# UC-07 Open Report Module (Module 3) - Architectural Mapping

This document maps the visual components from the **UC-07 Open Report Module** PlantUML diagram to the Laravel backend implementation, focusing on the dynamic permission system and **SOLID/DRY** principles.

## 1. Actors
* **Actors**: PR Employee, PRHeader, Quality, Admin.
* **Access Philosophy**: Unlike strict route-based middleware (which either allows or blocks an entire route), this module uses a dynamic, database-driven approach. All authenticated actors can technically hit the reports endpoint, but the *contents* of what they see and can access are strictly filtered.

## 2. "List Available Reports by Role" & "Check ReportPermission" (<<include>>)
* **API Endpoint**: `GET /reports`.
* **Database-Driven Authorization**: The system avoids hardcoding role-to-report mappings in the controller (which would violate the **Open/Closed Principle**). Instead, it queries the `ReportPermission` table.
* **Service Object (DRY)**: The `ReportPermissionService::listForUser($user)` method handles this logic. It joins the user's role against the `ReportPermission` table where `can_view = true`. This single source of truth is used by both the API controller (Flutter) and the Web controller (Blade views), perfectly adhering to **DRY**.

## 3. "Report MYRESPONSES", "BRANCHSUMMARY", "CYCLEANALYSIS", etc. (<<extend>>)
* **API Endpoint**: `GET /reports/{code}`.
* **Controller Execution**: When a user requests a specific report (e.g., `CYCLEANALYSIS`), the `ReportController::show` method first validates access using `ReportPermissionService::canView($user, $code)`. If it returns false, the API aborts with an HTTP 403.
* **Strategy & Template Method Patterns**: 
    * Once authorized, the controller uses a Factory or Registry to delegate data fetching to a dedicated service based on the `{code}` (e.g., `CycleAnalysisDataService` for cycle KPI data, or `EmployeeAuditDataService` for branch summaries).
    * This separation cleanly adheres to the **Single Responsibility Principle (SRP)**: the controller checks permissions, the data service fetches the complex DB queries, and the PDF rendering engine (if requested) uses the Template Method pattern to format it.

## 4. Dual Delivery (API & MVC)
* As established in the system's design catalogs, all of these reports are accessible via the Flutter App (`Api\ReportController` returning JSON) and the administrative web panel (`Web\ReportWebController` returning Blade views). The backend guarantees that **both surfaces consume the exact same `ReportPermissionService` and Data Services**, eliminating duplicated business logic.
