ladill-pos/app/Http/Controllers/Pos/MemberController.php

<?php

namespace App\Http\Controllers\Pos;

use App\Http\Controllers\Controller;
use App\Http\Controllers\Pos\Concerns\ScopesToAccount;
use App\Models\PosLocation;
use App\Models\PosMember;
use App\Models\User;
use App\Services\Identity\IdentityTeamClient;
use App\Services\Pos\SubscriptionService;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Validation\Rule;
use Illuminate\View\View;

class MemberController extends Controller
{
    use ScopesToAccount;

    public function __construct(private SubscriptionService $subscriptions) {}

    public function index(Request $request): View|RedirectResponse
    {
        if ($redirect = $this->guardManage($request)) {
            return $redirect;
        }

        $owner = $this->ownerRef($request);
        $members = PosMember::owned($owner)->with('location')->orderBy('created_at')->get();

        return view('pos.team.index', [
            'members' => $members,
            'roles' => config('pos.roles', []),
            'branches' => PosLocation::owned($owner)->orderBy('name')->get(),
        ]);
    }

    public function store(Request $request, IdentityTeamClient $identity): RedirectResponse
    {
        if ($redirect = $this->guardManage($request)) {
            return $redirect;
        }

        $owner = $this->ownerRef($request);

        $validated = $request->validate([
            'email' => ['required', 'email', 'max:255'],
            'role' => ['required', 'string', Rule::in(array_keys(config('pos.roles', [])))],
            'location_id' => [
                Rule::requiredIf(fn () => $request->input('role') === PosMember::ROLE_CASHIER),
                'nullable',
                'integer',
                Rule::exists('pos_locations', 'id')->where('owner_ref', $owner),
            ],
        ]);

        $email = strtolower(trim($validated['email']));
        $actor = $request->user();

        if ($email === strtolower((string) $actor->email)) {
            return back()->withErrors(['email' => 'You cannot invite yourself.']);
        }

        try {
            $identity->inviteAppMember(
                $owner,
                $email,
                ['pos'],
                [
                    'pos' => [
                        'role' => $validated['role'],
                        'location_id' => $validated['location_id'] ?? null,
                    ],
                ],
            );
        } catch (\Throwable $e) {
            return back()->withInput()->with('error', $e->getMessage());
        }

        PosMember::updateOrCreate(
            [
                'owner_ref' => $owner,
                'user_ref' => $email,
            ],
            [
                'role' => $validated['role'],
                'location_id' => $validated['location_id'] ?? null,
            ],
        );

        return back()->with('success', 'Invitation sent to '.$email.'.');
    }

    public function destroy(Request $request, PosMember $member): RedirectResponse
    {
        if ($redirect = $this->guardManage($request)) {
            return $redirect;
        }

        $this->authorizeOwner($request, $member);

        $actor = $request->user();
        if ($member->user_ref === $actor->public_id || $member->user_ref === strtolower((string) $actor->email)) {
            return back()->with('error', 'You cannot remove yourself.');
        }

        $member->delete();

        return back()->with('success', 'Team member removed.');
    }

    private function guardManage(Request $request): ?RedirectResponse
    {
        $owner = $this->ownerRef($request);
        $resolver = app(\App\Services\Pos\PosMemberResolver::class);

        if (! $resolver->canManageTeam($this->posMember($request), $owner, $this->actor($request))) {
            abort(403);
        }

        $account = ladill_account() ?? $request->user();
        if (! $this->subscriptions->canManageTeam($account)) {
            return redirect()->route('pos.pro.index')
                ->with('upsell', 'Team members and branch assignment require Ladill POS Pro or Business.');
        }

        return null;
    }
}