field level permissions via ->enable() method.

database/data/permissions.php

@@ -31,7 +31,7 @@ return [
     ],
 
     [
-        'name' => 'edit user permissions',
+        'name' => 'edit user roles',
         'guard_name' => 'web',
         'is_system' => 1,
     ],

resources/views/components/fields.blade.php

@@ -1,11 +1,13 @@
 <div class="mb-4 grid grid-cols-4 gap-4">
     @foreach ($fields as $field)
-        @if ($group)
-            @if ($group === $field->group)
+        @if ($field->enabled)
+            @if ($group)
+                @if ($group === $field->group)
+                    @include($field->getView())
+                @endif
+            @else
                 @include($field->getView())
-            @endif
-        @else
-            @include($field->getView())
-        @endisset
+            @endisset
+        @endif
     @endforeach
 </div>

routes/api.php

@@ -14,10 +14,10 @@ use Illuminate\Http\Request;
 |
 */
 
-// protected routes...
+// Authenticated routes...
 Route::middleware('auth.filament:api')->group(function () {
 
-    // curl -H "Accept: application/json" -X GET http://localhost:8000/cp/api/user
+    // curl -H "Accept: application/json" -X GET http://127.0.0.1:8000/filament/api/user
     Route::get('/user', function (Request $request) {
         return $request->user();
     });

routes/web.php

@@ -13,7 +13,7 @@ use Illuminate\Support\Facades\Route;
 |
 */
 
-// asset routes...
+// Asset routes...
 Route::name('assets.')->group(function () {
 
     Route::get('filament.css', 'AssetController@css')->name('css');
@@ -21,7 +21,7 @@ Route::name('assets.')->group(function () {
     
 });
 
-// authentication routes...
+// Authentication routes...
 Route::name('auth.')->namespace('Auth')->group(function () {
 
     Route::get('login', 'LoginController@showLoginForm')->name('login');
@@ -37,7 +37,7 @@ Route::name('auth.')->namespace('Auth')->group(function () {
     
 });
 
-// protected admin routes...
+// Authenticated routes...
 Route::name('admin.')->middleware('auth.filament')->group(function () {
 
     Route::get('/', 'DashboardController')->name('dashboard');

src/Http/Controllers/ImageController.php

@@ -18,7 +18,6 @@ class ImageController extends Controller
      */
     public function __invoke($path)
     {
-
         try {
             // Validate HTTP signature
             SignatureFactory::create(config('app.key'))->validateRequest($path, request()->all());

src/Http/Controllers/UserController.php

@@ -7,7 +7,6 @@ use Illuminate\Support\Str;
 
 class UserController extends Controller
 {
-
     /**
      * Show the users.
      *

src/Http/Fieldsets/UserEditFieldset.php

@@ -54,7 +54,8 @@ class UserEditFieldset implements Fieldset
             Field::make('filament::permissions.super_admin', 'is_super_admin')
                 ->checkbox()
                 ->help(__('filament::permissions.super_admin_info'))
-                ->group('permissions'),
+                ->group('permissions')
+                ->enabled(auth()->user()->is_super_admin),
             Field::make('filament::permissions.roles', 'roles')
                 ->checkboxes(app(RoleContract::class)::orderBy('name')
                     ->pluck('id', 'name')
@@ -63,7 +64,8 @@ class UserEditFieldset implements Fieldset
                     ->pluck('id')
                     ->all()))
                 ->rules([Rule::exists('roles', 'id')])
-                ->group('permissions'),
+                ->group('permissions')
+                ->enabled(auth()->user()->can('edit user roles')),
         ];
     }
 

src/Http/Livewire/UserEdit.php

@@ -10,12 +10,19 @@ class UserEdit extends FormComponent
     {
         $input = collect($this->form_data);
 
+        if (!auth()->user()->is_super_admin) {
+            $input->forget('is_super_admin');
+        }
+
         if (is_null($input->get('password'))) {
             $input->forget('password');
         }
-        
+
         $this->model->update($input->all());
-        $this->model->syncRoles($input->get('roles'));
+
+        if (auth()->user()->can('edit user roles')) {
+            $this->model->syncRoles($input->get('roles'));
+        }
 
         $this->emit('filament.notification.notify', [
             'type' => 'success',

src/Policies/PermissionPolicy.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace Filament\Policies;
+
+use Illuminate\Auth\Access\Response;
+
+class PermissionPolicy
+{
+    /**
+     * Determine if the authenticated user view users.
+     *
+     * @param  User  $authenticated
+     * @param  User  $user
+     * @return bool
+     */
+    public function view($authenticated): Response
+    {
+        return $authenticated->can('view permissions')
+                ? Response::allow()
+                : Response::deny(__('You are not allowed to view permissions.'));
+    }
+
+    /**
+     * Determine if the authenticated user can update a user.
+     *
+     * @param  User  $authenticated
+     * @return bool
+     */
+    public function edit($authenticated): Response
+    {
+        return $authenticated->can('edit permissions')
+                ? Response::allow()
+                : Response::deny(__('You are not allowed to edit permissions.'));
+    }
+}

src/Support/Fields/BaseField.php

@@ -24,6 +24,7 @@ class BaseField
     protected $file_rules = ['file'];
     protected $file_validation_messages = ['file' => 'Must be a valid file.'];
     protected $disabled = false;
+    protected $enabled = true;
 
     public function __get($property)
     {
@@ -83,6 +84,12 @@ class BaseField
         return $this;
     }
 
+    public function enabled($enabled)
+    {
+        $this->enabled = (bool) $enabled;
+        return $this;
+    }
+
     public function fileRules($rules)
     {
         $this->file_rules = (array) $rules;