From e98b1663826f365742d852cc3233fc3319549df4 Mon Sep 17 00:00:00 2001
From: Sam Rolfe <samuelrolfe@gmail.com>
Date: Sat, 8 Aug 2026 08:52:24 +1000
Subject: [PATCH] =?UTF-8?q?admin:=20User=20implements=20FilamentUser=20(ca?=
 =?UTF-8?q?nAccessPanel=3DisAdmin)=20=E2=80=94=20fixes=20403=20in=20produc?=
 =?UTF-8?q?tion?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 admin/app/app/Models/User.php | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/admin/app/app/Models/User.php b/admin/app/app/Models/User.php
index 1ff8910..7d70dad 100644
--- a/admin/app/app/Models/User.php
+++ b/admin/app/app/Models/User.php
@@ -2,29 +2,39 @@
 
 namespace App\Models;
 
+use Filament\Models\Contracts\FilamentUser;
+use Filament\Panel;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
 
-class User extends Authenticatable
+class User extends Authenticatable implements FilamentUser
 {
     use HasFactory, Notifiable;
 
-    protected $table = "users";
+    protected $table = 'users';
     public $timestamps = false; // shared schema: created_at only, set by DB default
-    protected $fillable = ["email", "password_hash", "name", "phone", "is_admin"];
-    protected $hidden = ["password_hash"];
-    protected $casts = ["is_admin" => "boolean"];
+    protected $fillable = ['email', 'password_hash', 'name', 'phone', 'is_admin'];
+    protected $hidden = ['password_hash'];
+    protected $casts = ['is_admin' => 'boolean'];
 
     public function getAuthPassword(): string
     {
         return $this->password_hash;
     }
 
+    /**
+     * Filament panel access — only admins may use the admin panel.
+     */
+    public function canAccessPanel(Panel $panel): bool
+    {
+        return $this->isAdmin();
+    }
+
     public function tags(): HasMany
     {
-        return $this->hasMany(Tag::class, "owner_id");
+        return $this->hasMany(Tag::class, 'owner_id');
     }
 
     public function isAdmin(): bool