nhance/app/Config/Acl.php

<?php

namespace Config;

class Acl
{
    public array $rules = [

        // ===================== PUBLIC / AUTH =====================
        '#^/login#' => ['public' => true],
        '#^/logout#' => ['public' => true],
        '#^/auth#' => ['public' => true],
        '#^/oauth2callback#' => ['public' => true],
        '#^/loginPos#' => ['public' => true],
        '#^/getVerifyPosMobileNo#' => ['public' => true],
        '#^/getVerifiedPosUserData#' => ['public' => true],
        '#^/swagger#' => ['roles' => [ADMIN_ROLE_ID]],
        '#^/fedeploy#' => ['roles' => [ADMIN_ROLE_ID]],
        '#^/visitOffBoardCheck#' => ['roles' => [ADMIN_ROLE_ID]],
        '#^/logs#' => ['roles' => [ADMIN_ROLE_ID]],
        '#^/util/log_list#' => ['roles' => [ADMIN_ROLE_ID]],
        '#^/util/view_log#' => ['roles' => [ADMIN_ROLE_ID]],
        '#^/util/download_log#' => ['roles' => [ADMIN_ROLE_ID]],

        // ===================== PUBLIC DOWNLOADS / FORMS =====================
        '#^/download-#' => ['public' => true],
        '#^/claim-form-download#' => ['public' => true],
        '#^/claims-feedback-form#' => ['public' => true],
        '#^/autobookstackLogin#' => ['public' => true],

        // ===================== DASHBOARD =====================
        '#^/dashboard#' => [
            'roles' => [ ADMIN_ROLE_ID,HEAD_ROLE_ID, MANAGER_ROLE_ID, STAFF_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID],
            'teams' => []
        ],

        // ===================== USER MANAGEMENT =====================
        '#^/user#' => [
            'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID],
            'teams' => []
        ],

        // ===================== CLIENT =====================
        '#^/client#' => [
            'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID],
            'teams' => []
        ],

        // ===================== EMPLOYEE / ENROLLMENT =====================
        '#^/employee#' => [
            'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID],
            'teams' => [ENROLLMENT_TEAM_ID]
        ],

        // ===================== MASTERS =====================
        '#^/master#' => [
            'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID],
            'teams' => []
        ],
        '#^/util#' => [
            'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID,STAFF_ROLE_ID],
            'teams' => []
        ],

        // ===================== POLICY TRANSACTION / BDS =====================
        '#^/policy_tranction#' => [
            'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID],
            'teams' => [FINANCE_TEAM_ID,POS_TEAM_ID]
        ],
        '#^/bds_upload#' => [
           'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID],
            'teams' => [FINANCE_TEAM_ID,POS_TEAM_ID]
        ],

        // ===================== REPORTS =====================
        '#^/bdsReport#' => [
           'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID],
            'teams' => [FINANCE_TEAM_ID,POS_TEAM_ID]
        ],

        // ===================== PAYOUT / COMMISSION =====================
        '#^/payout#' => [
           'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID],
            'teams' => [FINANCE_TEAM_ID,POS_TEAM_ID]
        ],
        '#^/commission#' => [
           'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID],
           'teams' => [FINANCE_TEAM_ID,POS_TEAM_ID]
        ],

        // ===================== CLAIMS / TICKETS =====================
        '#^/ticket#' => [
            'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID],
            'teams' => [CLAIMS_TEAM_ID]
        ],
        '#^/claim_mis#' => [
            'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID],
            'teams' => [CLAIMS_TEAM_ID]
        ],

        // ===================== LEADS / SALES =====================
        '#^/leads#' => [
            'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID],
            'teams' => [BUSINESS_SUPPORT_TEAM_ID, SALES_TEAM_ID]
        ],
        '#^/rfq#' => [
            'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID],
            'teams' => [SALES_TEAM_ID]
        ],
        '#^/sales#' => [
            'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID],
            'teams' => [SALES_TEAM_ID]
        ],

        // ===================== CMS / CONTENT =====================
        '#^/add_image_index#' => [
            'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID,STAFF_ROLE_ID],
            'teams' => []
        ],
        '#^/frontend_content#' => [
            'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID,STAFF_ROLE_ID],
            'teams' => []
        ],
        '#^/FAQ#' => [
            'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID,STAFF_ROLE_ID],
            'teams' => []
        ],

        // ===================== LOGS =====================
        '#^/logs#' => [
            'roles' => [ADMIN_ROLE_ID],
            'teams' => []
        ],

        // ===================== INTERNAL TEST =====================
        '#^/test#' => [
            'roles' => [ADMIN_ROLE_ID],
            'teams' => []
        ],

        // ===================== API (JWT / SIGNED) =====================
        '#^/api#' => ['public' => true],
        '#^/employeeRest#' => ['public' => true],
        '#^/clientApi#' => ['public' => true],

        // ===================== WEBHOOKS / 3RD PARTY =====================
        '#^/dispatchWebhookData#' => ['public' => true],
        '#^/retrieveWebhookData#' => ['public' => true],
        // '#^/ICICI#' => ['public' => true],
        // '#^/Vidal#' => ['public' => true],
        // '#^/MediAssist#' => ['public' => true],

        // ===================== CLI =====================
        '#^/cli/#' => ['public' => true],

        // ===================== DEFAULT DENY (ZERO TRUST) =====================
        '#^/#' => [
            'roles' => [ADMIN_ROLE_ID],
            'teams' => []
        ],
    ];
}