Add account requests, approval, and restricted resources

app/Actions/ApproveAccountRequest.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Actions;
+
+use App\Enums\AccountApprovalStatus;
+use App\Models\User;
+use App\Notifications\AccountApproved;
+use App\Notifications\AccountRejected;
+
+class ApproveAccountRequest
+{
+    public function approve(User $user): void
+    {
+        $user->update([
+            'approval_status' => AccountApprovalStatus::Approved,
+            'verified_at' => now(),
+            'expires_at' => now()->addYear(),
+        ]);
+
+        $user->notify(new AccountApproved);
+    }
+
+    public function reject(User $user): void
+    {
+        $user->update([
+            'approval_status' => AccountApprovalStatus::Rejected,
+        ]);
+
+        $user->notify(new AccountRejected);
+    }
+}

app/Actions/Fortify/CreateNewUser.php

@@ -2,52 +2,54 @@
 
 namespace App\Actions\Fortify;
 
-use App\Enums\ProfessionalRole;
+use App\Enums\AccountApprovalStatus;
 use App\Enums\UserRole;
 use App\Models\User;
+use App\Notifications\AccountRequested;
+use Illuminate\Support\Facades\Notification;
 use Illuminate\Support\Facades\Validator;
+use Illuminate\Support\Str;
 use Illuminate\Validation\Rule;
 use Illuminate\Validation\ValidationException;
 use Laravel\Fortify\Contracts\CreatesNewUsers;
 
 class CreateNewUser implements CreatesNewUsers
 {
-    use PasswordValidationRules;
-
     /**
-     * Validate and create a newly registered user.
-     *
-     * @param array<string, mixed> $input
+     * @param  array<string, mixed>  $input
      *
      * @throws ValidationException
      */
     public function create(array $input): User
     {
         Validator::make($input, [
             'name' => ['required', 'string', 'max:255'],
-            'email' => [
-                'required',
-                'string',
-                'email',
-                'max:255',
-                Rule::unique(User::class),
-            ],
+            'email' => ['required', 'string', 'email', 'max:255', Rule::unique(User::class)],
             'organization' => ['required', 'string', 'max:255'],
-            'professional_role' => ['required', Rule::enum(ProfessionalRole::class)],
-            'password' => $this->passwordRules(),
+            'reference_phone' => ['required', 'string', 'max:50'],
+            'account_role' => ['required', Rule::in([UserRole::Mai->value, UserRole::Ngo->value])],
             'terms' => ['accepted'],
             'locale' => ['nullable', 'string', Rule::in(config('cpc.supported_locales', ['ro', 'en']))],
         ])->validate();
 
-        return User::create([
+        $user = User::query()->create([
             'name' => $input['name'],
             'email' => $input['email'],
-            'password' => $input['password'],
+            'password' => Str::password(32),
             'organization' => $input['organization'],
-            'professional_role' => $input['professional_role'],
-            'role' => UserRole::Professional,
+            'reference_phone' => $input['reference_phone'],
+            'professional_role' => null,
+            'role' => $input['account_role'],
+            'approval_status' => AccountApprovalStatus::Pending,
             'verified_at' => null,
             'locale' => $input['locale'] ?? session('locale', config('cpc.default_locale', 'ro')),
         ]);
+
+        Notification::send(
+            User::query()->where('role', UserRole::Admin)->get(),
+            new AccountRequested($user),
+        );
+
+        return $user;
     }
 }

app/Console/Commands/ExpireAccounts.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Enums\UserRole;
+use App\Models\User;
+use App\Notifications\AccountRenewal;
+use Illuminate\Console\Attributes\Description;
+use Illuminate\Console\Attributes\Signature;
+use Illuminate\Console\Command;
+
+#[Signature('accounts:expire')]
+#[Description('Notify expired organization accounts and delete those that were not renewed')]
+class ExpireAccounts extends Command
+{
+    public function handle(): int
+    {
+        User::query()
+            ->whereIn('role', [UserRole::Mai, UserRole::Ngo])
+            ->whereNotNull('expires_at')
+            ->where('expires_at', '<=', now())
+            ->whereNull('renewal_notified_at')
+            ->each(function (User $user): void {
+                $user->notify(new AccountRenewal);
+                $user->update(['renewal_notified_at' => now()]);
+            });
+
+        User::query()
+            ->whereIn('role', [UserRole::Mai, UserRole::Ngo])
+            ->whereNotNull('expires_at')
+            ->where('expires_at', '<=', now()->subMonth())
+            ->delete();
+
+        return self::SUCCESS;
+    }
+}

app/Enums/AccountApprovalStatus.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Enums;
+
+enum AccountApprovalStatus: string
+{
+    case Pending = 'pending';
+    case Approved = 'approved';
+    case Rejected = 'rejected';
+
+    public function label(): string
+    {
+        return __('enums.account_approval_status.'.$this->value);
+    }
+}

app/Enums/ResourceAccess.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Enums;
+
+enum ResourceAccess: string
+{
+    case Public = 'public';
+    case Ngo = 'ngo';
+    case Mai = 'mai';
+
+    public function label(): string
+    {
+        return __('enums.resource_access.'.$this->value);
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    public static function options(): array
+    {
+        return collect(self::cases())
+            ->mapWithKeys(fn (self $access): array => [$access->value => $access->label()])
+            ->all();
+    }
+}

app/Enums/UserRole.php

@@ -7,6 +7,8 @@ enum UserRole: string
     case Admin = 'admin';
     case Editor = 'editor';
     case Professional = 'professional';
+    case Mai = 'mai';
+    case Ngo = 'ngo';
 
     public function label(): string
     {
@@ -18,8 +20,7 @@ public function label(): string
      */
     public static function options(): array
     {
-        return collect(self::cases())
-            ->reject(fn (self $role): bool => $role === self::Professional)
+        return collect([self::Admin, self::Editor])
             ->mapWithKeys(fn (self $role): array => [$role->value => $role->label()])
             ->all();
     }

app/Filament/Resources/AccountRequests/AccountRequestResource.php

@@ -0,0 +1,56 @@
+<?php
+
+namespace App\Filament\Resources\AccountRequests;
+
+use App\Enums\AccountApprovalStatus;
+use App\Filament\Concerns\HasTranslatedLabels;
+use App\Filament\Resources\AccountRequests\Pages\ListAccountRequests;
+use App\Filament\Resources\AccountRequests\Tables\AccountRequestsTable;
+use App\Models\User;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use UnitEnum;
+
+class AccountRequestResource extends Resource
+{
+    use HasTranslatedLabels;
+
+    protected static ?string $model = User::class;
+
+    protected static ?string $slug = 'account-requests';
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedUserPlus;
+
+    protected static string|UnitEnum|null $navigationGroup = 'Moderation';
+
+    public static function form(Schema $schema): Schema
+    {
+        return $schema->components([]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return AccountRequestsTable::configure($table);
+    }
+
+    public static function getEloquentQuery(): Builder
+    {
+        return parent::getEloquentQuery()->where('approval_status', AccountApprovalStatus::Pending);
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListAccountRequests::route('/'),
+        ];
+    }
+
+    protected static function translationKey(): string
+    {
+        return 'account_requests';
+    }
+}

app/Filament/Resources/AccountRequests/Pages/ListAccountRequests.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Filament\Resources\AccountRequests\Pages;
+
+use App\Filament\Resources\AccountRequests\AccountRequestResource;
+use Filament\Resources\Pages\ListRecords;
+
+class ListAccountRequests extends ListRecords
+{
+    protected static string $resource = AccountRequestResource::class;
+}

app/Filament/Resources/AccountRequests/Tables/AccountRequestsTable.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Filament\Resources\AccountRequests\Tables;
+
+use App\Actions\ApproveAccountRequest;
+use App\Enums\UserRole;
+use App\Models\User;
+use Filament\Actions\Action;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+
+class AccountRequestsTable
+{
+    public static function configure(Table $table): Table
+    {
+        return $table
+            ->columns([
+                TextColumn::make('name')->searchable(),
+                TextColumn::make('email')->searchable(),
+                TextColumn::make('organization')->searchable(),
+                TextColumn::make('reference_phone'),
+                TextColumn::make('role')
+                    ->formatStateUsing(function (UserRole|string $state): string {
+                        $role = $state instanceof UserRole ? $state : UserRole::from($state);
+
+                        return $role->label();
+                    }),
+                TextColumn::make('created_at')->dateTime()->sortable(),
+            ])
+            ->recordActions([
+                Action::make('approve')
+                    ->label(__('admin.fields.approve'))
+                    ->action(fn (User $record) => app(ApproveAccountRequest::class)->approve($record)),
+                Action::make('reject')
+                    ->label(__('admin.fields.reject'))
+                    ->color('danger')
+                    ->action(fn (User $record) => app(ApproveAccountRequest::class)->reject($record)),
+            ])
+            ->defaultSort('created_at', 'desc');
+    }
+}

app/Filament/Resources/Resources/Schemas/ResourceForm.php

@@ -2,6 +2,7 @@
 
 namespace App\Filament\Resources\Resources\Schemas;
 
+use App\Enums\ResourceAccess;
 use App\Enums\ResourceStatus;
 use App\Enums\ResourceType;
 use Filament\Forms\Components\DateTimePicker;
@@ -41,6 +42,12 @@ public static function configure(Schema $schema): Schema
                 Select::make('type')
                     ->options(ResourceType::options())
                     ->required(),
+                Select::make('access_levels')
+                    ->label(__('admin.fields.access_levels'))
+                    ->options(ResourceAccess::options())
+                    ->multiple()
+                    ->required()
+                    ->default([ResourceAccess::Public->value]),
                 Select::make('resource_category_id')
                     ->relationship('resourceCategory', 'name_ro')
                     ->searchable()

app/Http/Controllers/AccountAccessController.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\User;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\View\View;
+
+class AccountAccessController extends Controller
+{
+    public function showPasswordForm(Request $request, string $locale, User $user): View
+    {
+        return view('account.password', [
+            'user' => $user,
+        ]);
+    }
+
+    public function storePassword(Request $request, string $locale, User $user): RedirectResponse
+    {
+        $validated = $request->validate([
+            'password' => ['required', 'string', 'min:8', 'confirmed'],
+        ]);
+
+        $user->update([
+            'password' => $validated['password'],
+        ]);
+
+        Auth::login($user);
+
+        return redirect(localized_route('account.index', [], $user->locale));
+    }
+
+    public function renew(Request $request, string $locale, User $user): RedirectResponse
+    {
+        $user->update([
+            'expires_at' => now()->addYear(),
+            'renewal_notified_at' => null,
+        ]);
+
+        return redirect(localized_route('home', [], $user->locale))
+            ->with('status', __('auth.renewed'));
+    }
+}

app/Http/Responses/LoginResponse.php

@@ -19,6 +19,10 @@ public function toResponse($request): Response
             ?? session('locale')
             ?? config('cpc.default_locale', 'ro');
 
+        if ($user?->isApprovedOrganizationAccount()) {
+            return redirect()->intended(localized_route('account.index', [], $locale));
+        }
+
         if ($user?->isProfessional() && $user->verified_at === null) {
             return redirect()->intended(localized_route('auth.pending', [], $locale));
         }