ladill-care/app/Http/Controllers/Care/MemberController.php

<?php

namespace App\Http\Controllers\Care;

use App\Http\Controllers\Controller;
use App\Http\Controllers\Care\Concerns\ScopesToAccount;
use App\Models\Branch;
use App\Models\Member;
use App\Services\Care\AuditLogger;
use App\Services\Identity\IdentityTeamClient;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\View\View;

class MemberController extends Controller
{
    use ScopesToAccount;

    public function index(Request $request): View
    {
        $this->authorizeAbility($request, 'admin.members.view');
        $organization = $this->organization($request);

        $members = Member::owned($this->ownerRef($request))
            ->where('organization_id', $organization->id)
            ->with('branch')
            ->orderBy('created_at')
            ->get();

        return view('care.admin.members.index', [
            'members' => $members,
            'organization' => $organization,
            'roles' => config('care.roles'),
        ]);
    }

    public function create(Request $request): View
    {
        $this->authorizeAbility($request, 'admin.members.manage');
        $organization = $this->organization($request);

        $branches = Branch::owned($this->ownerRef($request))
            ->where('organization_id', $organization->id)
            ->where('is_active', true)
            ->orderBy('name')
            ->get();

        return view('care.admin.members.create', [
            'organization' => $organization,
            'branches' => $branches,
            'roles' => config('care.roles'),
        ]);
    }

    public function store(Request $request, IdentityTeamClient $identity): RedirectResponse
    {
        $this->authorizeAbility($request, 'admin.members.manage');
        $organization = $this->organization($request);
        $owner = $this->ownerRef($request);

        $validated = $request->validate([
            'email' => ['required', 'email', 'max:255'],
            'role' => ['required', 'string', 'in:'.implode(',', array_keys(config('care.roles')))],
            'branch_id' => ['nullable', 'integer', 'exists:care_branches,id'],
        ]);

        $email = strtolower(trim($validated['email']));

        if ($email === strtolower((string) $request->user()->email)) {
            return back()->withErrors(['email' => 'You cannot invite yourself.']);
        }

        $identity->inviteAppMember(
            $owner,
            $email,
            ['care'],
            [
                'care' => [
                    'organization_id' => $organization->id,
                    'role' => $validated['role'],
                    'branch_id' => $validated['branch_id'] ?? null,
                ],
            ],
        );

        $member = Member::updateOrCreate(
            [
                'organization_id' => $organization->id,
                'user_ref' => $email,
            ],
            [
                'owner_ref' => $owner,
                'role' => $validated['role'],
                'branch_id' => $validated['branch_id'] ?? null,
            ],
        );

        AuditLogger::record($owner, 'member.invited', $organization->id, $owner, Member::class, $member->id);

        return redirect()->route('care.members.index')->with('success', 'Invitation sent to '.$email.'.');
    }

    public function destroy(Request $request, Member $member): RedirectResponse
    {
        $this->authorizeAbility($request, 'admin.members.manage');
        $this->authorizeOwner($request, $member);

        abort_if($member->user_ref === $this->ownerRef($request), 422, 'You cannot remove yourself.');

        $memberId = $member->id;
        $organizationId = $member->organization_id;
        $member->delete();

        AuditLogger::record($this->ownerRef($request), 'member.deleted', $organizationId, $this->ownerRef($request), Member::class, $memberId);

        return redirect()->route('care.members.index')->with('success', 'Member removed.');
    }
}