GSB-Construction/Modules/ContractorManagement/app/Http/Controllers/ContractorOnboardingController.php

<?php

namespace Modules\ContractorManagement\Http\Controllers;

use App\Http\Controllers\Controller;
use App\Models\User;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Hash;
use Illuminate\Validation\Rules;
use Inertia\Inertia;
use Modules\ContractorManagement\Events\ContractorApproved;
use Modules\ContractorManagement\Events\ContractorOnboarded;
use Modules\ContractorManagement\Models\Contractor;
use Spatie\Permission\Models\Permission;
use Spatie\Permission\Models\Role;

class ContractorOnboardingController extends Controller
{
    /**
     * Show the contractor registration form.
     */
    public function showRegistrationForm()
    {
        return Inertia::render('ContractorManagement::Contractors/Register');
    }

    /**
     * Handle guest contractor onboarding registration.
     */
    public function register(Request $request)
    {
        $validated = $request->validate([
            // Contractor info
            'company_name' => 'required|string|max:255',
            'contact_person' => 'required|string|max:255',
            'email' => 'required|email|unique:contractors,email',
            'phone' => 'nullable|string|max:50',
            'specialization' => 'nullable|string|max:100',
            'address' => 'nullable|string',
            'tax_id' => 'nullable|string|max:50',
            'payment_terms' => 'required|in:net_15,net_30,net_60',

            // Admin User info
            'admin_name' => 'required|string|max:255',
            'admin_email' => 'required|email|unique:users,email',
            'password' => ['required', 'confirmed', Rules\Password::defaults()],
        ]);

        DB::transaction(function () use ($validated) {
            // 1. Create the contractor in 'pending' status
            $contractor = Contractor::create([
                'company_name' => $validated['company_name'],
                'contact_person' => $validated['contact_person'],
                'email' => $validated['email'],
                'phone' => $validated['phone'] ?? null,
                'specialization' => $validated['specialization'] ?? null,
                'address' => $validated['address'] ?? null,
                'tax_id' => $validated['tax_id'] ?? null,
                'payment_terms' => $validated['payment_terms'],
                'status' => 'pending',
                'type' => 'main', // Default to main if self-registered
            ]);

            // New contractor accounts are administrators for their own tenant.
            $role = Role::firstOrCreate(['name' => 'Main Contractor Admin']);
            $usersAccess = Permission::firstOrCreate([
                'name' => 'users.access',
                'guard_name' => 'web',
            ]);
            $role->givePermissionTo($usersAccess);

            // 2. Create the inactive admin user for this contractor
            $user = User::create([
                'name' => $validated['admin_name'],
                'email' => $validated['admin_email'],
                'password' => Hash::make($validated['password']),
                'user_type' => 'admin',
                'status' => 'inactive', // Inactive until approved
                'contractor_id' => $contractor->id,
            ]);

            $user->assignRole($role);

            event(new ContractorOnboarded($contractor));
        });

        return redirect()->route('login')->with('success', 'Your contractor registration has been submitted and is pending system approval.');
    }

    /**
     * List all pending contractor onboarding requests for Platform Owner review.
     */
    public function pending()
    {
        // Only Platform Owners (contractor_id === null) should access this
        if (auth()->user()->contractor_id !== null) {
            abort(403, 'Unauthorized access.');
        }

        // Fetch contractors in pending status
        $pendingContractors = Contractor::where('status', 'pending')
            ->withCount('users')
            ->latest()
            ->get();

        return Inertia::render('ContractorManagement::Contractors/Pending', [
            'contractors' => $pendingContractors,
        ]);
    }

    /**
     * Approve a pending contractor and activate their primary admin user.
     */
    public function approve(Contractor $contractor)
    {
        if (auth()->user()->contractor_id !== null) {
            abort(403, 'Unauthorized access.');
        }

        if ($contractor->status !== 'pending') {
            return back()->with('error', 'Only pending contractors can be approved.');
        }

        DB::transaction(function () use ($contractor) {
            // Update contractor status to active
            $contractor->update(['status' => 'active']);

            // Activate associated users
            User::where('contractor_id', $contractor->id)
                ->where('status', 'inactive')
                ->update(['status' => 'active']);

            event(new ContractorApproved($contractor));
        });

        return back()->with('success', "Contractor '{$contractor->company_name}' has been successfully approved.");
    }

    /**
     * Reject a pending contractor registration and delete the submission.
     */
    public function reject(Contractor $contractor)
    {
        if (auth()->user()->contractor_id !== null) {
            abort(403, 'Unauthorized access.');
        }

        if ($contractor->status !== 'pending') {
            return back()->with('error', 'Only pending contractors can be rejected.');
        }

        DB::transaction(function () use ($contractor) {
            // Delete all users belonging to this contractor
            User::where('contractor_id', $contractor->id)->delete();

            // Delete the contractor record
            $contractor->delete();
        });

        return back()->with('success', 'Contractor registration request has been rejected and deleted.');
    }
}