# BV-SIS Phase 1 — Error Fix Report

**Date:** 9 July 2026  
**Bugs found:** **7**  
**Bugs fixed:** **7**  
**Remaining:** **0**

---

## Bug #1 — Missing Spatie Activitylog package (FATAL)

| Field | Detail |
|-------|--------|
| Severity | Critical |
| Symptom | `Trait "Spatie\Activitylog\Traits\LogsActivity" not found` during InstitutionSetupSeeder |
| Root cause | `spatie/laravel-activitylog` listed in composer.json/lock but vendor package incomplete/missing |
| Fix | `composer require spatie/laravel-activitylog:^4.12` — package installed and autoloaded |
| Status | FIXED |

---

## Bug #2 — AreaOfStudy wrong table name (FATAL)

| Field | Detail |
|-------|--------|
| Severity | Critical |
| Symptom | `Table 'bv_sis.area_of_studies' doesn't exist` |
| Root cause | Laravel pluralization of `AreaOfStudy` ≠ migration table `areas_of_study` |
| Fix | Added `protected $table = 'areas_of_study';` to `app/Models/AreaOfStudy.php` |
| Status | FIXED |

---

## Bug #3 — Base Controller missing AuthorizesRequests (FATAL)

| Field | Detail |
|-------|--------|
| Severity | Critical |
| Symptom | `Call to undefined method ...Controller::authorize()` on every Institution CRUD page |
| Root cause | Empty `app/Http/Controllers/Controller.php` with no authorization traits |
| Fix | Added `AuthorizesRequests` and `ValidatesRequests` traits |
| Status | FIXED |

---

## Bug #4 — Dashboard Blade / Livewire @json parse error

| Field | Detail |
|-------|--------|
| Severity | High |
| Symptom | `Unclosed '[' on line 335 does not match ')'` compiling dashboard view |
| Root cause | Multiline `@json([...])` mangled by Livewire Extended Blade compiler |
| Fix | Precompute `$growthLabels` / `$growthValues` in `@php` and pass to `@json($var)` |
| Status | FIXED |

---

## Bug #5 — Missing Vite manifest entry for dashboard JS (FATAL)

| Field | Detail |
|-------|--------|
| Severity | Critical |
| Symptom | `Unable to locate file in Vite manifest: resources/js/pages/institution-dashboard.js` |
| Root cause | Asset listed in `vite.config.js` but production build not run / stale manifest |
| Fix | `npm run build` — manifest now includes `institution-dashboard-*.js` |
| Status | FIXED |

---

## Bug #6 — UI permission keys mismatched with policies

| Field | Detail |
|-------|--------|
| Severity | Medium |
| Symptom | Duplicate / Archive / Restore / Export buttons hidden for users with create/edit/view |
| Root cause | Blade checked `.duplicate`, `.archive`, `.restore`, `.export` keys not seeded for most modules |
| Fix | Aligned `row-actions.blade.php` and `table-toolbar.blade.php` with `InstitutionPolicy` mapping (create/edit/view) |
| Status | FIXED |

---

## Bug #7 — Policies used Auth::user() instead of policy $user (RBAC hole)

| Field | Detail |
|-------|--------|
| Severity | Critical (security) |
| Symptom | `Gate::forUser($lecturer)->allows(...)` returned true while super admin was Auth::user() |
| Root cause | `InstitutionPolicy` / `UserPolicy` called `PermissionHelper::can()` which reads `Auth::user()` |
| Fix | Policies now call `$user->can(...)` on the injected policy user |
| Status | FIXED |

---

## Additional Hardening (not counted as separate bugs)

| Change | Reason |
|--------|--------|
| Excel export via `TableExportService::toExcel` + toolbar dropdown | Claimed Excel export was CSV-only |
| Role QA users in `UserSeeder` | Enable RBAC matrix testing (registrar, finance, dean, lecturer, student, admissions) |

---

## Verification After Fixes

```
php artisan migrate:fresh --seed --force   → PASS
php scripts/phase1_final_verify.php        → 79 passed, 0 failed
php scripts/phase1_http_smoke.php          → all institution URLs HTTP 200
```