landing-api/app/Policies/UserPolicy.php

<?php

declare(strict_types=1);

namespace App\Policies;

use App\Models\User;
use Illuminate\Database\Eloquent\Model;

class UserPolicy extends ResourcePolicy
{
    protected function resource(): string
    {
        return 'users';
    }

    /**
     * Everyone may read their own record, regardless of permissions — the
     * panel's profile screen depends on it.
     *
     * @param  User|Model  $model
     */
    public function view(User $user, Model $model): bool
    {
        return $user->id === $model->id || parent::view($user, $model);
    }

    /**
     * Nobody may edit an account more privileged than their own, and only a
     * super admin may edit another super admin. Without this, an `admin` could
     * grant themselves `super_admin` through the user editor.
     *
     * @param  User|Model  $model
     */
    public function update(User $user, Model $model): bool
    {
        if ($model->hasRole('super_admin') && ! $user->hasRole('super_admin')) {
            return false;
        }

        return parent::update($user, $model);
    }

    /**
     * Deleting your own account from the panel would drop you out mid-session,
     * and the last super admin must survive or the app locks itself out.
     *
     * @param  User|Model  $model
     */
    public function delete(User $user, Model $model): bool
    {
        if ($user->id === $model->id) {
            return false;
        }

        if ($model->hasRole('super_admin') && ! $user->hasRole('super_admin')) {
            return false;
        }

        if ($model->hasRole('super_admin') && $this->isLastSuperAdmin($model)) {
            return false;
        }

        return parent::delete($user, $model);
    }

    protected function isLastSuperAdmin(User $model): bool
    {
        return User::query()
            ->whereKeyNot($model->getKey())
            ->whereHas('roles', fn ($q) => $q->where('name', 'super_admin'))
            ->doesntExist();
    }
}