From 0eb6f4df24dd85304609eafd08d0e2fcae59086f Mon Sep 17 00:00:00 2001
From: Paulo Castellano <paulo@castellanos.llc>
Date: Mon, 22 Jun 2026 16:35:27 -0300
Subject: [PATCH] refactor(permissions): drop explanatory comments, fix stale
 PostPolicy docblock

---
 app/Policies/PostPolicy.php                  | 3 ++-
 resources/js/components/AppSidebar.vue       | 1 -
 resources/js/composables/useWorkspaceRole.ts | 3 ---
 3 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/app/Policies/PostPolicy.php b/app/Policies/PostPolicy.php
index e542176b..0949d812 100644
--- a/app/Policies/PostPolicy.php
+++ b/app/Policies/PostPolicy.php
@@ -25,7 +25,8 @@ public function view(User $user, Post $post): bool|Response
     }
 
     /**
-     * Authorize updating a post. Same workspace-tenancy guard as `view`.
+     * Authorize updating a post: tenancy guard (404 across tenants) then the
+     * role gate — viewers are read-only (403).
      */
     public function update(User $user, Post $post): bool|Response
     {
diff --git a/resources/js/components/AppSidebar.vue b/resources/js/components/AppSidebar.vue
index 971cdc73..81f50672 100644
--- a/resources/js/components/AppSidebar.vue
+++ b/resources/js/components/AppSidebar.vue
@@ -119,7 +119,6 @@ const workspaceNavItems = computed<NavItem[]>(() => [
         href: accounts.url(),
         icon: IconAffiliate,
     },
-    // Signatures / labels / assets are content-authoring tools (member+ only).
     ...(canCreatePost.value
         ? [
               {
diff --git a/resources/js/composables/useWorkspaceRole.ts b/resources/js/composables/useWorkspaceRole.ts
index a4a34fd3..52ae869e 100644
--- a/resources/js/composables/useWorkspaceRole.ts
+++ b/resources/js/composables/useWorkspaceRole.ts
@@ -28,14 +28,11 @@ export const useWorkspaceRole = () => {
         isOwner,
         isAdminOrAbove,
         isMemberOrAbove,
-        // member+ (owner/admin/member) — content authoring
         canCreatePost: isMemberOrAbove,
         canManageAutomations: isMemberOrAbove,
-        // admin+ (owner/admin) — workspace administration
         canManageAccounts: isAdminOrAbove,
         canManageTeam: isAdminOrAbove,
         canManageWorkspace: isAdminOrAbove,
-        // owner only
         canManageBilling: isOwner,
         canCreateWorkspace: isOwner,
     };