fix: make project template inheritance granular and safe

app/Http/Requests/ResetProjectTemplateRequest.php

@@ -2,10 +2,13 @@
 
 namespace App\Http\Requests;
 
+use App\Actions\Projects\DuplicateProjectConfiguration;
 use App\Models\Project;
 use Illuminate\Contracts\Validation\ValidationRule;
 use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Support\Arr;
 use Illuminate\Validation\Rule;
+use Illuminate\Validation\Validator;
 
 class ResetProjectTemplateRequest extends FormRequest
 {
@@ -23,11 +26,71 @@ class ResetProjectTemplateRequest extends FormRequest
         $project = $this->route('project');
 
         return [
+            'areas' => ['sometimes', 'array', 'min:1'],
+            'areas.*' => ['required', 'string', Rule::in(DuplicateProjectConfiguration::copyableAreas())],
             'confirmation_key' => [
-                'required',
+                'required_without:areas',
                 'string',
                 Rule::in([$project->key]),
             ],
+            'status_replacements' => ['sometimes', 'array'],
+            'status_replacements.*' => [
+                'required',
+                'integer',
+                Rule::exists('ticket_statuses', 'id')->where('project_id', $project->id),
+            ],
+        ];
+    }
+
+    /** @return array<int, callable(Validator): void> */
+    public function after(): array
+    {
+        return [
+            function (Validator $validator): void {
+                if ($validator->errors()->isNotEmpty()) {
+                    return;
+                }
+
+                /** @var Project $project */
+                $project = $this->route('project');
+                $validated = $validator->validated();
+                $areas = array_values(Arr::get(
+                    $validated,
+                    'areas',
+                    DuplicateProjectConfiguration::copyableAreas(),
+                ));
+
+                if (! in_array(DuplicateProjectConfiguration::COPY_TICKET_STATUSES, $areas, true)) {
+                    return;
+                }
+
+                $project->loadMissing('projectTemplate');
+                $configuration = app(DuplicateProjectConfiguration::class)->normalizeConfiguration(
+                    $project->projectTemplate?->configuration_snapshot ?? [],
+                );
+                $templateStatuses = Arr::get(
+                    $configuration,
+                    DuplicateProjectConfiguration::COPY_TICKET_STATUSES,
+                    [],
+                );
+                $statuses = $project->ticketStatuses()->withCount('tickets')->get()->values();
+                $allowedReplacementIds = $statuses->take(count($templateStatuses))->pluck('id');
+                $replacements = Arr::get($validated, 'status_replacements', []);
+
+                foreach ($statuses->slice(count($templateStatuses)) as $status) {
+                    if ($status->tickets_count === 0) {
+                        continue;
+                    }
+
+                    $replacementId = (int) Arr::get($replacements, (string) $status->id, 0);
+                    if (! $allowedReplacementIds->contains($replacementId)) {
+                        $validator->errors()->add(
+                            "status_replacements.{$status->id}",
+                            "Choose a replacement status for {$status->name}.",
+                        );
+                    }
+                }
+            },
         ];
     }
 
@@ -38,6 +101,7 @@ class ResetProjectTemplateRequest extends FormRequest
     {
         return [
             'confirmation_key.in' => 'Enter the exact project key to reset this project to its template baseline.',
+            'areas.*.in' => 'Choose a valid template area to reset.',
         ];
     }
 }