auth()->id(), ['role' => 'Manager']);

app/Http/Controllers/MemberController.php

@@ -0,0 +1,141 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\Airline;
+use App\Models\User;
+use App\Support\ActivityLevel;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+
+class MemberController extends Controller
+{
+    public function __construct()
+    {
+        $this->middleware('auth');
+    }
+
+    public function index()
+    {
+        $airline = session('activeairline');
+
+        abort_unless($airline && auth()->user()->isManagerOf($airline), 403);
+
+        // Reload from DB — the session model is a snapshot
+        $airline = Airline::findOrFail($airline->id);
+
+        // Owner first (represented by -1), then Managers (0), Dispatchers (1), Pilots (2); alphabetical within each.
+        // Sorted in PHP so it stays portable across MySQL/SQLite (tests).
+        $roleOrder = ['Manager' => 0, 'Dispatcher' => 1, 'Pilot' => 2];
+        $members = $airline->users()
+            ->orderBy('name')
+            ->get()
+            ->sortBy(fn ($member) => [
+                $member->id === $airline->owner_user_id ? -1 : ($roleOrder[$member->pivot->role] ?? 99),
+                $member->name
+            ])
+            ->values();
+
+        return view('manager.members', compact('airline', 'members'));
+    }
+
+    public function update(Request $request, User $member)
+    {
+        $airline = session('activeairline');
+
+        abort_unless($airline && auth()->user()->isManagerOf($airline), 403);
+        abort_unless($airline->isMember($member), 403);
+
+        // Reload fresh to have accurate owner_user_id
+        $airline = Airline::findOrFail($airline->id);
+
+        $viewerIsOwner = auth()->user()->isOwnerOf($airline);
+        $targetIsOwner = $airline->owner_user_id === $member->id;
+
+        abort_if($targetIsOwner, 403);
+
+        $request->validate(['role' => 'required|in:Pilot,Dispatcher,Manager']);
+
+        if (! $viewerIsOwner) {
+            $isTargetManager = $member->hasAirlineRole($airline, 'Manager');
+            abort_if($isTargetManager || $request->role === 'Manager', 403);
+        }
+
+        $airline->users()->updateExistingPivot($member->id, ['role' => $request->role]);
+
+        activity()
+            ->causedBy(auth()->user())
+            ->performedOn($airline)
+            ->withProperties(['level' => ActivityLevel::INFO])
+            ->event('airline_member_role_changed')
+            ->log($member->name . ' is now ' . $request->role . ' at ' . $airline->name);
+
+        return back()->with('success', $member->name . "'s role updated to " . $request->role . '.');
+    }
+
+    public function destroy(User $member)
+    {
+        $airline = session('activeairline');
+
+        abort_unless($airline && auth()->user()->isManagerOf($airline), 403);
+        abort_unless($airline->isMember($member), 403);
+
+        // Reload fresh to have accurate owner_user_id
+        $airline = Airline::findOrFail($airline->id);
+
+        $viewerIsOwner = auth()->user()->isOwnerOf($airline);
+        $targetIsOwner = $airline->owner_user_id === $member->id;
+
+        abort_if($targetIsOwner, 403);
+
+        if (! $viewerIsOwner) {
+            $isTargetManager = $member->hasAirlineRole($airline, 'Manager');
+            abort_if($isTargetManager, 403);
+        }
+
+        $airline->users()->detach($member->id);
+
+        activity()
+            ->causedBy(auth()->user())
+            ->performedOn($airline)
+            ->withProperties(['level' => ActivityLevel::INFO])
+            ->event('airline_member_removed')
+            ->log($member->name . ' was removed from ' . $airline->name);
+
+        return back()->with('success', $member->name . ' has been removed from the airline.');
+    }
+
+    public function transferOwnership(User $member)
+    {
+        $airline = session('activeairline');
+
+        abort_unless($airline, 403);
+        $airline = Airline::findOrFail($airline->id);
+
+        abort_unless(auth()->user()->isOwnerOf($airline), 403);
+        abort_unless($airline->isMember($member), 403);
+        abort_if($member->id === auth()->id(), 422);
+
+        DB::transaction(function () use ($airline, $member) {
+            // Promote new owner to Manager role in memberships
+            $airline->users()->updateExistingPivot($member->id, ['role' => 'Manager']);
+            // Keep old owner as Manager in memberships
+            $airline->users()->updateExistingPivot(auth()->id(), ['role' => 'Manager']);
+
+            $airline->owner_user_id = $member->id;
+            $airline->save();
+        });
+
+        // re-put the fresh airline into the session
+        session(['activeairline' => $airline]);
+
+        activity()
+            ->causedBy(auth()->user())
+            ->performedOn($airline)
+            ->withProperties(['level' => ActivityLevel::INFO])
+            ->event('airline_ownership_transferred')
+            ->log('Ownership of ' . $airline->name . ' transferred to ' . $member->name);
+
+        return back()->with('success', 'Ownership transferred to ' . $member->name . '. You are now a Manager.');
+    }
+}

app/Http/Controllers/SetupController.php

@@ -121,6 +121,8 @@ public function store(Request $request)
 
             $user->assignRole($superAdminRole);
             $airline->users()->attach($user, ['role' => 'Manager']);
+            $airline->owner_user_id = $user->id;
+            $airline->save();
 
             auth()->login($user);
             session(['activeairline' => $airline]);

app/Models/Airline.php

@@ -27,6 +27,7 @@ class Airline extends Model
         'active',
         'require_pirep_review',
         'location_continuity',
+        'owner_user_id',
     ];
 
     protected $casts = [
@@ -83,4 +84,14 @@ public function notams(): HasMany
         return $this->hasMany(Notam::class);
     }
 
+    public function owner(): \Illuminate\Database\Eloquent\Relations\BelongsTo
+    {
+        return $this->belongsTo(User::class, 'owner_user_id');
+    }
+
+    public function isOwnedBy(User $u): bool
+    {
+        return $this->owner_user_id !== null && $this->owner_user_id === $u->id;
+    }
+
 }

app/Models/User.php

@@ -103,14 +103,19 @@ public function hasAirlineRole(Airline $airline, string|array $roles): bool
             ->exists();
     }
 
+    public function isOwnerOf(Airline $airline): bool
+    {
+        return $airline->owner_user_id === $this->id;
+    }
+
     public function isManagerOf(Airline $airline): bool
     {
-        return $this->hasAirlineRole($airline, 'Manager');
+        return $this->isOwnerOf($airline) || $this->hasAirlineRole($airline, 'Manager');
     }
 
     public function canReviewFlightsFor(Airline $airline): bool
     {
-        return $this->hasAirlineRole($airline, ['Dispatcher', 'Manager']);
+        return $this->isOwnerOf($airline) || $this->hasAirlineRole($airline, ['Dispatcher', 'Manager']);
     }
 
     public function countNewNotifications() {

app/Providers/AppServiceProvider.php

@@ -148,7 +148,21 @@ public function boot(): void
         });
 
         Gate::before(function ($user, $ability) {
-            return $user->hasRole('Super-Admin') ? true : null;
+            $activeAirline = session('activeairline');
+            if ($activeAirline) {
+                if ($ability === 'add aircraft' || $ability === 'edit aircraft') {
+                    return $user->isManagerOf($activeAirline);
+                }
+                if ($ability === 'review flight') {
+                    return $user->canReviewFlightsFor($activeAirline);
+                }
+            }
+
+            if ($user->hasRole('Super-Admin')) {
+                return true;
+            }
+
+            return null;
         });
     }
 }

database/migrations/2026_07_23_114200_add_owner_to_airlines_table.php

@@ -0,0 +1,48 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('airlines', function (Blueprint $table) {
+            $table->foreignId('owner_user_id')->nullable()->after('id')->constrained('users')->nullOnDelete();
+        });
+
+        // Backfill
+        $airlines = DB::table('airlines')->get();
+        foreach ($airlines as $airline) {
+            $ownerUserId = DB::table('airline_memberships')
+                ->where('airline_id', $airline->id)
+                ->where('role', 'Manager')
+                ->orderBy('created_at')
+                ->orderBy('id')
+                ->value('user_id');
+
+            if (!$ownerUserId) {
+                $ownerUserId = DB::table('airline_memberships')
+                    ->where('airline_id', $airline->id)
+                    ->orderBy('created_at')
+                    ->orderBy('id')
+                    ->value('user_id');
+            }
+
+            if ($ownerUserId) {
+                DB::table('airlines')
+                    ->where('id', $airline->id)
+                    ->update(['owner_user_id' => $ownerUserId]);
+            }
+        }
+    }
+
+    public function down(): void
+    {
+        Schema::table('airlines', function (Blueprint $table) {
+            $table->dropConstrainedForeignId('owner_user_id');
+        });
+    }
+};

database/seeders/AirlineMembershipSeeder.php

@@ -44,5 +44,30 @@ public function run(): void
                 }
             }
         }
+
+        // Set owners for all airlines
+        $airlines = DB::table('airlines')->get();
+        foreach ($airlines as $airline) {
+            $ownerUserId = DB::table('airline_memberships')
+                ->where('airline_id', $airline->id)
+                ->where('role', 'Manager')
+                ->orderBy('created_at')
+                ->orderBy('id')
+                ->value('user_id');
+
+            if (!$ownerUserId) {
+                $ownerUserId = DB::table('airline_memberships')
+                    ->where('airline_id', $airline->id)
+                    ->orderBy('created_at')
+                    ->orderBy('id')
+                    ->value('user_id');
+            }
+
+            if ($ownerUserId) {
+                DB::table('airlines')
+                    ->where('id', $airline->id)
+                    ->update(['owner_user_id' => $ownerUserId]);
+            }
+        }
     }
 }

resources/views/layouts/_navbar.blade.php

@@ -58,7 +58,7 @@
                     @endphp
                     @if($canReviewFlights || $isAirlineManager)
                         <li class="nav-item dropdown">
-                            <a class="nav-link dropdown-toggle {{ request()->routeIs('flightreviewindex', 'airline.settings', 'invitecodes.index', 'notams.index') ? 'active' : '' }}" href="#" id="navbarDropdownManagement" role="button" data-bs-toggle="dropdown" aria-expanded="false">
+                            <a class="nav-link dropdown-toggle {{ request()->routeIs('flightreviewindex', 'airline.settings', 'members.index', 'invitecodes.index', 'notams.index') ? 'active' : '' }}" href="#" id="navbarDropdownManagement" role="button" data-bs-toggle="dropdown" aria-expanded="false">
                                 <i class="bi bi-briefcase"></i> Management
                             </a>
                             <ul class="dropdown-menu shadow-sm border-0" aria-labelledby="navbarDropdownManagement">
@@ -70,6 +70,7 @@
                                 @endif
                                 @if($isAirlineManager)
                                     <li><a class="dropdown-item {{ request()->routeIs('airline.settings') ? 'active' : '' }}" href="{{ route('airline.settings') }}"><i class="bi bi-sliders me-2 text-secondary"></i> Operations</a></li>
+                                    <li><a class="dropdown-item {{ request()->routeIs('members.index') ? 'active' : '' }}" href="{{ route('members.index') }}"><i class="bi bi-people me-2 text-secondary"></i> Members</a></li>
                                     <li><a class="dropdown-item {{ request()->routeIs('invitecodes.index') ? 'active' : '' }}" href="{{ route('invitecodes.index') }}"><i class="bi bi-ticket-perforated me-2 text-secondary"></i> Invite codes</a></li>
                                     <li><a class="dropdown-item {{ request()->routeIs('notams.index') ? 'active' : '' }}" href="{{ route('notams.index') }}"><i class="bi bi-megaphone me-2 text-secondary"></i> Announcements</a></li>
                                 @endif

resources/views/manager/_sidebar.blade.php

@@ -1,5 +1,5 @@
 {{-- Airline management sections sidebar. Pass $active
-     ('operations' | 'invitecodes' | 'announcements') to highlight the current section. --}}
+     ('operations' | 'members' | 'invitecodes' | 'announcements') to highlight the current section. --}}
 @php($active = $active ?? 'operations')
 <div class="col-12 col-lg-3">
     <div class="card">
@@ -8,6 +8,10 @@
                class="list-group-item list-group-item-action {{ $active === 'operations' ? 'active' : '' }}">
                 <i class="bi bi-sliders me-2"></i> Operations
             </a>
+            <a href="{{ route('members.index') }}"
+               class="list-group-item list-group-item-action {{ $active === 'members' ? 'active' : '' }}">
+                <i class="bi bi-people me-2"></i> Members
+            </a>
             <a href="{{ route('invitecodes.index') }}"
                class="list-group-item list-group-item-action {{ $active === 'invitecodes' ? 'active' : '' }}">
                 <i class="bi bi-ticket-perforated me-2"></i> Invite codes