feat: add secure module marketplace runtime (#745)

app/Http/Controllers/Company/Modules/CompanyModulesController.php

@@ -20,16 +20,16 @@ use InvoiceShelf\Modules\Registry as ModuleRegistry;
  * settings (per CompanySetting under the module.{slug}.* prefix).
  *
  * Slug convention: nwidart stores the module's PascalCase class name in
- * `modules.name` (e.g. "HelloWorld"), but URLs and registry keys use the
- * kebab-case form ("hello-world") for readability. We normalize via
- * Str::kebab() so module authors can call Registry::registerMenu('hello-world')
+ * `modules.name` (e.g. "SalesTaxUs"), but URLs and registry keys use the
+ * kebab-case form ("sales-tax-us") for readability. We normalize via
+ * Str::kebab() so module authors can call Registry::registerMenu('sales-tax-us')
  * naturally without thinking about the storage format.
  */
 class CompanyModulesController extends Controller
 {
     public function index(): JsonResponse
     {
-        $this->authorize('manage modules');
+        $this->authorize('manage module settings');
 
         $modules = Module::query()
             ->where('enabled', true)

app/Http/Controllers/Company/Modules/ModuleSettingsController.php

@@ -25,7 +25,7 @@ class ModuleSettingsController extends Controller
 {
     public function show(Request $request, string $slug): JsonResponse
     {
-        $this->authorize('manage modules');
+        $this->authorize('manage module settings');
 
         $schema = ModuleRegistry::settingsFor($slug);
 
@@ -50,7 +50,7 @@ class ModuleSettingsController extends Controller
 
     public function update(Request $request, string $slug): JsonResponse
     {
-        $this->authorize('manage modules');
+        $this->authorize('manage module settings');
 
         $schema = ModuleRegistry::settingsFor($slug);
 
@@ -139,7 +139,7 @@ class ModuleSettingsController extends Controller
     /**
      * Translate section titles and field labels in the schema so the
      * frontend receives ready-to-display strings instead of Laravel
-     * translation keys it cannot resolve (e.g. `helloworld::settings.greeting`).
+     * translation keys it cannot resolve (e.g. `sales_tax_us::settings.greeting`).
      *
      * @param  array{sections: list<array<string, mixed>>}  $schema
      * @return array{sections: list<array<string, mixed>>}