daily-meal-api/app/Http/Controllers/AuthController.php

<?php

namespace App\Http\Controllers;

use App\Actions\RevokeSocialAuthorizations;
use App\Http\Requests\EmailVerificationNotificationRequest;
use App\Http\Requests\ForgotPasswordRequest;
use App\Http\Requests\LoginRequest;
use App\Http\Requests\RegisterRequest;
use App\Http\Requests\ResetPasswordRequest;
use App\Http\Requests\UpdatePasswordRequest;
use App\Http\Requests\UpdateUserRequest;
use App\Http\Resources\UserResource;
use App\Models\User;
use App\Services\RevenueCatService;
use Illuminate\Auth\Events\PasswordReset;
use Illuminate\Auth\Events\Verified;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Http\Resources\Json\JsonResource;
use Illuminate\Support\Arr;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Password;
use Illuminate\Support\Facades\Storage;
use Illuminate\Support\Str;
use Illuminate\Support\ValidatedInput;
use Illuminate\View\View;
use Laravel\Sanctum\PersonalAccessToken;
use Throwable;

class AuthController extends Controller
{
    public function register(RegisterRequest $request): JsonResponse
    {
        $user = $this->createRegisteredUser($request);

        if ($user instanceof JsonResponse) {
            return $user;
        }

        $this->startWebSession($request, $user);

        return response()->json([
            'code' => 'REGISTERED_UNVERIFIED',
            'user' => new UserResource($user),
        ], 201);
    }

    public function login(LoginRequest $request): JsonResponse
    {
        $data = $request->validated();
        $user = $this->getLoginUser($data);

        if ($user instanceof JsonResponse) {
            return $user;
        }

        $this->startWebSession($request, $user);

        return response()->json([
            'user' => new UserResource($user),
        ]);
    }

    public function mobileRegister(RegisterRequest $request): JsonResponse
    {
        $user = $this->createRegisteredUser($request);

        if ($user instanceof JsonResponse) {
            return $user;
        }

        return response()->json([
            'code' => 'REGISTERED_UNVERIFIED',
            'token' => $this->createMobileToken($user, $request->validated('device_name')),
            'user' => new UserResource($user),
        ], 201);
    }

    public function mobileLogin(LoginRequest $request): JsonResponse
    {
        $data = $request->validated();
        $user = $this->getLoginUser($data);

        if ($user instanceof JsonResponse) {
            return $user;
        }

        return response()->json([
            'token' => $this->createMobileToken($user, $data['device_name'] ?? null),
            'user' => new UserResource($user),
        ]);
    }

    public function verifyEmail(Request $request, string $id, string $hash): JsonResponse|View
    {
        $user = User::findOrFail($id);

        if (! hash_equals($hash, sha1($user->getEmailForVerification()))) {
            if ($request->expectsJson()) {
                return response()->json([
                    'code' => 'INVALID_VERIFICATION_LINK',
                ], 403);
            }

            abort(403, __('api.auth.invalid_verification_link'));
        }

        $alreadyVerified = $user->hasVerifiedEmail();

        if (! $alreadyVerified) {
            $user->markEmailAsVerified();

            event(new Verified($user));
        }

        if ($request->expectsJson()) {
            return response()->json([
                'code' => $alreadyVerified
                    ? 'EMAIL_ALREADY_VERIFIED'
                    : 'EMAIL_VERIFIED',
                'user' => new UserResource($user->fresh()),
            ]);
        }

        return view('auth.email-verified', [
            'alreadyVerified' => $alreadyVerified,
            'appName' => config('app.name'),
        ]);
    }

    public function sendVerificationEmail(EmailVerificationNotificationRequest $request): JsonResponse
    {
        $email = strtolower($request->validated('email'));
        $user = User::where('email', $email)->first();

        if ($user && ! $user->hasVerifiedEmail()) {
            $user->sendEmailVerificationNotification();
        }

        return response()->json([
            'code' => 'VERIFICATION_EMAIL_SENT_IF_UNVERIFIED',
        ]);
    }

    public function forgotPassword(ForgotPasswordRequest $request): JsonResponse
    {
        $email = strtolower($request->validated('email'));
        $status = Password::sendResetLink(['email' => $email]);

        if ($status === Password::RESET_THROTTLED) {
            return response()->json([
                'code' => 'PASSWORD_RESET_THROTTLED',
            ], 429);
        }

        return response()->json([
            'code' => 'PASSWORD_RESET_LINK_SENT',
        ]);
    }

    public function resetPassword(ResetPasswordRequest $request): JsonResponse
    {
        $status = $this->resetPasswordFor($request->safe());

        if ($status !== Password::PASSWORD_RESET) {
            return response()->json([
                'code' => 'PASSWORD_RESET_FAILED',
            ], 422);
        }

        return response()->json([
            'code' => 'PASSWORD_RESET',
        ]);
    }

    public function showResetPasswordForm(Request $request, string $token): View
    {
        $email = (string) $request->query('email', '');
        $locale = $this->localeForEmail($email);

        return view('auth.reset-password', [
            'appName' => config('app.name'),
            'email' => $email,
            'locale' => $locale,
            'passwordReset' => false,
            'token' => $token,
        ]);
    }

    public function resetPasswordFromView(ResetPasswordRequest $request): RedirectResponse|View
    {
        $locale = $this->localeForEmail((string) $request->validated('email'));
        app()->setLocale($locale);

        $status = $this->resetPasswordFor($request->safe());

        if ($status !== Password::PASSWORD_RESET) {
            return back()
                ->withInput($request->only('email'))
                ->withErrors(['email' => __($status)]);
        }

        return view('auth.reset-password', [
            'appName' => config('app.name'),
            'email' => strtolower($request->validated('email')),
            'locale' => $locale,
            'passwordReset' => true,
            'token' => '',
        ]);
    }

    public function logout(): JsonResponse
    {
        $request = request();
        $accessToken = $request->user()?->currentAccessToken();

        if ($accessToken instanceof PersonalAccessToken) {
            $accessToken->delete();
        }

        if ($request->hasSession()) {
            Auth::guard('web')->logout();
            $request->session()->invalidate();
            $request->session()->regenerateToken();
        }

        return response()->json([
            'code' => 'LOGGED_OUT',
        ]);
    }

    public function me(): JsonResource|JsonResponse
    {
        $user = auth()->user();

        if (! $user) {
            return response()->json(['code' => 'UNAUTHENTICATED'], 401);
        }

        return new UserResource($user);
    }

    public function update(UpdateUserRequest $request): JsonResource
    {
        $user = $request->user();

        abort_if($user->isSuspended(), 403, 'ACCOUNT_SUSPENDED');

        $data = $request->validated();

        if ($request->hasFile('avatar')) {
            if ($user->avatar_url) {
                Storage::disk()->delete($user->avatar_url);
            }

            $path = $request->file('avatar')->store('avatars');
            $data['avatar_url'] = $path;
        }

        $userAttributes = $this->userAttributesFromRequestData($data);

        if (! empty($userAttributes)) {
            $user->update($userAttributes);
        }

        return new UserResource($user->fresh());
    }

    public function updatePassword(UpdatePasswordRequest $request): JsonResponse
    {
        $user = $request->user();

        abort_if($user->isSuspended(), 403, 'ACCOUNT_SUSPENDED');

        $currentAccessToken = $user->currentAccessToken();

        $user->forceFill([
            'password' => Hash::make($request->validated('password')),
            'remember_token' => Str::random(60),
        ])->save();

        if ($currentAccessToken instanceof PersonalAccessToken) {
            $user->tokens()
                ->whereKeyNot($currentAccessToken->getKey())
                ->delete();
        } else {
            $user->tokens()->delete();
        }

        return response()->json([
            'code' => 'PASSWORD_UPDATED',
        ]);
    }

    public function destroy(
        Request $request,
        RevenueCatService $revenueCat,
        RevokeSocialAuthorizations $revokeSocialAuthorizations,
    ): JsonResponse {
        $user = $request->user();
        $identityVerificationRequest = $user->identityVerificationRequest()->first();
        $storagePaths = collect([$user->avatar_url])
            ->merge($user->mealPosts()->withTrashed()->pluck('image_url'))
            ->filter(fn (?string $path): bool => $this->isPublicStoragePath($path))
            ->values()
            ->all();

        $revokeSocialAuthorizations->execute($user);

        try {
            $revenueCat->deleteCustomer($user);
        } catch (Throwable $exception) {
            report($exception);
        }

        DB::transaction(function () use ($user): void {
            $user->tokens()->delete();
            $user->notifications()->delete();

            DB::table('sessions')
                ->where('user_id', $user->getKey())
                ->delete();

            DB::table('password_reset_tokens')
                ->where('email', $user->email)
                ->delete();

            $user->forceDelete();
        });

        if (! empty($storagePaths)) {
            Storage::disk()->delete($storagePaths);
        }

        if ($identityVerificationRequest?->hasDocument()) {
            Storage::disk($identityVerificationRequest->document_disk)
                ->delete($identityVerificationRequest->document_path);
        }

        if ($request->hasSession()) {
            Auth::guard('web')->logout();
            $request->session()->invalidate();
            $request->session()->regenerateToken();
        }

        return response()->json([
            'code' => 'ACCOUNT_DELETED',
        ]);
    }

    private function createRegisteredUser(RegisterRequest $request): User|JsonResponse
    {
        $data = $request->validated();

        $avatarPath = null;
        if ($request->hasFile('avatar')) {
            $avatarPath = $request->file('avatar')->store('avatars');
        }

        $userAttributes = $this->userAttributesFromRequestData($data);
        $userAttributes['email'] = strtolower($data['email']);
        $userAttributes['password'] = Hash::make($data['password']);
        $userAttributes['avatar_url'] = $avatarPath;
        $userAttributes['terms_accepted_at'] = now();
        $user = User::create($userAttributes);

        try {
            $user->sendEmailVerificationNotification();
        } catch (Throwable $exception) {
            report($exception);

            $user->forceDelete();

            if ($avatarPath !== null) {
                Storage::disk()->delete($avatarPath);
            }

            return response()->json([
                'code' => 'VERIFICATION_EMAIL_FAILED',
            ], 503);
        }

        return $user;
    }

    /**
     * @param  array<string, mixed>  $data
     */
    private function getLoginUser(array $data): User|JsonResponse
    {
        $user = User::where('email', strtolower((string) $data['email']))->first();

        if (! $user || ! is_string($user->password) || ! Hash::check((string) $data['password'], $user->password)) {
            return response()->json([
                'code' => 'INVALID_CREDENTIALS',
            ], 401);
        }

        if ($user->isSuspended()) {
            return response()->json([
                'code' => 'ACCOUNT_SUSPENDED',
            ], 403);
        }

        if (isset($data['locale']) && $user->locale !== $data['locale']) {
            $user->forceFill(['locale' => $data['locale']])->save();
        }

        if (! $user->hasVerifiedEmail()) {
            return response()->json([
                'code' => 'EMAIL_NOT_VERIFIED',
            ], 403);
        }

        return $user;
    }

    private function startWebSession(Request $request, User $user): void
    {
        if (! $request->hasSession()) {
            return;
        }

        Auth::login($user);
        $request->session()->regenerate();
    }

    private function createMobileToken(User $user, mixed $deviceName): string
    {
        $tokenName = is_string($deviceName) && trim($deviceName) !== ''
            ? trim($deviceName)
            : 'mobile';

        return $user->createToken($tokenName)->plainTextToken;
    }

    private function isPublicStoragePath(?string $path): bool
    {
        return filled($path) && ! Str::startsWith($path, ['http://', 'https://']);
    }

    private function resetPasswordFor(ValidatedInput $data): string
    {
        $credentials = $data->all();
        $credentials['email'] = strtolower($credentials['email']);

        return Password::reset(
            $credentials,
            function (User $user, string $password): void {
                $user->forceFill([
                    'password' => Hash::make($password),
                    'remember_token' => Str::random(60),
                ])->save();

                $user->tokens()->delete();

                event(new PasswordReset($user));
            }
        );
    }

    private function localeForEmail(string $email): string
    {
        return User::where('email', strtolower($email))->value('locale') ?: 'en';
    }

    /**
     * @param  array<string, mixed>  $data
     * @return array<string, mixed>
     */
    private function userAttributesFromRequestData(array $data): array
    {
        $attributes = Arr::only($data, [
            'name',
            'avatar_url',
            'locale',
            'bio',
        ]);

        return $attributes;
    }
}