ldc-gen-game-web/app/Models/User.php

<?php

declare(strict_types=1);

namespace App\Models;

use App\Enums\Users\RoleEnum;
use App\Traits\Models\HasActivityLog;
use Illuminate\Auth\Access\AuthorizationException;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Relations\HasMany;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Illuminate\Support\Carbon;
use Illuminate\Support\Facades\Hash;

/**
 * @property string $first_name Prénom.
 * @property string $last_name Nom.
 * @property string $email Email.
 * @property string $password Mot de passe.
 * @property RoleEnum $role Rôle.
 * @property Carbon $published État de publication.
 * @property Carbon $published_at Date de mise à jour de l'état de publication.
 * @property-read Carbon $created_at Created date.
 * @property-read Carbon $updated_at Updated date.
 * @property-read \App\Models\ActivityLog $activityLogs Activities logs One-to-many relationship.
 */
class User extends Authenticatable
{
    use HasActivityLog;
    use HasFactory;
    use Notifiable;

    /**
     * The attributes that are mass assignable.
     *
     * @var list<string>
     */
    #[\Override]
    protected $fillable = [
        'first_name',
        'last_name',
        'email',
        'password',
        'role',
        'published',
        'published_at',
    ];

    /**
     * The attributes that should be hidden for serialization.
     *
     * @var list<string>
     */
    #[\Override]
    protected $hidden = [
        'password',
        'remember_token',
    ];

    /**
     * The attributes that should be cast.
     *
     * @var array<string, string>
     */
    #[\Override]
    protected $casts = [
        'role'              => RoleEnum::class,
        'email_verified_at' => 'datetime',
        'published'         => 'boolean',
    ];

    // * EVENTS

    /**
     * Perform any actions required after the model boots.
     */
    protected static function booted(): void
    {
        static::creating(function (self $model): void {
            self::updatePassword($model);
            // * Prevent user elevation privileges
            throw_if(
                auth('backend')->user() && auth('backend')->user()->role->value() > $model->role->value(),
                AuthorizationException::class
            );
        });
        static::updating(function (self $model): void {
            self::updatePassword($model);
            if (auth('backend')->user()?->getKey() === $model->getKey()) {
                \validator(
                    ['published' => $model->published],
                    ['published' => 'required|boolean|accepted'],
                    ['published.accepted' => trans('Vous ne pouvez pas déactiver votre propre compte')],
                )->validate();
            }
            // * Prevent user elevation privileges
            throw_if(
                auth('backend')->user() && auth('backend')->user()->role->value() > $model->role->value(),
                AuthorizationException::class
            );
        });
    }

    // * METHODS

    /**
     * Update password.
     */
    private static function updatePassword(self $model): void
    {
        if (Hash::needsRehash($model->password)) {
            $model->password = Hash::make($model->password);
        }
    }

    // * RELATIONS
    /**
     * Activities logs One-to-many relationship.
     *
     * @return HasMany<ActivityLog, $this>
     */
    public function activityLogs(): HasMany
    {
        return $this->hasMany(ActivityLog::class);
    }
}