fix(settings): force can_edit=1 for runtime keys in API and DB writes

editable_only now includes RUNTIME_KEYS; normalize can_edit in responses.
UpdateConfig and montzar login persist can_edit=1. SQL override moved before COMMIT.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Admin/SettingsController.php

@@ -37,10 +37,10 @@ class SettingsController extends Controller
         }
 
         if ($request->boolean('editable_only')) {
+            $local = $query->get();
+
             return response()->json($this->authorizeSettingsPayload(
-                $query->where(function ($q) {
-                    $q->where('can_edit', 1)->orWhere('can_edit', true)->orWhere('can_edit', '1');
-                })->get()
+                $this->composeEditableSettings($local)
             ));
         }
 
@@ -171,6 +171,12 @@ class SettingsController extends Controller
                 if (! is_array($item)) {
                     continue;
                 }
+                if (
+                    SuperAdminProgramSettingsOverlay::isRuntime((string) $key)
+                    || SuperAdminProgramSettingsOverlay::isLocalOwned((string) $key)
+                ) {
+                    continue;
+                }
                 $byKey[(string) $key] = $this->overlayRowToSetting($item);
             }
         } else {
@@ -187,13 +193,31 @@ class SettingsController extends Controller
                 SuperAdminProgramSettingsOverlay::isLocalOwned($key)
                 || SuperAdminProgramSettingsOverlay::isRuntime($key)
             ) {
-                $byKey[$key] = $row;
+                $byKey[$key] = $this->normalizeTenantOwnedRow($row);
             }
         }
 
         return collect(array_values($byKey))->sortBy(fn ($row) => (string) ($row->key ?? ''))->values();
     }
 
+    /**
+     * تنظیمات عادی پنل — can_edit=1 در DB + کلیدهای runtime (کد tenant می‌نویسد).
+     */
+    private function composeEditableSettings($localRows)
+    {
+        $rows = collect($localRows)->filter(function ($row) {
+            $key = (string) ($row->key ?? '');
+
+            return $this->isEditableCanEdit($row->can_edit ?? null)
+                || SuperAdminProgramSettingsOverlay::isRuntime($key);
+        });
+
+        return $rows
+            ->map(fn ($row) => $this->normalizeTenantOwnedRow($row))
+            ->sortBy(fn ($row) => (string) ($row->key ?? ''))
+            ->values();
+    }
+
     /**
      * get_settings: کلیدهای سوپرادمین (can_edit=0) + ردیف‌های جدول لوکال با can_edit=1.
      * اگر سوپرادمین در دسترس نباشد کل جدول لوکال برمی‌گردد.
@@ -211,7 +235,7 @@ class SettingsController extends Controller
 
         foreach ($localRows as $row) {
             if ($this->isEditableCanEdit($row->can_edit ?? null)) {
-                $byKey[(string) $row->key] = $row;
+                $byKey[(string) $row->key] = $this->normalizeTenantOwnedRow($row);
             }
         }
 
@@ -219,6 +243,12 @@ class SettingsController extends Controller
             if (! is_array($item)) {
                 continue;
             }
+            if (
+                SuperAdminProgramSettingsOverlay::isRuntime((string) $key)
+                || SuperAdminProgramSettingsOverlay::isLocalOwned((string) $key)
+            ) {
+                continue;
+            }
             $byKey[(string) $key] = $this->overlayRowToSetting($item);
         }
 
@@ -228,7 +258,7 @@ class SettingsController extends Controller
                 SuperAdminProgramSettingsOverlay::isLocalOwned($key)
                 || SuperAdminProgramSettingsOverlay::isRuntime($key)
             ) {
-                $byKey[$key] = $row;
+                $byKey[$key] = $this->normalizeTenantOwnedRow($row);
             }
         }
 
@@ -271,6 +301,20 @@ class SettingsController extends Controller
         return $setting;
     }
 
+    /** کلیدهای tenant-only — can_edit=1 در پاسخ API حتی اگر DB قدیمی 0 باشد */
+    private function normalizeTenantOwnedRow(Setting $row): Setting
+    {
+        $key = (string) ($row->key ?? '');
+        if (
+            SuperAdminProgramSettingsOverlay::isRuntime($key)
+            || SuperAdminProgramSettingsOverlay::isLocalOwned($key)
+        ) {
+            $row->can_edit = 1;
+        }
+
+        return $row;
+    }
+
     /**
      * اپ کاربر (بدون auth ادمین) هرگز secret/credential نمی‌بیند.
      * پنل ادمین با auth:user همه کلیدها را می‌بیند.

app/Services/ConfigService.php

@@ -444,9 +444,14 @@ class ConfigService
 
     public function UpdateConfig($name, $value)
     {
+        $payload = ['value' => $value];
+        if (SuperAdminProgramSettingsOverlay::isRuntime((string) $name)) {
+            $payload['can_edit'] = 1;
+        }
+
         return Setting::updateOrCreate(
             ['key' => $name],
-            ['value' => $value]
+            $payload
         );
     }
 

app/Services/MontzarService.php

@@ -71,7 +71,7 @@ class MontzarService
 
         Setting::updateOrCreate(
             ['key' => 'montzar_token'],
-            ['value' => $token, 'is_active' => 1]
+            ['value' => $token, 'is_active' => 1, 'can_edit' => 1]
         );
 
         return $token;