- Four roles are supported: Owner, Admin, CS, and Gudang — each with a different permission surface.
- The
destroy()method has a bug:Store::where('user_id', ...)only succeeds for the Owner, blocking removal of other members. - Permission checks rely on user-controlled input, opening a permission injection vector on team endpoints.
TeamchatControllerships with hardcoded credentials used for its service-to-service calls.UserRoleandUserAspireare empty MySQL models — the only two non-MongoDB models in the project.
Settings (Team)
Overview of the Team module that manages members, roles, and internal team chat.