ladill-care/app/Services/Care/TeamMemberProvisioner.php

<?php

namespace App\Services\Care;

use App\Models\Member;
use App\Models\User;
use App\Services\Identity\IdentityTeamClient;

class TeamMemberProvisioner
{
    public function __construct(
        protected IdentityTeamClient $identity,
    ) {}

    public function sync(User $user): void
    {
        Member::query()
            ->where('user_ref', strtolower((string) $user->email))
            ->update(['user_ref' => $user->ownerRef()]);

        try {
            $access = $this->identity->teamAccess($user->ownerRef());
        } catch (\Throwable) {
            return;
        }

        foreach ($access as $grant) {
            if (($grant['self'] ?? false) || ($grant['full_access'] ?? false)) {
                continue;
            }

            $apps = (array) ($grant['apps'] ?? []);
            if (! in_array('care', $apps, true)) {
                continue;
            }

            $appMeta = (array) data_get($grant, 'metadata.care', []);
            $organizationId = (int) ($appMeta['organization_id'] ?? 0);
            if ($organizationId <= 0) {
                continue;
            }

            Member::updateOrCreate(
                [
                    'organization_id' => $organizationId,
                    'user_ref' => $user->ownerRef(),
                ],
                [
                    'owner_ref' => (string) ($grant['account'] ?? $user->ownerRef()),
                    'role' => (string) ($appMeta['role'] ?? 'member'),
                    'branch_id' => $appMeta['branch_id'] ?? null,
                ],
            );
        }
    }
}