Fix team authorization, invite revocation, and slug handling

app/Http/Controllers/TeamController.php

@@ -8,63 +8,63 @@ use App\Http\Requests\UpdateTeamRequest;
 use App\Http\Resources\TeamInviteResource;
 use App\Http\Resources\TeamResource;
 use App\Models\Team;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Arr;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
 use Inertia\Inertia;
-use Str;
+use Inertia\Response;
 
 class TeamController extends Controller
 {
     /**
      * Display a listing of the resource.
      */
-    public function index(Request $request)
+    public function index(Request $request): Response
     {
         return Inertia::render('team/Index', [
-            'teams' => TeamResource::collection(Team::visibleTo(auth()->user())->get())->resolve($request),
+            'teams' => TeamResource::collection(Team::visibleTo($request->user())->with('members')->get())->resolve($request),
         ]);
     }
 
-    public function show(Request $request, Team $team)
+    public function show(Request $request, Team $team): Response
     {
-        $teamManager = auth()->user()->can('manage', $team);
+        $teamManager = $request->user()->can('manage', $team);
+        $team->load('members');
 
         return Inertia::render('team/Show', [
             'team' => TeamResource::make($team)->resolve($request),
             'canManageTeam' => $teamManager,
         ] + ($teamManager ? [
-            'teamInvites' => TeamInviteResource::collection($team->invites)->resolve($request),
+            'teamInvites' => TeamInviteResource::collection($team->invites()->with('invitedBy')->get())->resolve($request),
         ] : []));
     }
 
     /**
      * Store a newly created resource in storage.
      */
-    public function store(StoreTeamRequest $request)
+    public function store(StoreTeamRequest $request): RedirectResponse
     {
-        $validated = $request->validated();
-
         try {
-            DB::transaction(function () use ($validated) {
-                $team = Team::create($validated);
-                $team->members()->attach(
-                    request()->user()->id,
-                    ['role' => TeamMemberRole::Admin]
-                );
+            DB::transaction(function () use ($request): void {
+                $team = Team::create($request->validated());
+                $team->members()->attach($request->user(), ['role' => TeamMemberRole::Admin]);
             });
-            Inertia::flash('success', 'Team successfully created.');
-
-            return to_route('teams.index');
         } catch (\Exception $exception) {
+            report($exception);
             Inertia::flash('error', 'Team could not be created.');
-            DB::rollBack();
 
-            return back();
+            return back()->withInput();
         }
+
+        Inertia::flash('success', 'Team successfully created.');
+
+        return to_route('teams.index');
     }
 
-    public function create()
+    public function create(): Response
     {
         return Inertia::render('team/Create');
     }
@@ -72,7 +72,7 @@ class TeamController extends Controller
     /**
      * Show the form for editing the specified resource.
      */
-    public function edit(Request $request, Team $team)
+    public function edit(Request $request, Team $team): Response
     {
         return Inertia::render('team/Edit', [
             'team' => TeamResource::make($team)->resolve($request),
@@ -82,25 +82,23 @@ class TeamController extends Controller
     /**
      * Update the specified resource in storage.
      */
-    public function update(UpdateTeamRequest $request, Team $team)
+    public function update(UpdateTeamRequest $request, Team $team): RedirectResponse
     {
-        $validated = $request->validated();
-
         try {
-            DB::transaction(function () use ($validated, $team) {
-                $team->update($validated);
-            });
-            Inertia::flash('success', 'Team successfully updated.');
-
+            $team->update($request->validated());
         } catch (\Exception $exception) {
+            report($exception);
             Inertia::flash('error', 'Team could not be updated.');
-            DB::rollBack();
+
+            return back()->withInput();
         }
 
+        Inertia::flash('success', 'Team successfully updated.');
+
         return to_route('teams.show', $team);
     }
 
-    public function nameToSlug(Request $request)
+    public function nameToSlug(Request $request): JsonResponse
     {
         $validated = $request->validate([
             'name' => 'required|string|max:255',
@@ -114,7 +112,7 @@ class TeamController extends Controller
         return response()->json([
             'name' => $name,
             'slug' => $slug,
-            'taken' => $slug !== $ignoredSlug && Team::whereSlug($slug)->exists(),
+            'taken' => $slug === 'create' || ($slug !== $ignoredSlug && Team::whereSlug($slug)->exists()),
         ]);
     }
 
@@ -134,25 +132,25 @@ class TeamController extends Controller
         Inertia::flash('success', 'User invited to your team.');
     }
 
-    public function revokeInvite(Request $request, Team $team)
+    public function revokeInvite(Request $request, Team $team): RedirectResponse
     {
         $validated = $request->validate([
-            'email' => 'required|email|max:255|exists:team_invites,invited_email',
+            'email' => 'required|email|max:255',
         ]);
 
-        abort_unless(auth()->user()->can('manage', $team), 403);
-
-        $teamInvite = $team->invites()->whereInvitedEmail(Arr::get($validated, 'email'))->firstOrFail();
+        $teamInvite = $team->invites()->whereInvitedEmail($validated['email'])->firstOrFail();
 
         try {
-            DB::transaction(function () use ($teamInvite) {
-                $teamInvite->delete();
-            });
-            Inertia::flash('success', 'successfully deleted user invite.');
-        } catch (\Throwable $e) {
+            $teamInvite->delete();
+        } catch (\Exception $exception) {
+            report($exception);
             Inertia::flash('error', 'could not delete user invite.');
-            DB::rollBack();
+
+            return to_route('teams.show', $team);
         }
 
+        Inertia::flash('success', 'successfully deleted user invite.');
+
+        return to_route('teams.show', $team);
     }
 }