device-management/app/Http/Controllers/Administration/UserController.php

<?php

namespace App\Http\Controllers\Administration;

use App\Enums\SystemRole;
use App\Http\Controllers\Controller;
use App\Http\Requests\Administration\ResetUserPasswordRequest;
use App\Http\Requests\Administration\StoreUserRequest;
use App\Http\Requests\Administration\UpdateUserRequest;
use App\Models\Tenant;
use App\Models\User;
use App\Services\LicenseEntitlementService;
use Illuminate\Http\RedirectResponse;
use Inertia\Inertia;
use Inertia\Response;

class UserController extends Controller
{
    public function index(Tenant $tenant): Response
    {
        abort_unless(request()->user()->can('user.view'), 403);

        $users = User::query()
            ->with('roles:id,name')
            ->when(! request()->user()->is_platform_admin, fn ($query) => $query->role(SystemRole::TenantUser->value))
            ->orderBy('name')
            ->paginate(15)
            ->withQueryString();

        return Inertia::render('administration/users/index', compact('tenant', 'users'));
    }

    public function create(Tenant $tenant): Response
    {
        abort_unless(request()->user()->can('user.create'), 403);

        return Inertia::render('administration/users/create', ['tenant' => $tenant, 'canManageRoles' => request()->user()->is_platform_admin]);
    }

    public function store(StoreUserRequest $request, Tenant $tenant): RedirectResponse
    {
        app(LicenseEntitlementService::class)->assertCanAddUser($tenant->id);
        $data = $request->validated();
        $user = User::create([
            'tenant_id' => $tenant->id,
            'name' => $data['name'],
            'email' => $data['email'],
            'password' => $data['password'],
            'is_active' => $data['is_active'] ?? true,
        ]);
        $user->forceFill(['email_verified_at' => now()])->save();
        $role = $request->user()->is_platform_admin ? ($data['role'] ?? SystemRole::TenantUser->value) : SystemRole::TenantUser->value;
        $user->assignRole($role);

        return to_route('administration.users.index', $tenant)->with('success', 'User berhasil dibuat.');
    }

    public function edit(Tenant $tenant, User $user): Response
    {
        $this->ensureManageableUser($tenant, $user);
        abort_unless(request()->user()->can('user.update'), 403);

        return Inertia::render('administration/users/edit', [
            'tenant' => $tenant,
            'managedUser' => $user->load('roles:id,name'),
            'canManageRoles' => request()->user()->is_platform_admin,
        ]);
    }

    public function update(UpdateUserRequest $request, Tenant $tenant, User $user): RedirectResponse
    {
        $this->ensureManageableUser($tenant, $user);
        $data = $request->validated();
        $user->update(['name' => $data['name'], 'email' => $data['email']]);
        if ($request->user()->is_platform_admin && isset($data['role'])) {
            $user->syncRoles([$data['role']]);
        }

        return back()->with('success', 'User berhasil diperbarui.');
    }

    public function resetPassword(ResetUserPasswordRequest $request, Tenant $tenant, User $user): RedirectResponse
    {
        $this->ensureManageableUser($tenant, $user);
        $user->update(['password' => $request->validated('password')]);
        $user->tokens()->delete();

        return back()->with('success', 'Password user berhasil direset dan token API dicabut.');
    }

    public function toggleActive(Tenant $tenant, User $user): RedirectResponse
    {
        $this->ensureManageableUser($tenant, $user);
        abort_unless(request()->user()->can('user.update'), 403);
        abort_if(request()->user()->is($user), 422, 'Anda tidak dapat menonaktifkan akun sendiri.');
        abort_if($user->is_active && $user->hasRole(SystemRole::TenantAdmin->value), 422, 'Akun Tenant Admin utama tidak dapat dinonaktifkan dari pengelolaan user tenant.');
        $user->update(['is_active' => ! $user->is_active]);
        $user->tokens()->delete();

        return back()->with('success', $user->is_active ? 'User diaktifkan.' : 'User dinonaktifkan.');
    }

    public function destroy(Tenant $tenant, User $user): RedirectResponse
    {
        $this->ensureManageableUser($tenant, $user);
        abort_unless(request()->user()->can('user.delete'), 403);
        abort_if(request()->user()->is($user), 422, 'Anda tidak dapat menghapus akun sendiri.');
        abort_if($user->hasRole(SystemRole::TenantAdmin->value), 422, 'Akun Tenant Admin utama tidak dapat dihapus dari pengelolaan user tenant.');
        $user->delete();

        return to_route('administration.users.index', $tenant)->with('success', 'User berhasil dihapus.');
    }

    private function ensureManageableUser(Tenant $tenant, User $user): void
    {
        abort_unless($user->tenant_id === $tenant->id && ! $user->is_platform_admin, 404);
        abort_if(
            ! request()->user()->is_platform_admin && ! $user->hasRole(SystemRole::TenantUser->value),
            403,
            'Tenant Admin hanya dapat mengelola Tenant User.',
        );
    }
}