# Apply location scoping to PortfolioService

The report tabs all read PortfolioService, so filtering there covers every screen at
once. Two changes:

## 1. Inject the scope (constructor)

    public function __construct(
        protected CurrentOrganization $current,
        protected \App\Locations\Services\LocationScope $scope,
    ) {}

## 2. Filter units to the caller's locations

Replace the units() body with:

    public function units(): Collection
    {
        $units = $this->rows('units')
            ->reject(fn ($u) => (bool) ($u['archived'] ?? false))
            ->reject(fn ($u) => in_array(strtolower(trim($u['nickname'] ?? '')), self::NON_RENTABLE, true));

        $user = \Illuminate\Support\Facades\Auth::user();

        // No authenticated user (console/scheduler) -> unfiltered; HTTP requests are
        // always scoped by the caller's locations.
        if (! $user || $this->scope->seesAll($user)) {
            return $units->values();
        }

        $allowed = $this->scope->namesForUser($user);

        return $units->filter(fn ($u) => $allowed->contains($u['location_name'] ?? null))->values();
    }

Because locations(), retention(), vacancies(), tenantRoster() and incomeByLocation()
all derive from units() (or group by location_name), they inherit the filter.

## 3. Permission

Add 'locations.view_all' to PermissionRegistry and grant it to the owner + admin roles.
Users without it see only their tagged locations.