Filament canAccessPanel role guard on the user model

<?php

namespace App\Enums;

enum Role: string
{
    case Admin = 'admin';
    case Vendor = 'vendor';
    case Customer = 'customer';

    /** Panel ids this role may enter. Admins may also look at the vendor panel. */
    public function panels(): array
    {
        return match ($this) {
            self::Admin => ['admin', 'vendor'],
            self::Vendor => ['vendor', 'customer'],
            self::Customer => ['customer'],
        };
    }

    public function canEnter(string $panelId): bool
    {
        return in_array($panelId, $this->panels(), true);
    }
}

<?php

namespace App\Models;

use App\Enums\Role;
use Filament\Models\Contracts\FilamentUser;
use Filament\Panel;
use Illuminate\Foundation\Auth\User as Authenticatable;

class User extends Authenticatable implements FilamentUser
{
    protected $fillable = ['name', 'email', 'password', 'role', 'is_active', 'vendor_approved_at'];

    protected function casts(): array
    {
        return [
            'role' => Role::class,
            'is_active' => 'boolean',
            'vendor_approved_at' => 'datetime',
            'password' => 'hashed',
        ];
    }

    /**
     * Called by Filament on every panel request. Return false and the user
     * gets a 403 instead of the panel, even with a valid session.
     */
    public function canAccessPanel(Panel $panel): bool
    {
        // Suspended accounts are locked out of every panel.
        if (! $this->is_active) {
            return false;
        }

        // The role decides which panels are allowed at all.
        if (! $this->role->canEnter($panel->getId())) {
            return false;
        }

        // Vendors must be approved by staff before they can see their panel.
        if ($panel->getId() === 'vendor' && $this->role === Role::Vendor) {
            return $this->vendor_approved_at !== null;
        }

        // Back-office access additionally requires a verified address.
        if ($panel->getId() === 'admin') {
            return $this->hasVerifiedEmail();
        }

        return true;
    }
}