ladill-pos/app/Models/User.php

<?php

namespace App\Models;

use Database\Factories\UserFactory;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Relations\HasMany;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Illuminate\Support\Collection;
use Laravel\Sanctum\HasApiTokens;

/**
 * Thin local mirror of the platform identity (auth.ladill.com owns users).
 */
class User extends Authenticatable
{
    /** @use HasFactory<UserFactory> */
    use HasApiTokens, HasFactory, Notifiable;

    protected $fillable = ['public_id', 'name', 'email', 'avatar_url', 'password', 'last_app_active_at'];

    protected $hidden = ['password', 'remember_token'];

    protected function casts(): array
    {
        return [
            'email_verified_at' => 'datetime',
            'last_app_active_at' => 'datetime',
            'password' => 'hashed',
        ];
    }

    public function memberships(): HasMany
    {
        return $this->hasMany(QrTeamMember::class, 'user_id')
            ->where('status', QrTeamMember::STATUS_ACTIVE);
    }

    public function posMemberships(): HasMany
    {
        return $this->hasMany(PosMember::class, 'user_ref', 'public_id');
    }

    public function canAccessAccount(int $accountId): bool
    {
        if ($accountId === $this->id) {
            return true;
        }

        if ($this->memberships()->where('account_id', $accountId)->exists()) {
            return true;
        }

        $account = self::find($accountId);

        return $account !== null
            && $this->posMemberships()->where('owner_ref', $account->public_id)->exists();
    }

    /** @return Collection<int, User> */
    public function accessibleAccounts(): Collection
    {
        $qrIds = $this->memberships()->pluck('account_id')->all();
        $posOwnerRefs = $this->posMemberships()->pluck('owner_ref')->all();

        return collect([$this])
            ->merge(self::whereIn('id', $qrIds)->get())
            ->merge(self::whereIn('public_id', $posOwnerRefs)->get())
            ->unique('id')
            ->values();
    }

    public function avatarUrl(): ?string
    {
        $url = trim((string) $this->avatar_url);

        return $url !== '' ? $url : null;
    }
}