Comments Laravel Package

Getting Started

• Install with composer require the package, then publish its config and migrations (php artisan vendor:publish --provider="...CommentsServiceProvider") and run php artisan migrate.
• Look first at three things: the published config file (tenant/company scoping keys and the comments table name), the migration (which columns identify the author and the owning company), and the trait/abstract resource that exposes showOnlyMyComments() and allowToShowAllCompaniesComments() — that class is where all visibility logic lives.
• First use case: drop the comments field/card onto a Nova resource's fields() method for a standard (non-admin) user. Out of the box they should see and manage only their own comments on the records they can already reach.

Implementation Patterns

• Scoped-by-default, unlocked-by-exception. Treat "show only my comments" as the default posture and opt into broader visibility explicitly per resource. This keeps the blast radius of a forgotten flag small.
• Centralize in a base resource. Create an abstract App\Nova\Resources\BaseResource that calls showOnlyMyComments(! $user->isSystemAdmin()) once, then have tenant resources extend it. Otherwise every new resource is a chance to reintroduce the wrong default.
• Gate the cross-company method behind authorization, not a role name string. Wrap allowToShowAllCompaniesComments() in a policy or Gate check (e.g. $user->can('viewAllCompaniesComments')) so it is testable and auditable, rather than scattering hasRole('admin') calls.
• Multi-tenant admin screens. For a system-admin dashboard spanning several companies, enable the all-companies flag on the admin resource only, and pair it with an explicit company filter field so the unfiltered view is still browsable.
• Fluent ordering. These visibility methods read like fluent setters on the resource/field definition; set them in one place near the top of fields() and do not toggle them conditionally later in the same request, or the last call wins in a way that is hard to trace.
• Test matrix. Cover at minimum: user A in company 1 (sees only own), user B in company 1 (does not see A's comments), user A in company 2, and system admin (sees all). That matrix is what catches regressions in this area.

Gotchas and Tips

• v1.0.8 changes runtime behavior. showOnlyMyComments() previously ignored its argument and always behaved as if true were passed. Any code calling showOnlyMyComments(false) before this release was silently getting the filtered behavior; after upgrading it will actually show the wider set. Audit every call site before deploying — on a multi-tenant install this is a potential cross-company data exposure, not just a cosmetic change, and the fix is not marked as breaking.
• allowToShowAllCompaniesComments() is a tenant boundary crossing. It exists for a system-admin user, per the release notes, and it is not self-authorizing. If it is reachable from a resource that ordinary tenant users can load (shared base class, inherited config), you have widened visibility for everyone. Gate it and add a test that a non-admin still sees the scoped list.
• Check how the two flags interact. With both set, the semantics of "show all companies" versus "only my comments" are not documented in the release notes; verify against the source whether one short-circuits the other, and pin the expected combination in a test rather than relying on the current behavior.
• Debugging visibility: log or dd() the underlying query constraints when a user sees the wrong rows. Because the flags mutate query state, confirm the final query rather than the call order in your code.
• Regression watch: the showOnlyMyComments bug survived several releases, so do not assume the flag is honored until you have asserted it. A cheap smoke test that a second user in the same company cannot see the first user's comment will catch this class of bug permanently.
• Pin the version in composer.json to 1.0.8 or later once verified, so an environment does not sit on a pre-fix build where the boolean argument is silently ignored.