Add multi-branch POS with team roles and branch-scoped cashiers.

Pro and Business users can manage branches, invite cashiers with branch assignment, and switch registers; sales and register flows respect acting location.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Middleware/SetActingAccount.php

@@ -2,6 +2,7 @@
 
 namespace App\Http\Middleware;
 
+use App\Models\PosLocation;
 use App\Models\User;
 use Closure;
 use Illuminate\Http\Request;
@@ -26,6 +27,8 @@ class SetActingAccount
                 }
             }
 
+            $accountId = $this->preferEmployerAccount($request, $user, $accountId);
+
             $account = $accountId === $user->id ? $user : (User::find($accountId) ?? $user);
 
             $request->attributes->set('actingAccount', $account);
@@ -38,4 +41,31 @@ class SetActingAccount
 
         return $next($request);
     }
+
+    private function preferEmployerAccount(Request $request, User $user, int $accountId): int
+    {
+        if ($accountId !== $user->id) {
+            return $accountId;
+        }
+
+        if (PosLocation::owned($user->public_id)->exists()) {
+            return $accountId;
+        }
+
+        $membership = $user->posMemberships()->first();
+        if (! $membership) {
+            return $accountId;
+        }
+
+        $employer = User::where('public_id', $membership->owner_ref)->first();
+        if ($employer && $user->canAccessAccount($employer->id)) {
+            if (! $request->is('api/*')) {
+                $request->session()->put('ladill_account', $employer->id);
+            }
+
+            return $employer->id;
+        }
+
+        return $accountId;
+    }
 }

app/Http/Middleware/SetActingLocation.php

@@ -0,0 +1,67 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Models\PosLocation;
+use App\Models\User;
+use App\Services\Pos\PosLocationService;
+use App\Services\Pos\PosMemberResolver;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\View;
+use Symfony\Component\HttpFoundation\Response;
+
+class SetActingLocation
+{
+    public function __construct(
+        private PosLocationService $locations,
+        private PosMemberResolver $members,
+    ) {}
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (! $user = $request->user()) {
+            return $next($request);
+        }
+
+        $account = ladill_account() ?? $user;
+        $ownerRef = (string) $account->public_id;
+        $member = $this->members->memberFor($user, $ownerRef);
+        $scope = $this->members->locationScope($member, $ownerRef, $user);
+
+        $request->attributes->set('pos.member', $member);
+        $request->attributes->set('pos.locationScope', $scope);
+
+        $location = $this->resolveLocation($request, $ownerRef, $scope);
+        $request->attributes->set('actingLocation', $location);
+
+        if (! $request->is('api/*')) {
+            View::share('actingLocation', $location);
+            View::share('accessibleLocations', $this->locations->accessible($ownerRef, $scope));
+            View::share('posMember', $member);
+            View::share('canManageBranches', $this->members->canManageBranches($member, $ownerRef, $user));
+            View::share('canManageTeam', $this->members->canManageTeam($member, $ownerRef, $user));
+        }
+
+        return $next($request);
+    }
+
+    private function resolveLocation(Request $request, string $ownerRef, ?int $scope): PosLocation
+    {
+        if ($scope !== null) {
+            return PosLocation::owned($ownerRef)->whereKey($scope)->firstOrFail();
+        }
+
+        if (! $request->is('api/*')) {
+            $sessionId = (int) $request->session()->get('ladill_pos_location', 0);
+            if ($sessionId > 0) {
+                $fromSession = PosLocation::owned($ownerRef)->whereKey($sessionId)->first();
+                if ($fromSession) {
+                    return $fromSession;
+                }
+            }
+        }
+
+        return $this->locations->ensureDefault($ownerRef);
+    }
+}