ladill-care/app/Http/Controllers/Care/PatientMessageController.php

<?php

namespace App\Http\Controllers\Care;

use App\Http\Controllers\Controller;
use App\Http\Controllers\Care\Concerns\ScopesToAccount;
use App\Models\Patient;
use App\Services\Billing\PlatformEmailClient;
use App\Services\Billing\PlatformSmsClient;
use App\Services\Care\AuditLogger;
use App\Services\Care\OrganizationResolver;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;

class PatientMessageController extends Controller
{
    use ScopesToAccount;

    public function sendEmail(Request $request, Patient $patient, PlatformEmailClient $email): RedirectResponse
    {
        $this->authorizeAbility($request, 'patients.manage');
        $this->authorizePatient($request, $patient);

        if (! filter_var((string) $patient->email, FILTER_VALIDATE_EMAIL)) {
            return back()->with('error', 'This patient has no valid email on file.');
        }

        $data = $request->validate([
            'subject' => ['required', 'string', 'max:200'],
            'body' => ['required', 'string', 'max:5000'],
        ]);

        $owner = $this->ownerRef($request);
        $html = nl2br(e($data['body']));
        $sent = $email->send($owner, (string) $patient->email, $data['subject'], $html, $data['body']);

        AuditLogger::record(
            $owner,
            $sent ? 'patient.email_sent' : 'patient.email_failed',
            $patient->organization_id,
            $owner,
            Patient::class,
            $patient->id,
            [
                'to' => $patient->email,
                'subject' => $data['subject'],
                'error' => $sent ? null : $email->lastError(),
            ],
        );

        if (! $sent) {
            return back()->with('error', $email->lastError() ?: 'Email could not be sent.');
        }

        return back()->with('success', 'Email sent to '.$patient->email);
    }

    public function sendSms(Request $request, Patient $patient, PlatformSmsClient $sms): RedirectResponse
    {
        $this->authorizeAbility($request, 'patients.manage');
        $this->authorizePatient($request, $patient);

        if (trim((string) $patient->phone) === '') {
            return back()->with('error', 'This patient has no phone number on file.');
        }

        $data = $request->validate([
            'message' => ['required', 'string', 'max:480'],
        ]);

        $owner = $this->ownerRef($request);
        $sent = $sms->send($owner, (string) $patient->phone, $data['message']);

        AuditLogger::record(
            $owner,
            $sent ? 'patient.sms_sent' : 'patient.sms_failed',
            $patient->organization_id,
            $owner,
            Patient::class,
            $patient->id,
            [
                'to' => $patient->phone,
                'error' => $sent ? null : $sms->lastError(),
            ],
        );

        if (! $sent) {
            return back()->with('error', $sms->lastError() ?: 'SMS could not be sent.');
        }

        return back()->with('success', 'SMS sent to '.$patient->phone);
    }

    protected function authorizePatient(Request $request, Patient $patient): void
    {
        $this->authorizeOwner($request, $patient);
        abort_unless($patient->organization_id === $this->organization($request)->id, 404);

        $branchId = app(OrganizationResolver::class)->branchScope($this->member($request));
        if ($branchId !== null && $patient->branch_id !== $branchId) {
            abort(404);
        }
    }
}