From 63219a31fb33f060988a82ca30b29463d6ea73f0 Mon Sep 17 00:00:00 2001
From: sky121113 <sky121113@gmail.com>
Date: Wed, 17 Jun 2026 11:15:05 +0800
Subject: [PATCH] =?UTF-8?q?[FIX]=20=E9=81=A0=E7=AB=AF=E7=AE=A1=E7=90=86?=
 =?UTF-8?q?=E6=AD=B7=E5=8F=B2=E7=B4=80=E9=8C=84=E5=A5=97=E7=94=A8=E6=A9=9F?=
 =?UTF-8?q?=E5=8F=B0=E6=8E=88=E6=AC=8A=E9=81=8E=E6=BF=BE=EF=BC=8C=E4=BF=AE?=
 =?UTF-8?q?=E5=BE=A9=E7=A7=9F=E6=88=B6=E5=B8=B3=E8=99=9F=20500?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

1. RemoteController index() 與 stock() 的歷史查詢加上 whereHas('machine')，透過 Machine 的 machine_access 全域作用域，使租戶僅能看到自己被授權機台的指令／補貨紀錄；系統管理員不受限制仍可看全部，符合 RBAC 機台以帳號授權原則。
2. 修復根因：先前重構將 Blade 改為對 machine 關聯直接呼叫 only()，租戶遇到未授權機台時 machine 為 null 導致整頁 500。
3. tab-history 與 tab-history-index 三處 $item->machine->only() 改為 null-safe（?->...?? null）作為防禦，避免未來其他查詢路徑漏過濾再次崩潰。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 app/Http/Controllers/Admin/RemoteController.php             | 6 +++++-
 .../views/admin/remote/partials/tab-history-index.blade.php | 6 +++---
 resources/views/admin/remote/partials/tab-history.blade.php | 6 +++---
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/app/Http/Controllers/Admin/RemoteController.php b/app/Http/Controllers/Admin/RemoteController.php
index 9fceafc..60588cc 100644
--- a/app/Http/Controllers/Admin/RemoteController.php
+++ b/app/Http/Controllers/Admin/RemoteController.php
@@ -42,7 +42,10 @@ class RemoteController extends Controller
         $machines = $machineQuery->paginate($request->input('per_page', 10), ['*'], 'machine_page');
 
         // --- 2. 歷史紀錄處理 (Operation Records Tab) ---
+        // whereHas('machine') 會套用 Machine 的 machine_access 全域作用域，
+        // 確保租戶僅能看到自己被授權機台的指令紀錄（系統管理員不受作用域限制，仍可看全部）。
         $historyQuery = RemoteCommand::where('command_type', '!=', 'reload_stock')
+            ->whereHas('machine')
             ->with(['machine', 'user']);
 
         if ($request->filled('search') && ($request->input('tab') === 'history' || !$request->has('tab'))) {
@@ -233,8 +236,9 @@ class RemoteController extends Controller
             ->paginate($request->input('per_page', 10), ['*'], 'machine_page');
 
         // 2. 歷史紀錄查詢與分頁
+        // whereHas('machine') 套用 machine_access 作用域，租戶僅能看到自己授權機台的補貨紀錄。
         $historyQuery = RemoteCommand::with(['machine', 'user']);
-        $historyQuery->where('command_type', 'reload_stock');
+        $historyQuery->whereHas('machine')->where('command_type', 'reload_stock');
 
         if ($request->filled('search')) {
             $search = $request->input('search');
diff --git a/resources/views/admin/remote/partials/tab-history-index.blade.php b/resources/views/admin/remote/partials/tab-history-index.blade.php
index 4823094..20c5ded 100644
--- a/resources/views/admin/remote/partials/tab-history-index.blade.php
+++ b/resources/views/admin/remote/partials/tab-history-index.blade.php
@@ -162,7 +162,7 @@
                     @foreach ($history as $item)
                     <tr
                         class="group hover:bg-slate-50/80 dark:hover:bg-slate-800/40 transition-all duration-300">
-                        <td class="px-6 py-6 cursor-pointer" @click="selectMachine({{ Js::from($item->machine->only(['id', 'name', 'serial_no', 'image_urls'])) }})">
+                        <td class="px-6 py-6 cursor-pointer" @click="selectMachine({{ Js::from(($item->machine?->only(['id', 'name', 'serial_no', 'image_urls']) ?? null)) }})">
                             <div class="flex items-center gap-4">
                                 <div
                                     class="w-12 h-12 rounded-2xl bg-slate-100 dark:bg-slate-800 flex items-center justify-center text-slate-400 border border-slate-200 dark:border-slate-700 group-hover:bg-cyan-500 group-hover:text-white transition-all duration-300 shadow-sm overflow-hidden shrink-0">
@@ -295,7 +295,7 @@
         <div class="xl:hidden grid grid-cols-1 md:grid-cols-2 gap-6">
             @forelse ($history as $item)
             <div class="luxury-card p-6 rounded-[2rem] border border-slate-100 dark:border-slate-800 bg-white/50 dark:bg-slate-900/50 transition-all duration-300 group"
-                 @click="selectMachine({{ Js::from($item->machine->only(['id', 'name', 'serial_no', 'image_urls'])) }})">
+                 @click="selectMachine({{ Js::from(($item->machine?->only(['id', 'name', 'serial_no', 'image_urls']) ?? null)) }})">
                 <div class="flex items-start justify-between gap-4 mb-6">
                     <div class="flex items-center gap-4 min-w-0">
                         <div class="w-14 h-14 rounded-2xl bg-slate-100 dark:bg-slate-800 flex items-center justify-center text-slate-400 border border-slate-200 dark:border-slate-700 group-hover:bg-cyan-500 group-hover:text-white transition-all duration-300 overflow-hidden shadow-sm shrink-0">
@@ -379,7 +379,7 @@
                 </div>
 
                 <div class="flex items-center gap-3">
-                    <button type="button" @click.stop="selectMachine({{ Js::from($item->machine->only(['id', 'name', 'serial_no', 'image_urls'])) }})"
+                    <button type="button" @click.stop="selectMachine({{ Js::from(($item->machine?->only(['id', 'name', 'serial_no', 'image_urls']) ?? null)) }})"
                        class="flex-1 flex items-center justify-center gap-2 py-3 rounded-xl bg-slate-100 dark:bg-slate-800 text-slate-600 dark:text-slate-300 font-black text-[10px] sm:text-xs tracking-widest hover:bg-slate-200 dark:hover:bg-slate-700 transition-all duration-300 border border-slate-200 dark:border-slate-700 shadow-sm">
                         <svg class="w-4 h-4 stroke-[2.5]" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" d="m16.862 4.487 1.687-1.688a1.875 1.875 0 1 1 2.652 2.652L10.582 16.07a4.5 4.5 0 0 1-1.897 1.13L6 18l.8-2.685a4.5 4.5 0 0 1 1.13-1.897l8.932-8.931Zm0 0L19.5 7.125M18 14v4.75A2.25 2.25 0 0 1 15.75 21H5.25A2.25 2.25 0 0 1 3 18.75V8.25A2.25 2.25 0 0 1 5.25 6H10" /></svg>
                         {{ __('New Command') }}
diff --git a/resources/views/admin/remote/partials/tab-history.blade.php b/resources/views/admin/remote/partials/tab-history.blade.php
index 519ba2d..c68d162 100644
--- a/resources/views/admin/remote/partials/tab-history.blade.php
+++ b/resources/views/admin/remote/partials/tab-history.blade.php
@@ -129,7 +129,7 @@
         <tbody class="divide-y divide-slate-50 dark:divide-slate-800/80">
             @foreach ($history as $item)
             <tr class="group hover:bg-slate-50/80 dark:hover:bg-slate-800/40 transition-all duration-300">
-                <td class="px-6 py-6 cursor-pointer" @click="selectMachine(@js($item->machine->only(['id', 'name', 'serial_no', 'image_urls'])))">
+                <td class="px-6 py-6 cursor-pointer" @click="selectMachine(@js(($item->machine?->only(['id', 'name', 'serial_no', 'image_urls']) ?? null)))">
                     <div class="flex items-center gap-4">
                         <div
                             class="w-12 h-12 rounded-2xl bg-slate-100 dark:bg-slate-800 flex items-center justify-center text-slate-400 border border-slate-200 dark:border-slate-700 group-hover:bg-cyan-500 group-hover:text-white transition-all duration-300 shadow-sm overflow-hidden">
@@ -236,7 +236,7 @@
 <div class="xl:hidden grid grid-cols-1 md:grid-cols-2 gap-6">
     @forelse ($history as $item)
     <div class="luxury-card p-6 rounded-[2rem] border border-slate-100 dark:border-slate-800 bg-white/50 dark:bg-slate-900/50 transition-all duration-300 group"
-        @click="selectMachine(@js($item->machine->only(['id', 'name', 'serial_no', 'image_urls'])))">
+        @click="selectMachine(@js(($item->machine?->only(['id', 'name', 'serial_no', 'image_urls']) ?? null)))">
         <div class="flex items-start justify-between gap-4 mb-6">
             <div class="flex items-center gap-4 min-w-0">
                 <div
@@ -314,7 +314,7 @@
         </div>
 
         <div class="flex items-center gap-3">
-            <button type="button" @click.stop="selectMachine(@js($item->machine->only(['id', 'name', 'serial_no', 'image_urls'])))"
+            <button type="button" @click.stop="selectMachine(@js(($item->machine?->only(['id', 'name', 'serial_no', 'image_urls']) ?? null)))"
                 class="flex-1 flex items-center justify-center gap-2 py-3 rounded-xl bg-slate-100 dark:bg-slate-800 text-slate-600 dark:text-slate-300 font-black text-[10px] sm:text-xs tracking-widest hover:bg-slate-200 dark:hover:bg-slate-700 transition-all duration-300 border border-slate-200 dark:border-slate-700 shadow-sm">
                 <svg class="w-4 h-4 stroke-[2.5]" fill="none" stroke="currentColor" viewBox="0 0 24 24">
                     <path stroke-linecap="round" stroke-linejoin="round"