{{--
Row actions for the Bookings DataTable — docs/wireframes-v12/booking-management.html
(~line 154):
**The trash is replaced by Cancel (`fa-ban`)** — client decision D8. This
module has no destroy at all: a booking is a contract, and the record of a
cancelled one is the point rather than clutter. The icon is the same one the
sidebar gives the Cancellation module and the same one the detail screen's
Cancel Booking button carries, so the action reads the same wherever it
appears.
## Cancel is a LINK now, not a POST form (CR-9 §3.4)
It used to be a real POST to `bookings.cancel` behind a `confirm()` dialog,
because a GET that changes data would be triggered by any crawler or
prefetch. That reasoning has not changed — what changed is that **this
control no longer changes anything**. Cancelling a booking has to record a
reason, a date, who asked, the cancellation stage and a verified-document
checklist (CR-9 §2.2), and a one-click POST behind a dialog cannot collect
any of it. So the icon now links to the Initiate Cancellation screen with
this booking preselected, and **that screen is the confirmation step** the
dialog used to be. The route it posted to is gone.
The gate moved with it: `cancellations.create`, not `bookings.delete`
(CR-9 §3.5). `bookings.delete` still exists as a permission and, since CR-15
decision D3 moved document deletion onto `customer_documents.delete`, it now
gates nothing at all — see routes/web.php's Bookings block.
Edit and Cancel are **not** hidden for a cancelled booking any more, and do
not need to be: BookingsDataTable draws confirmed bookings and only those
(CR-9 §3.3), so a cancelled row cannot appear in this table at all. A
cancelled booking's row lives on the Cancellation listing, which has its own
two icons.
Rendered by BookingsDataTable through rawColumns(['actions']), which means
this output is injected into the page unescaped. **Nothing user-controlled
reaches it**: the only dynamic values are three route urls built from the
model key. The booking code used to appear here inside a Js::from()'d
confirm() string; with the dialog gone there is no longer any text in this
partial at all, which is the strongest form of that guarantee.
Every control is gated on its own bare permission rather than on one blanket
check, so a user with `bookings.view` alone gets the eye and nothing else.
Bare permissions and not a policy — CR-8 §0.4, CR-9 §0.4.
yajra hands the row's model in as $model.
--}}
@php
/** @var \App\Models\Booking $model */
@endphp