Add Ladill POS v1 — register, Pay checkout, and commerce links.

Staff-facing counter register at pos.ladill.com with catalog cart, cash and MoMo/card checkout via Ladill Pay, CRM timeline/import, invoice prefill, and Merchant catalog import. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-23 22:52:24 +00:00
commit e5d2b84388
378 changed files with 41419 additions and 0 deletions
@@ -0,0 +1,196 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\QrTeamMember;
+use App\Models\User;
+use Illuminate\Http\Client\ConnectionException;
+use Illuminate\Http\Client\Response as HttpResponse;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Validation\ValidationException;
+
+/**
+ * Native token auth for the Ladill Mini mobile app.
+ *
+ * Login and registration proxy to the central Ladill identity API
+ * (auth.ladill.com /api/identity/auth/*, gated by the shared first-party
+ * service key) so app accounts are the same single identity used by the website
+ * and every other Ladill app. We then provision the thin local user mirror
+ * (keyed by the OIDC `sub`, exactly like the web SSO callback) and hand back a
+ * Sanctum token the app uses for `auth:sanctum` requests.
+ */
+class AuthController extends Controller
+{
+    public function login(Request $request): JsonResponse
+    {
+        $credentials = $request->validate([
+            'email' => ['required', 'email'],
+            'password' => ['required', 'string'],
+            'device_name' => ['nullable', 'string', 'max:120'],
+        ]);
+
+        $response = $this->identityPost('/api/identity/auth/login', [
+            'email' => $credentials['email'],
+            'password' => $credentials['password'],
+        ]);
+
+        if ($response->status() === 422) {
+            throw ValidationException::withMessages([
+                'email' => ['The email or password is incorrect.'],
+            ]);
+        }
+
+        $user = $this->provisionFromResponse($response);
+
+        return $this->issueToken($user, $credentials['device_name'] ?? null);
+    }
+
+    public function register(Request $request): JsonResponse
+    {
+        // Mirror the web signup form; the monolith validates authoritatively, but
+        // we pre-validate so the app gets fast, field-level feedback.
+        $data = $request->validate([
+            'name' => ['required', 'string', 'max:255'],
+            'email' => ['required', 'email', 'max:255'],
+            'password' => ['required', 'string', 'min:8', 'confirmed'],
+            'company' => ['nullable', 'string', 'max:255'],
+            'address' => ['required', 'string', 'max:255'],
+            'city' => ['required', 'string', 'max:255'],
+            'state' => ['required', 'string', 'max:255'],
+            'country' => ['required', 'string', 'size:2'],
+            'zipcode' => ['required', 'string', 'max:32'],
+            'phone_cc' => ['required', 'string', 'max:8'],
+            'phone' => ['required', 'string', 'max:32'],
+            'mobile_cc' => ['nullable', 'string', 'max:8'],
+            'mobile' => ['nullable', 'string', 'max:32'],
+            'terms' => ['accepted'],
+            'device_name' => ['nullable', 'string', 'max:120'],
+        ]);
+
+        $response = $this->identityPost('/api/identity/auth/register', array_merge(
+            $request->only([
+                'name', 'email', 'password', 'password_confirmation', 'company',
+                'address', 'city', 'state', 'country', 'zipcode',
+                'phone_cc', 'phone', 'mobile_cc', 'mobile',
+            ]),
+            ['terms' => $request->boolean('terms')],
+        ));
+
+        // Surface the monolith's validation errors (e.g. email already taken).
+        if ($response->status() === 422) {
+            throw ValidationException::withMessages(
+                $response->json('errors') ?: ['email' => [$response->json('message') ?: 'Registration failed.']],
+            );
+        }
+
+        $user = $this->provisionFromResponse($response);
+
+        return $this->issueToken($user, $data['device_name'] ?? null);
+    }
+
+    public function logout(Request $request): JsonResponse
+    {
+        $request->user()?->currentAccessToken()?->delete();
+
+        return response()->json(['data' => ['message' => 'Signed out.']]);
+    }
+
+    public function me(Request $request): JsonResponse
+    {
+        return response()->json(['data' => $this->presentUser($request->user())]);
+    }
+
+    private function identity(): \Illuminate\Http\Client\PendingRequest
+    {
+        return Http::baseUrl(rtrim((string) config('services.ladill_identity.url'), '/'))
+            ->withToken((string) config('services.ladill_identity.key'))
+            ->connectTimeout(10)
+            ->timeout(20)
+            ->acceptJson()
+            ->asJson();
+    }
+
+    /** POST to the identity API, turning connection failures into a clean message. */
+    private function identityPost(string $path, array $payload): HttpResponse
+    {
+        try {
+            return $this->identity()->post($path, $payload);
+        } catch (ConnectionException $e) {
+            throw ValidationException::withMessages([
+                'email' => ['Could not reach Ladill sign-in. Please try again in a moment.'],
+            ]);
+        }
+    }
+
+    /** Upsert the local mirror from the identity API's OIDC claims. */
+    private function provisionFromResponse(HttpResponse $response): User
+    {
+        if ($response->failed()) {
+            throw ValidationException::withMessages([
+                'email' => ['We could not reach Ladill sign-in. Please try again.'],
+            ]);
+        }
+
+        $claims = (array) $response->json('data.user', []);
+        $sub = (string) ($claims['sub'] ?? '');
+
+        if ($sub === '') {
+            throw ValidationException::withMessages([
+                'email' => ['We could not verify your Ladill account. Please try again.'],
+            ]);
+        }
+
+        $email = (string) ($claims['email'] ?? '');
+
+        return User::updateOrCreate(
+            ['public_id' => $sub],
+            [
+                'name' => $claims['name'] ?? null,
+                'email' => $email !== '' ? $email : $sub.'@users.ladill.com',
+                'avatar_url' => $claims['picture'] ?? null,
+            ],
+        );
+    }
+
+    private function issueToken(User $user, ?string $deviceName): JsonResponse
+    {
+        QrTeamMember::linkPendingInvitesFor($user);
+        $user->update(['last_app_active_at' => now()]);
+
+        $token = $user->createToken($deviceName ?: 'Ladill Mini Android', ['mini:read', 'mini:write']);
+
+        return response()->json([
+            'data' => [
+                'token' => $token->plainTextToken,
+                'user' => $this->presentUser($user),
+            ],
+        ]);
+    }
+
+    /** @return array<string, mixed> */
+    private function presentUser(User $user): array
+    {
+        // On the public login/register routes SetActingAccount hasn't run and
+        // there's no authenticated guard yet, so ladill_account() is null —
+        // the acting account at sign-in is simply the user themselves.
+        $account = ladill_account() ?? $user;
+
+        return [
+            'id' => $user->id,
+            'public_id' => $user->public_id,
+            'name' => $user->name,
+            'email' => $user->email,
+            'avatar_url' => $user->avatarUrl(),
+            'acting_account' => [
+                'id' => $account->id,
+                'public_id' => $account->public_id,
+                'name' => $account->name,
+                'email' => $account->email,
+            ],
+            'accessible_account_ids' => $user->accessibleAccounts()->pluck('id')->values(),
+        ];
+    }
+}