Add multi-branch POS with team roles and branch-scoped cashiers.

Pro and Business users can manage branches, invite cashiers with branch assignment, and switch registers; sales and register flows respect acting location.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Pos/MemberController.php

@@ -0,0 +1,130 @@
+<?php
+
+namespace App\Http\Controllers\Pos;
+
+use App\Http\Controllers\Controller;
+use App\Http\Controllers\Pos\Concerns\ScopesToAccount;
+use App\Models\PosLocation;
+use App\Models\PosMember;
+use App\Models\User;
+use App\Services\Identity\IdentityTeamClient;
+use App\Services\Pos\SubscriptionService;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Validation\Rule;
+use Illuminate\View\View;
+
+class MemberController extends Controller
+{
+    use ScopesToAccount;
+
+    public function __construct(private SubscriptionService $subscriptions) {}
+
+    public function index(Request $request): View|RedirectResponse
+    {
+        if ($redirect = $this->guardManage($request)) {
+            return $redirect;
+        }
+
+        $owner = $this->ownerRef($request);
+        $members = PosMember::owned($owner)->with('location')->orderBy('created_at')->get();
+
+        return view('pos.team.index', [
+            'members' => $members,
+            'roles' => config('pos.roles', []),
+            'branches' => PosLocation::owned($owner)->orderBy('name')->get(),
+        ]);
+    }
+
+    public function store(Request $request, IdentityTeamClient $identity): RedirectResponse
+    {
+        if ($redirect = $this->guardManage($request)) {
+            return $redirect;
+        }
+
+        $owner = $this->ownerRef($request);
+
+        $validated = $request->validate([
+            'email' => ['required', 'email', 'max:255'],
+            'role' => ['required', 'string', Rule::in(array_keys(config('pos.roles', [])))],
+            'location_id' => [
+                Rule::requiredIf(fn () => $request->input('role') === PosMember::ROLE_CASHIER),
+                'nullable',
+                'integer',
+                Rule::exists('pos_locations', 'id')->where('owner_ref', $owner),
+            ],
+        ]);
+
+        $email = strtolower(trim($validated['email']));
+        $actor = $request->user();
+
+        if ($email === strtolower((string) $actor->email)) {
+            return back()->withErrors(['email' => 'You cannot invite yourself.']);
+        }
+
+        try {
+            $identity->inviteAppMember(
+                $owner,
+                $email,
+                ['pos'],
+                [
+                    'pos' => [
+                        'role' => $validated['role'],
+                        'location_id' => $validated['location_id'] ?? null,
+                    ],
+                ],
+            );
+        } catch (\Throwable $e) {
+            return back()->withInput()->with('error', $e->getMessage());
+        }
+
+        PosMember::updateOrCreate(
+            [
+                'owner_ref' => $owner,
+                'user_ref' => $email,
+            ],
+            [
+                'role' => $validated['role'],
+                'location_id' => $validated['location_id'] ?? null,
+            ],
+        );
+
+        return back()->with('success', 'Invitation sent to '.$email.'.');
+    }
+
+    public function destroy(Request $request, PosMember $member): RedirectResponse
+    {
+        if ($redirect = $this->guardManage($request)) {
+            return $redirect;
+        }
+
+        $this->authorizeOwner($request, $member);
+
+        $actor = $request->user();
+        if ($member->user_ref === $actor->public_id || $member->user_ref === strtolower((string) $actor->email)) {
+            return back()->with('error', 'You cannot remove yourself.');
+        }
+
+        $member->delete();
+
+        return back()->with('success', 'Team member removed.');
+    }
+
+    private function guardManage(Request $request): ?RedirectResponse
+    {
+        $owner = $this->ownerRef($request);
+        $resolver = app(\App\Services\Pos\PosMemberResolver::class);
+
+        if (! $resolver->canManageTeam($this->posMember($request), $owner, $this->actor($request))) {
+            abort(403);
+        }
+
+        $account = ladill_account() ?? $request->user();
+        if (! $this->subscriptions->canManageTeam($account)) {
+            return redirect()->route('pos.pro.index')
+                ->with('upsell', 'Team members and branch assignment require Ladill POS Pro or Business.');
+        }
+
+        return null;
+    }
+}