Implement project memberships teams and permission model

app/Http/Controllers/ProjectController.php

@@ -2,19 +2,42 @@
 
 namespace App\Http\Controllers;
 
+use App\Actions\ProjectPermissions\ProjectPermissionService;
 use App\Http\Requests\StoreProjectRequest;
+use App\Http\Requests\SyncProjectPermissionsRequest;
 use App\Models\Project;
+use App\Models\Team;
+use App\Models\User;
 use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
 use Inertia\Inertia;
 use Inertia\Response;
 
 class ProjectController extends Controller
 {
-    public function index(): Response
+    public function __construct(
+        private readonly ProjectPermissionService $projectPermissionService,
+    ) {}
+
+    public function index(Request $request): Response
     {
+        $projectQuery = Project::query()
+            ->orderByDesc('id');
+
+        if (! $request->user()->is_admin) {
+            $viewableProjectIds = $this->projectPermissionService->viewableProjectIds($request->user());
+
+            if ($viewableProjectIds === []) {
+                return Inertia::render('projects/Index', [
+                    'projects' => [],
+                ]);
+            }
+
+            $projectQuery->whereIn('id', $viewableProjectIds);
+        }
+
         return Inertia::render('projects/Index', [
-            'projects' => Project::query()
-                ->orderByDesc('id')
+            'projects' => $projectQuery
                 ->get(),
         ]);
     }
@@ -27,14 +50,84 @@ class ProjectController extends Controller
     public function store(StoreProjectRequest $request): RedirectResponse
     {
         $project = Project::query()->create($request->validated());
+        $this->projectPermissionService->grantAllProjectPermissions($project, $request->user());
 
         return to_route('projects.show', $project);
     }
 
-    public function show(Project $project): Response
+    public function show(Request $request, Project $project): Response
     {
+        abort_unless(
+            $this->projectPermissionService->userCanViewProject($request->user(), $project),
+            403,
+        );
+
         return Inertia::render('projects/Show', [
+            'canManageAccess' => $this->projectPermissionService->userCanManageProjectAccess($request->user(), $project),
             'project' => $project,
         ]);
     }
+
+    public function access(Request $request, Project $project): Response
+    {
+        abort_unless(
+            $this->projectPermissionService->userCanManageProjectAccess($request->user(), $project),
+            403,
+        );
+
+        return Inertia::render('projects/Access', [
+            'directPermissions' => $this->projectPermissionService->userPermissionMap($project),
+            'permissionOptions' => $this->projectPermissionService->permissionOptions(),
+            'project' => $project,
+            'status' => session('status'),
+            'teamPermissions' => $this->projectPermissionService->teamPermissionMap($project),
+            'teams' => Team::query()
+                ->with('users')
+                ->orderBy('name')
+                ->get()
+                ->map(fn (Team $team): array => [
+                    'id' => $team->id,
+                    'name' => $team->name,
+                    'created_at' => $team->created_at?->toISOString(),
+                    'updated_at' => $team->updated_at?->toISOString(),
+                    'user_ids' => $team->users->modelKeys(),
+                    'users' => $team->users->values(),
+                ]),
+            'users' => User::query()
+                ->orderBy('name')
+                ->get(),
+        ]);
+    }
+
+    public function updateUserPermissions(
+        SyncProjectPermissionsRequest $request,
+        Project $project,
+        User $user,
+    ): RedirectResponse {
+        abort_unless(
+            $this->projectPermissionService->userCanManageProjectAccess($request->user(), $project),
+            403,
+        );
+
+        $this->projectPermissionService->syncUserPermissions($project, $user, $request->permissions());
+
+        return to_route('projects.access', $project)
+            ->with('status', "{$user->name} permissions were updated.");
+    }
+
+    public function updateTeamPermissions(
+        SyncProjectPermissionsRequest $request,
+        Project $project,
+        Team $team,
+    ): RedirectResponse {
+        abort_unless(
+            $this->projectPermissionService->userCanManageProjectAccess($request->user(), $project),
+            403,
+        );
+
+        $this->projectPermissionService->syncTeamPermissions($project, $team, $request->permissions());
+
+        return to_route('projects.access', $project)
+            ->with('status', "{$team->name} permissions were updated.");
+    }
 }