jwed
cac47b74bd
Removes this app's NavVisibilityRegistry resolver and, where it had one, its page-grant middleware. Sidebar visibility and route access now come from the same place as everything else: a permission, held through a group. Nav visibility already had a better answer than the resolvers. NavItem:: visibleTo() applies required_permission to any route prefix that is NOT registered — central-notifications documents exactly that and is why it never registered one — and HandleInertiaRequests then applies a safety net reading the TARGET route's own `permission:` middleware. The resolvers were overriding both with a lookup against a grant table that is now empty, so a permission holder could open a page while its sidebar link stayed hidden. That inconsistency is what this removes. The middleware only ever NARROWED routes that already carry `permission:`, with one exception worth naming: payments' legacy rule had NO permission bypass, so a payments.view holder was denied the ledger it gates. Deleting it fixes that rather than changing it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RDA3fQbsa3gaHCFoV1Q8Gg