Reseed Care demo tenants after each SSO login.

Demo Free/Pro/Enterprise accounts wipe and reload sample clinic data on
authorization-code SSO callbacks so every sales walkthrough starts clean.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -67,6 +67,10 @@ AFIA_PLATFORM_API_KEY=
 # Platform events webhook (user/org lifecycle from the monolith)
 SERVICE_EVENTS_INBOUND_SECRET=
 
+# Suite demo accounts (sales walkthroughs) — reset Care data on each SSO login
+DEMO_ACCOUNTS_ENABLED=false
+DEMO_RESET_ON_LOGIN=true
+
 # --- Inbound service API keys (sibling Ladill apps calling Care) ---
 CARE_API_KEY_FRONTDESK=
 CARE_API_KEY_CRM=

app/Http/Controllers/Auth/SsoLoginController.php

@@ -121,6 +121,7 @@ class SsoLoginController extends Controller
         $request->session()->forget('sso.attempts');
 
         app(TeamMemberProvisioner::class)->sync($user);
+        app(\App\Services\Care\DemoLoginReseeder::class)->maybeResetAfterLogin($user);
 
         return $this->finishCallback($request, $intended, null, app(IdentityTeamClient::class));
     }

app/Services/Care/DemoLoginReseeder.php

@@ -0,0 +1,83 @@
+<?php
+
+namespace App\Services\Care;
+
+use App\Models\User;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Reseed Care demo tenants after a fresh SSO login.
+ */
+class DemoLoginReseeder
+{
+    public function maybeResetAfterLogin(User $user): void
+    {
+        if (! (bool) config('demo_accounts.enabled', false)
+            || ! (bool) config('demo_accounts.reset_on_login', true)) {
+            return;
+        }
+
+        $plan = $this->planForEmail($user->email);
+        if ($plan === null) {
+            return;
+        }
+
+        $seedUser = $this->resolveSeedUser($user);
+        if (! $seedUser) {
+            return;
+        }
+
+        $lockKey = 'demo-reseed:care:'.$seedUser->public_id;
+        if (! Cache::add($lockKey, 1, 120)) {
+            return;
+        }
+
+        $userId = $seedUser->id;
+        dispatch(function () use ($userId, $plan, $lockKey) {
+            try {
+                $user = User::query()->find($userId);
+                if ($user) {
+                    app(DemoTenantSeeder::class)->seed($user, $plan, reset: true);
+                }
+            } catch (\Throwable $e) {
+                Log::warning('demo_care_login_reseed_failed', [
+                    'user_id' => $userId,
+                    'plan' => $plan,
+                    'error' => $e->getMessage(),
+                ]);
+            } finally {
+                Cache::forget($lockKey);
+            }
+        })->afterResponse();
+    }
+
+    private function planForEmail(?string $email): ?string
+    {
+        $email = strtolower(trim((string) $email));
+        if ($email === '') {
+            return null;
+        }
+
+        $accounts = (array) config('demo_accounts.accounts', []);
+        if (isset($accounts[$email])) {
+            return $accounts[$email];
+        }
+
+        $members = (array) config('demo_accounts.member_emails', []);
+        $ownerEmail = $members[$email] ?? null;
+
+        return $ownerEmail ? ($accounts[$ownerEmail] ?? null) : null;
+    }
+
+    private function resolveSeedUser(User $user): ?User
+    {
+        $email = strtolower((string) $user->email);
+        $ownerEmail = ((array) config('demo_accounts.member_emails', []))[$email] ?? null;
+        if (! $ownerEmail) {
+            return $user;
+        }
+
+        return User::query()->where('email', $ownerEmail)->first() ?? $user;
+    }
+}

config/demo_accounts.php

@@ -0,0 +1,18 @@
+<?php
+
+return [
+    'enabled' => (bool) env('DEMO_ACCOUNTS_ENABLED', false),
+    'reset_on_login' => (bool) env('DEMO_RESET_ON_LOGIN', true),
+
+    'accounts' => [
+        'demo-free@ladill.com' => 'free',
+        'demo-pro@ladill.com' => 'pro',
+        'demo-enterprise@ladill.com' => 'enterprise',
+    ],
+
+    // Org members share the enterprise owner tenant.
+    'member_emails' => [
+        'demo-enterprise-member-1@ladill.com' => 'demo-enterprise@ladill.com',
+        'demo-enterprise-member-2@ladill.com' => 'demo-enterprise@ladill.com',
+    ],
+];

tests/Feature/DemoLoginReseederTest.php

@@ -0,0 +1,78 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Http\Middleware\EnsurePlatformSession;
+use App\Models\User;
+use App\Services\Care\DemoLoginReseeder;
+use App\Services\Care\DemoTenantSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Tests\TestCase;
+
+class DemoLoginReseederTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->withoutMiddleware(EnsurePlatformSession::class);
+        config([
+            'demo_accounts.enabled' => true,
+            'demo_accounts.reset_on_login' => true,
+        ]);
+        Cache::flush();
+    }
+
+    public function test_it_reseeds_demo_free_user_after_login(): void
+    {
+        $user = User::create([
+            'public_id' => 'demo-free-pid',
+            'name' => 'Ladill Demo (Free)',
+            'email' => 'demo-free@ladill.com',
+        ]);
+
+        $seeder = $this->mock(DemoTenantSeeder::class);
+        $seeder->shouldReceive('seed')
+            ->once()
+            ->withArgs(fn (User $u, string $plan, bool $reset) => $u->is($user) && $plan === 'free' && $reset === true)
+            ->andReturn(['ok' => true]);
+
+        app(DemoLoginReseeder::class)->maybeResetAfterLogin($user);
+
+        $this->app->terminate();
+    }
+
+    public function test_it_skips_non_demo_users(): void
+    {
+        $user = User::create([
+            'public_id' => 'regular-pid',
+            'name' => 'Regular',
+            'email' => 'regular@example.com',
+        ]);
+
+        $seeder = $this->mock(DemoTenantSeeder::class);
+        $seeder->shouldReceive('seed')->never();
+
+        app(DemoLoginReseeder::class)->maybeResetAfterLogin($user);
+        $this->app->terminate();
+    }
+
+    public function test_it_skips_when_disabled(): void
+    {
+        config(['demo_accounts.enabled' => false]);
+
+        $user = User::create([
+            'public_id' => 'demo-free-pid',
+            'name' => 'Ladill Demo (Free)',
+            'email' => 'demo-free@ladill.com',
+        ]);
+
+        $seeder = $this->mock(DemoTenantSeeder::class);
+        $seeder->shouldReceive('seed')->never();
+
+        app(DemoLoginReseeder::class)->maybeResetAfterLogin($user);
+        $this->app->terminate();
+    }
+}