Initial commit device-management

app/Http/Controllers/RevealTenantBasePasswordController.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Enums\SystemRole;
+use App\Models\TenantDeviceSetting;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Validation\ValidationException;
+
+class RevealTenantBasePasswordController extends Controller
+{
+    public function __invoke(Request $request): JsonResponse
+    {
+        abort_unless($request->user()->hasRole(SystemRole::TenantAdmin->value), 403);
+        $data = $request->validate(['current_password' => ['required', 'string']]);
+        if (! Hash::check($data['current_password'], $request->user()->password)) {
+            throw ValidationException::withMessages(['current_password' => 'Password login tidak sesuai.']);
+        }
+
+        $setting = TenantDeviceSetting::where('tenant_id', $request->user()->tenant_id)->firstOrFail();
+        Log::notice('Tenant Admin revealed the base device password.', [
+            'tenant_id' => $request->user()->tenant_id,
+            'user_id' => $request->user()->id,
+        ]);
+
+        return response()->json(['password' => $setting->base_password])
+            ->header('Cache-Control', 'no-store, private')
+            ->header('Pragma', 'no-cache');
+    }
+}