[Settings]: Company panel — manage Email Templates

[nielsdrost7]

SMART Plan — As an Admin, in the company Panel I want to be able to view, edit, delete Email Templates

Specific

Add an EmailTemplateResource to the Company panel (/{tenant}). The resource is scoped to the current tenant company and is accessible only to users with the customer_admin role (or elevated roles). It provides a full CRUD list page with view, edit, and delete actions, and a create action to add new templates scoped to the company.

Measurable

• A customer_admin can navigate to the Email Templates resource in the company panel without a 403.
• The list page shows only templates belonging to the current tenant company.
• Edit and delete actions complete without errors and persist/remove the record correctly.
• A customer (non-admin) role cannot access the resource (returns 403 or is hidden from navigation).

Achievable

1. Create EmailTemplateResource for the company panel — Modules/Core/Filament/Company/Resources/EmailTemplates/EmailTemplateResource.php
2. Create ListEmailTemplates page — Modules/Core/Filament/Company/Resources/EmailTemplates/Pages/ListEmailTemplates.php
3. Create EditEmailTemplate page — Modules/Core/Filament/Company/Resources/EmailTemplates/Pages/EditEmailTemplate.php
4. Create CreateEmailTemplate page — Modules/Core/Filament/Company/Resources/EmailTemplates/Pages/CreateEmailTemplate.php
5. Scope all queries to Filament::getTenant() via BelongsToCompany trait or explicit ->where('company_id', ...) — EmailTemplate model
6. Register the resource in CompanyPanelProvider — Modules/Core/Providers/CompanyPanelProvider.php
7. Add navigation visibility guard (role check) — inside EmailTemplateResource::canAccess() or canViewAny()

Relevant

Company admins need to manage the email templates used for sending invoices, quotes, and payment reminders directly from their own panel without requiring platform admin intervention.

Time-bound

Sprint 6.

---

Arrange · Act · Assert

// Modules/Core/Tests/Feature/Company/EmailTemplateResourceTest.php

#[Test]
public function customer_admin_can_list_email_templates_in_company_panel(): void
{
    /* Arrange */
    $template = EmailTemplate::factory()->for($this->company)->create();

    /* Act */
    $response = $this->testLivewire(ListEmailTemplates::class);

    /* Assert */
    $response->assertSuccessful()
             ->assertCanSeeTableRecords([$template]);
}

#[Test]
public function customer_admin_can_edit_an_email_template(): void
{
    /* Arrange */
    $template = EmailTemplate::factory()->for($this->company)->create();

    /* Act */
    $response = $this->testLivewire(EditEmailTemplate::class, ['record' => $template->id])
        ->fillForm(['name' => 'Updated Name'])
        ->call('save');

    /* Assert */
    $response->assertHasNoErrors();
    $this->assertDatabaseHas('email_templates', ['id' => $template->id, 'name' => 'Updated Name']);
}

[coderabbitai]

📝 CodeRabbit Plan Mode

Generate an implementation plan and prompts that you can use with your favorite coding agent.

• Create Plan

Examples

• Example 1
• Example 2

---

🔗 Similar Issues

Possible Duplicates

• As an Admin, in the admin Panel I want to be able to view, edit, delete Email Templates #226

Related Issues

• [Settings]: Admin panel — assign Email Templates to companies #230
• As an Admin, in the admin Panel I want to be able to view, edit, delete Invoice Groups #227
• As an Admin, in the admin Panel I want to be able to view, edit, delete Tax Rates #229
• As an Admin, in the admin Panel I want to be able to view, edit, delete Payment Methods #228

👤 Suggested Assignees

• nielsdrost7

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[nielsdrost7]

@coderabbitai make pull-request with AAA test Scenario's: Arrange, Act, Assert. And also make sure you test edge cases

[coderabbitai]

Coding Plan

Approach

Enable company panel users to view, edit, and delete email templates for their own company, following the established pattern from the Numbering resource where create operations are admin-only. The implementation creates a new Company panel resource, adapts the form schema for proper field visibility, and includes comprehensive AAA tests for security and functionality.

Observations

The application uses a modular Filament-based architecture with separate Admin and Company panels. Email templates are currently managed only in the Admin panel (Modules/Core/Filament/Admin/Resources/EmailTemplates/).

Key architectural findings:

• The EmailTemplate model uses the BelongsToCompany trait for tenant scoping
• Templates are stored per-company in the database
• The Numbering resource provides a clear precedent for dual-panel resources: Admin has full CRUD capabilities while Company has restricted access (edit and list only, with canCreate(): false and company_id protection via mutateFormDataBeforeSave())
• Form and table schemas can be reused from Admin resources via EmailTemplateForm::make() and EmailTemplatesTable::make()

Assumptions

Assumption 1: Create Operation Restriction

Options Considered:

• Allow full CRUD in Company panel (create, edit, delete)
• Restrict to edit and delete only (following Numbering pattern)
• Restrict to edit only (no delete, no create)

Chosen Option: 2

Rationale: Following the established Numbering resource pattern ensures consistency, where company users manage existing templates but admins control template provisioning.

Assumption 2: System Template Protection

Options Considered:

• Add migration for is_system boolean field and prevent deletion of system templates
• Allow deletion of all templates (current behavior)
• Soft delete system templates in Company panel but hard delete in Admin panel

Chosen Option: 2

Rationale: Maintain current behavior to avoid database schema changes. This is a business decision that can be revisited if template protection becomes a requirement.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Create Company Panel Email Template Resource

Establish the Company panel resource structure for email template management by creating the resource class, pages, and configuring operations following the Numbering resource pattern.

Task 1: Create EmailTemplateResource for Company Panel

Create the main resource class that defines capabilities and routing for company-level email template management.

• Create Modules/Core/Filament/Company/Resources/EmailTemplates/EmailTemplateResource.php extending BaseResource
• Set canCreate(): false to disable template creation in company panel
• Define model as EmailTemplate::class
• Configure getPages() to return only 'index' => ListEmailTemplates and 'edit' => EditEmailTemplate (no create route)
• Reuse form schema by calling EmailTemplateForm::make() from Admin resource schemas
• Reuse table schema by calling EmailTemplatesTable::make() from Admin resource schemas

Task 2: Create List Page for Company Panel

Implement the list/index page for viewing all email templates scoped to the current company.

• Create Modules/Core/Filament/Company/Resources/EmailTemplates/Pages/ListEmailTemplates.php
• Extend ListRecords from Filament
• Add class docblock explaining company users can view and manage their company's email templates but cannot create new ones
• No header actions needed (create is disabled)
• Tenant filtering will be handled automatically by BaseResource and BelongsToCompany trait

Task 3: Create Edit Page for Company Panel

Implement the edit page with security measures to prevent company_id manipulation.

• Create Modules/Core/Filament/Company/Resources/EmailTemplates/Pages/EditEmailTemplate.php
• Extend EditRecord from Filament
• Add DeleteAction to header actions for template deletion
• Implement mutateFormDataBeforeSave(array $data): array method that unsets $data['company_id'] before saving
• Add docblock explaining the company_id protection prevents cross-tenant data manipulation
• Use app(EmailTemplateService::class)->updateEmailTemplate($this->record, $data) for updates if the service handles additional logic

🤖 Prompt for AI agents

Create the Company panel email template resource structure following the
Numbering resource pattern with restricted operations.

Create EmailTemplateResource in
`Modules/Core/Filament/Company/Resources/EmailTemplates/`:
- Extend BaseResource
- Set model to EmailTemplate::class
- Override canCreate() to return false
- Configure getPages() with only 'index' and 'edit' routes (no 'create')
- Reuse form schema via EmailTemplateForm::make()
- Reuse table schema via EmailTemplatesTable::make()

Create ListEmailTemplates page:
- Extend ListRecords
- Add docblock explaining view-only and management capabilities
- No header actions (create disabled)
- Tenant filtering handled automatically

Create EditEmailTemplate page:
- Extend EditRecord
- Add DeleteAction to header actions
- Implement mutateFormDataBeforeSave() to unset company_id for security
- Add docblock explaining company_id protection
- Use EmailTemplateService if available for update logic

Phase 2: Adapt Form Schema for Company Panel Context

Modify the form schema to hide or disable the company_id field when used in the Company panel, since company users should not see or manipulate this field.

Add Conditional Company Field Visibility

Update the form schema to conditionally hide the company_id field based on panel context.

• In Modules/Core/Filament/Admin/Resources/EmailTemplates/Schemas/EmailTemplateForm.php, check if company_id field exists in the form
• If the field exists, add ->hidden(fn () => Filament::getCurrentPanel()->getId() === 'company') to hide it in company panel
• If no company_id field exists in the form currently (likely since it's set automatically), verify the field won't be accidentally exposed through form introspection
• Ensure 'type' field remains visible and editable in company panel (it determines template purpose and should be manageable)

🤖 Prompt for AI agents

Adapt the email template form schema to hide company_id field in Company panel
context.

Modify EmailTemplateForm in
`Modules/Core/Filament/Admin/Resources/EmailTemplates/Schemas/`:
- Locate company_id field if it exists
- Add conditional hidden() method: ->hidden(fn () =>
Filament::getCurrentPanel()->getId() === 'company')
- If company_id field doesn't exist, verify it won't be exposed through form
introspection
- Ensure 'type' field remains visible and editable in company panel

Phase 3: Implement Comprehensive AAA Test Suite

Create thorough test coverage for Company panel email template operations with explicit Arrange-Act-Assert structure and edge case validation.

Task 1: Create Feature Test File with Base Setup

Set up the test file structure and common test helpers for email template operations.

• Create Modules/Core/Tests/Feature/CompanyEmailTemplatesTest.php
• Extend AbstractCompanyPanelTestCase to inherit company panel setup (user, company, tenant configuration)
• In setUp method, create 2-3 default email templates using EmailTemplate::factory()->for($this->company)->create()
• Add helper methods if needed: getEmailTemplateResource() returning the Livewire component path

Task 2: Test View/List Operations

Verify company users can view their own templates and are properly isolated from other companies' templates.

Test: it_lists_email_templates_for_current_company

• Arrange: Create templates for current company and a different company
• Act: Visit ListEmailTemplates page via Livewire::test()
• Assert: Current company's templates are visible, other company's templates are not (assertCanSeeTableRecords, assertCanNotSeeTableRecords)

Test: it_shows_template_details_in_table

• Arrange: Create template with specific title, type, subject, from_name, from_email
• Act: Render table
• Assert: All expected columns are displayed with correct values

Test: it_does_not_show_create_action

• Arrange: Authenticated company user
• Act: Mount ListEmailTemplates
• Assert: assertActionDoesNotExist('create')

Task 3: Test Edit Operations and Validation

Verify company users can edit templates with proper validation and security controls.

Test: it_can_edit_email_template

• Arrange: Create template, prepare valid form data with modified title/subject
• Act: Navigate to edit page, fillForm with new data, call save action
• Assert: assertHasNoErrors, assertDatabaseHas with updated values

Test: it_validates_required_fields_on_edit

• Arrange: Create template
• Act: Submit form with empty title and type fields
• Assert: assertHasFormErrors(['title', 'type'])

Test: it_validates_email_format_for_from_email

• Arrange: Create template
• Act: Submit form with invalid from_email value ('not-an-email')
• Assert: assertHasFormErrors(['from_email' => 'email'])

Test: it_prevents_company_id_manipulation_on_edit

• Arrange: Create template for current company, prepare form data attempting to change company_id to different company
• Act: Call edit page with manipulated form data including different company_id
• Assert: assertDatabaseHas verifying company_id remains unchanged to original company

Task 4: Test Delete Operations

Verify company users can delete templates with proper authorization.

Test: it_can_delete_email_template

• Arrange: Create template for current company
• Act: Navigate to edit page, call DeleteAction
• Assert: assertDatabaseMissing for deleted template record

Test: it_cannot_delete_other_company_template

• Arrange: Create template for different company, get its ID
• Act: Attempt to access edit page with other company's template ID
• Assert: Expect 403/404 or redirect, assertDatabaseHas confirming template still exists

Task 5: Test Security and Edge Cases

Verify proper isolation, authorization, and error handling.

Test: it_requires_authentication

• Arrange: Log out user (Auth::logout())
• Act: Attempt to access ListEmailTemplates
• Assert: assertRedirect to login or 401 status

Test: it_scopes_queries_to_current_company

• Arrange: Create 5 templates for current company, 3 for another company
• Act: Get list count via Livewire assertion
• Assert: assertCount(5) on table records, verify only current company's templates returned

Test: it_cannot_access_edit_page_for_other_company_template

• Arrange: Create template for Company B while authenticated as Company A user
• Act: Attempt GET request to EditEmailTemplate route with Company B's template ID
• Assert: Expect 403 Forbidden or 404 Not Found status

Test: it_handles_non_existent_template_gracefully

• Arrange: Use non-existent template ID (999999)
• Act: Attempt to access edit page
• Assert: Expect 404 Not Found response

🤖 Prompt for AI agents

Create comprehensive AAA test suite for Company panel email template operations.

Create CompanyEmailTemplatesTest in `Modules/Core/Tests/Feature/`:
- Extend AbstractCompanyPanelTestCase
- In setUp, create 2-3 default email templates for the company
- Add helper methods for resource path if needed

Implement test methods:

**View/List Tests:**
- Test listing templates for current company only (verify isolation)
- Test template details display in table
- Test create action does not exist

**Edit and Validation Tests:**
- Test successful edit with valid data
- Test required field validation (title, type)
- Test email format validation for from_email
- Test company_id manipulation prevention

**Delete Tests:**
- Test successful deletion of own template
- Test cannot delete other company's template

**Security and Edge Case Tests:**
- Test authentication requirement
- Test query scoping to current company
- Test access denial for other company's templates
- Test graceful handling of non-existent templates

Use explicit AAA structure with Livewire testing helpers
(assertCanSeeTableRecords, fillForm, assertHasNoErrors, etc.)

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

Create the Company panel email template resource structure following the
Numbering resource pattern with restricted operations.

Create EmailTemplateResource in
`Modules/Core/Filament/Company/Resources/EmailTemplates/`:
- Extend BaseResource
- Set model to EmailTemplate::class
- Override canCreate() to return false
- Configure getPages() with only 'index' and 'edit' routes (no 'create')
- Reuse form schema via EmailTemplateForm::make()
- Reuse table schema via EmailTemplatesTable::make()

Create ListEmailTemplates page:
- Extend ListRecords
- Add docblock explaining view-only and management capabilities
- No header actions (create disabled)
- Tenant filtering handled automatically

Create EditEmailTemplate page:
- Extend EditRecord
- Add DeleteAction to header actions
- Implement mutateFormDataBeforeSave() to unset company_id for security
- Add docblock explaining company_id protection
- Use EmailTemplateService if available for update logic
===============================================================================

Task: 2

Adapt the email template form schema to hide company_id field in Company panel
context.

Modify EmailTemplateForm in
`Modules/Core/Filament/Admin/Resources/EmailTemplates/Schemas/`:
- Locate company_id field if it exists
- Add conditional hidden() method: ->hidden(fn () =>
Filament::getCurrentPanel()->getId() === 'company')
- If company_id field doesn't exist, verify it won't be exposed through form
introspection
- Ensure 'type' field remains visible and editable in company panel
===============================================================================

Task: 3

Create comprehensive AAA test suite for Company panel email template operations.

Create CompanyEmailTemplatesTest in `Modules/Core/Tests/Feature/`:
- Extend AbstractCompanyPanelTestCase
- In setUp, create 2-3 default email templates for the company
- Add helper methods for resource path if needed

Implement test methods:

**View/List Tests:**
- Test listing templates for current company only (verify isolation)
- Test template details display in table
- Test create action does not exist

**Edit and Validation Tests:**
- Test successful edit with valid data
- Test required field validation (title, type)
- Test email format validation for from_email
- Test company_id manipulation prevention

**Delete Tests:**
- Test successful deletion of own template
- Test cannot delete other company's template

**Security and Edge Case Tests:**
- Test authentication requirement
- Test query scoping to current company
- Test access denial for other company's templates
- Test graceful handling of non-existent templates

Use explicit AAA structure with Livewire testing helpers
(assertCanSeeTableRecords, fillForm, assertHasNoErrors, etc.)

💡 Iterate on the plan with: @coderabbitai <feedback>

Example Feedback
- @coderabbitai You can skip phase 3. Add a simple unit test case for phase 2.
- @coderabbitai For assumption 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!

[nielsdrost7]

SMART Plan — Company panel — manage Email Templates

Specific

Add an EmailTemplateResource to the Company panel (/{tenant}/email-templates). Provides full CRUD (create, read, update, delete) for Email Templates scoped to the current tenant company. Only accessible to customer_admin role.

Measurable

• CRUD table view listing company's email templates.
• Create action opens form with subject, body (rich text), and lifecycle state fields.
• Edit action updates existing template.
• Delete action removes template.
• A Filament success notification confirms each action.

Achievable

1. Verify Modules/Core/Models/EmailTemplate.php has BelongsToCompany trait and scoping.
2. Create Modules/Core/Filament/Company/Resources/EmailTemplateResource.php.
3. Register the resource in CompanyPanelProvider.
4. Add tests: create, update, delete actions.

Relevant

Companies customize email messaging for invoices/quotes/reminders. A CRUD screen lets them manage templates without admin panel access.

Time-bound

Sprint 6.