ladill-hosting/app/Models/User.php

<?php

namespace App\Models;

use Database\Factories\UserFactory;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Relations\HasMany;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Illuminate\Support\Collection;
use Laravel\Sanctum\HasApiTokens;

/**
 * Thin local mirror of the platform identity (auth.ladill.com owns users).
 * Keyed by public_id (the OIDC `sub`), upserted from SSO claims on login.
 */
class User extends Authenticatable
{
    /** @use HasFactory<UserFactory> */
    use HasApiTokens, HasFactory, Notifiable;

    protected $fillable = ['public_id', 'name', 'email', 'avatar_url', 'password'];

    protected $hidden = ['password', 'remember_token'];

    protected function casts(): array
    {
        return ['email_verified_at' => 'datetime', 'password' => 'hashed'];
    }

    /** Active team memberships (accounts this user can act within as a member). */
    public function memberships(): HasMany
    {
        return $this->hasMany(HostingTeamMember::class, 'user_id')
            ->where('status', HostingTeamMember::STATUS_ACTIVE);
    }

    /** Can this user act within the given account (own it, or active member)? */
    public function canAccessAccount(int $accountId): bool
    {
        return $accountId === $this->id
            || $this->memberships()->where('account_id', $accountId)->exists();
    }

    /** Owner Users for every account this user can act in (self first). */
    public function accessibleAccounts(): Collection
    {
        $ids = $this->memberships()->pluck('account_id')->all();

        return collect([$this])->merge(self::whereIn('id', $ids)->get())->unique('id')->values();
    }
}