feat: multi-tenant architecture and tenant isolation changes

app/Http/Middleware/EnsureTenantModuleEnabled.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use App\Models\CentralTenantModule;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureTenantModuleEnabled
+{
+    /**
+     * Handle an incoming request for a tenant route.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     * @param  string  $moduleKey
+     */
+    public function handle(Request $request, Closure $next, string $moduleKey): Response
+    {
+        $tenantId = null;
+
+        if (function_exists('tenant') && tenant()) {
+            $tenantId = tenant('id');
+        } elseif ($request->header('X-Tenant')) {
+            $tenantId = $request->header('X-Tenant');
+        }
+
+        if ($tenantId) {
+            $isModuleEnabled = CentralTenantModule::where('tenant_id', $tenantId)
+                ->where('module_key', $moduleKey)
+                ->where('enabled', true)
+                ->exists();
+
+            // If central tenant_modules table is empty for this tenant, default to allowing or fallback
+            $hasAnyModulesConfigured = CentralTenantModule::where('tenant_id', $tenantId)->exists();
+
+            if ($hasAnyModulesConfigured && !$isModuleEnabled) {
+                if ($request->wantsJson() || $request->is('api/*')) {
+                    return response()->json([
+                        'success' => false,
+                        'message' => "The '{$moduleKey}' module is not enabled for your company subscription.",
+                    ], 403);
+                }
+
+                abort(403, "The '{$moduleKey}' module is not enabled for your company subscription.");
+            }
+        }
+
+        return $next($request);
+    }
+}