From 6a271c1f7dc97d13a47882fe38483c2cb0476e6d Mon Sep 17 00:00:00 2001
From: Thanakorn <thanakorn.inbox@gmail.com>
Date: Mon, 14 Sep 2026 16:57:36 +0700
Subject: [PATCH] Default the app registry when config.php does not define it

---
 app/assets/utils/app_registry.php       | 22 ++++++++++++++++++++++
 app/config.example.php                  |  9 +++++++++
 app/setting/api/engine/manage_users.php |  1 +
 app/setting/users.php                   |  1 +
 docker/php/config.php.template          |  9 +++++++++
 5 files changed, 42 insertions(+)
 create mode 100644 app/assets/utils/app_registry.php

diff --git a/app/assets/utils/app_registry.php b/app/assets/utils/app_registry.php
new file mode 100644
index 0000000..0bf1c11
--- /dev/null
+++ b/app/assets/utils/app_registry.php
@@ -0,0 +1,22 @@
+<?php
+// app/assets/utils/app_registry.php
+//
+// The apps a user can be given access to (user.app_access and
+// company_map_user.app_access), with the label, icon and badge colour the
+// Users Access page shows for each.
+//
+// config.php may define its own $app_registry; this file only fills it in when
+// it is missing or empty — which is every Docker-generated config.php written
+// before the setting was documented. Without it the Add User dialog breaks
+// (Object.entries(null) in setting/users.php) and inviting a user fails
+// (array_keys(null) in setting/api/engine/manage_users.php).
+//
+// Keys must stay within the user.app_access enum: 'wms' and 'accounting'
+// ('all' is implied and never listed here).
+
+if (!isset($app_registry) || !is_array($app_registry) || !$app_registry) {
+    $app_registry = [
+        'wms'        => ['label' => 'WMS',        'icon' => 'ti-box',        'color' => 'bg-label-primary'],
+        'accounting' => ['label' => 'Accounting', 'icon' => 'ti-calculator', 'color' => 'bg-label-success'],
+    ];
+}
diff --git a/app/config.example.php b/app/config.example.php
index 0366161..691b6f4 100644
--- a/app/config.example.php
+++ b/app/config.example.php
@@ -47,6 +47,15 @@ if (!defined('OTP_REQUIRED')) {
 	define('OTP_REQUIRED', false);
 }
 
+// ── App registry ─────────────────────────────────────────────────────────────
+// Apps a user can be given access to, as shown on Setting → Users Access. Keys
+// must match the user.app_access enum ('wms', 'accounting'). If this is left
+// out, assets/utils/app_registry.php supplies the same default.
+$app_registry = [
+	'wms'        => ['label' => 'WMS',        'icon' => 'ti-box',        'color' => 'bg-label-primary'],
+	'accounting' => ['label' => 'Accounting', 'icon' => 'ti-calculator', 'color' => 'bg-label-success'],
+];
+
 // ── Usage packages ───────────────────────────────────────────────────────────
 // Keyed by company_list.package (defaults to 'starter'). Read by UsageGuard to
 // enforce daily/weekly action limits and which features lock once exceeded.
diff --git a/app/setting/api/engine/manage_users.php b/app/setting/api/engine/manage_users.php
index 11a8302..34abb3b 100644
--- a/app/setting/api/engine/manage_users.php
+++ b/app/setting/api/engine/manage_users.php
@@ -1,6 +1,7 @@
 <?php
     session_start();
     require_once '../../../assets/utils/db_auth.php';
+    require_once '../../../assets/utils/app_registry.php';
     require_once '../../../assets/utils/classes/UserManager.php';
 
     if ($user_role !== 'owner') { http_response_code(403); exit(json_encode(['success' => 0, 'message' => 'Only the owner can modify this setting.'])); }
diff --git a/app/setting/users.php b/app/setting/users.php
index dab25f2..1ca5f2b 100644
--- a/app/setting/users.php
+++ b/app/setting/users.php
@@ -1,6 +1,7 @@
 <?php
   session_start();
   require '../config.php';
+  require_once '../assets/utils/app_registry.php';
   require '../include_header.php';
 ?>
 
diff --git a/docker/php/config.php.template b/docker/php/config.php.template
index 20da983..8587007 100644
--- a/docker/php/config.php.template
+++ b/docker/php/config.php.template
@@ -40,6 +40,15 @@ if (!defined('OTP_REQUIRED')) {
 	define('OTP_REQUIRED', ${OTP_REQUIRED});
 }
 
+// ── App registry ─────────────────────────────────────────────────────────────
+// Apps a user can be given access to (Setting → Users Access). Keys must match
+// the user.app_access enum; assets/utils/app_registry.php supplies this default
+// for configs that do not define it.
+$app_registry = [
+	'wms'        => ['label' => 'WMS',        'icon' => 'ti-box',        'color' => 'bg-label-primary'],
+	'accounting' => ['label' => 'Accounting', 'icon' => 'ti-calculator', 'color' => 'bg-label-success'],
+];
+
 // ── Usage packages ───────────────────────────────────────────────────────────
 $packages = [
 	'starter' => [