ldc-agis/app/Models/User.php

<?php

namespace App\Models;

use App\Enums\Users\RoleEnum;
use App\Traits\Models\ActivityLog;
use Illuminate\Auth\Access\AuthorizationException;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;

/**
 * @property string                          $first_name   Firstname.
 * @property string                          $last_name    Lastname.
 * @property string                          $email        Email.
 * @property \App\Enums\Users\RoleEnum       $role         Role.
 * @property \Illuminate\Support\Carbon      $published    Publication status.
 * @property \Illuminate\Support\Carbon      $published_at Publication status update date.
 * @property-read \Illuminate\Support\Carbon $created_at   Created date.
 * @property-read \Illuminate\Support\Carbon $updated_at   Updated date.
 *
 * @property-read \App\Models\ActivityLog $activityLogs Activities logs One-to-many relationship.
 */
class User extends Authenticatable
{
    use ActivityLog;
    use HasFactory;
    use Notifiable;

    /**
     * The attributes that are mass assignable.
     *
     * @var array<int, string>
     */
    protected $fillable = [
        'first_name',
        'last_name',
        'email',
        'role',
        'published',
        'published_at',
    ];

    /**
     * The attributes that should be hidden for serialization.
     *
     * @var array<int, string>
     */
    protected $hidden = [
        'remember_token',
    ];

    /**
     * The attributes that should be cast.
     *
     * @var array<string, string>
     */
    protected $casts = [
        'role'             => RoleEnum::class,
        'last_connection'  => 'date',
        'published'        => 'boolean',
    ];

    /**
     * Perform any actions required after the model boots.
     *
     * @return void
     */
    protected static function booted(): void
    {
        static::creating(function (self $model) {
            // * Prevent user elevation privileges
            throw_if(
                auth('backend')->user() and auth('backend')->user()->role->value() > $model->role->value(),
                AuthorizationException::class
            );
        });
        static::updating(function (self $model) {
            if (optional(auth('backend')->user())->getKey() === $model->getKey()) {
                \validator(
                    ['published' => $model->published],
                    ['published' => 'required|boolean|accepted'],
                    ['published.accepted' => trans('Vous ne pouvez pas déactiver votre propre compte')],
                )->validate();
            }
            // * Prevent user elevation privileges
            throw_if(
                auth('backend')->user() and auth('backend')->user()->role->value() > $model->role->value(),
                AuthorizationException::class
            );
        });
    }
}