ladill-care/app/Http/Controllers/Care/PatientMessageController.php

<?php

namespace App\Http\Controllers\Care;

use App\Http\Controllers\Controller;
use App\Http\Controllers\Care\Concerns\ScopesToAccount;
use App\Models\Patient;
use App\Services\Care\AuditLogger;
use App\Services\Care\OrganizationResolver;
use App\Services\Messaging\CustomerEmailClient;
use App\Services\Messaging\CustomerSmsClient;
use App\Services\Messaging\MessagingCredentialsService;
use App\Support\OrganizationBranding;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;

class PatientMessageController extends Controller
{
    use ScopesToAccount;

    public function sendEmail(
        Request $request,
        Patient $patient,
        MessagingCredentialsService $credentials,
        CustomerEmailClient $email,
    ): RedirectResponse {
        $this->authorizeAbility($request, 'patients.manage');
        $this->authorizePatient($request, $patient);

        if (! filter_var((string) $patient->email, FILTER_VALIDATE_EMAIL)) {
            return back()->with('error', 'This patient has no valid email on file.');
        }

        $credential = $credentials->forOrganization($this->organization($request));
        if (! $credential->hasValidBird()) {
            return back()->with('error', 'Connect Ladill Bird in Integrations before sending patient email.');
        }

        $apiKey = $credential->birdApiKey();
        if (! $apiKey) {
            return back()->with('error', 'Bird credentials could not be decrypted. Reconnect Bird in Integrations.');
        }

        $data = $request->validate([
            'subject' => ['required', 'string', 'max:200'],
            'body' => ['required', 'string', 'max:5000'],
        ]);

        $owner = $this->ownerRef($request);
        $organization = $this->organization($request);
        $html = OrganizationBranding::wrapEmailHtml(nl2br(e($data['body'])), $organization);
        $sent = $email->send(
            $apiKey,
            (string) $credential->bird_from_email,
            $credential->bird_from_name,
            (string) $patient->email,
            $data['subject'],
            $html,
            $data['body'],
        );

        AuditLogger::record(
            $owner,
            $sent ? 'patient.email_sent' : 'patient.email_failed',
            $patient->organization_id,
            $owner,
            Patient::class,
            $patient->id,
            [
                'to' => $patient->email,
                'subject' => $data['subject'],
                'error' => $sent ? null : $email->lastError(),
            ],
        );

        if (! $sent) {
            return back()->with('error', $email->lastError() ?: 'Email could not be sent.');
        }

        return back()->with('success', 'Email sent to '.$patient->email);
    }

    public function sendSms(
        Request $request,
        Patient $patient,
        MessagingCredentialsService $credentials,
        CustomerSmsClient $sms,
    ): RedirectResponse {
        $this->authorizeAbility($request, 'patients.manage');
        $this->authorizePatient($request, $patient);

        if (trim((string) $patient->phone) === '') {
            return back()->with('error', 'This patient has no phone number on file.');
        }

        $credential = $credentials->forOrganization($this->organization($request));
        if (! $credential->hasValidSms()) {
            return back()->with('error', 'Connect Ladill SMS in Integrations before sending patient SMS.');
        }

        $apiKey = $credential->smsApiKey();
        if (! $apiKey) {
            return back()->with('error', 'SMS credentials could not be decrypted. Reconnect SMS in Integrations.');
        }

        $data = $request->validate([
            'message' => ['required', 'string', 'max:480'],
        ]);

        $owner = $this->ownerRef($request);
        $sent = $sms->send($apiKey, (string) $patient->phone, $data['message'], (string) $credential->sms_sender_id);

        AuditLogger::record(
            $owner,
            $sent ? 'patient.sms_sent' : 'patient.sms_failed',
            $patient->organization_id,
            $owner,
            Patient::class,
            $patient->id,
            [
                'to' => $patient->phone,
                'error' => $sent ? null : $sms->lastError(),
            ],
        );

        if (! $sent) {
            return back()->with('error', $sms->lastError() ?: 'SMS could not be sent.');
        }

        return back()->with('success', 'SMS sent to '.$patient->phone);
    }

    protected function authorizePatient(Request $request, Patient $patient): void
    {
        $this->authorizeOwner($request, $patient);
        abort_unless($patient->organization_id === $this->organization($request)->id, 404);

        $branchId = app(OrganizationResolver::class)->branchScope($this->member($request));
        if ($branchId !== null && $patient->branch_id !== $branchId) {
            abort(404);
        }
    }
}