portal-api/app/Http/Controllers/Api/Admin/Employee/EmployeeController.php

<?php

namespace App\Http\Controllers\Api\Admin\Employee;

use App\Http\Controllers\Controller;
use App\Http\Requests\EmployeeRequest;
use App\Repositories\Employee\EmployeeRepositoryInterface;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Hash;
use Spatie\Permission\Models\Role;

class EmployeeController extends Controller
{
    public function __construct(
        private readonly EmployeeRepositoryInterface $employeeRepository
    ) {}

    public function index(Request $request): JsonResponse
    {
        $employees = $this->employeeRepository->filter($request->all());

        return response()->json([
            'error' => false,
            'data'  => $employees,
        ]);
    }

    public function store(EmployeeRequest $request): JsonResponse
    {
        $request->validated();

        try {
            DB::beginTransaction();

            $employee = $this->employeeRepository->create([
                'fullname'  => $request->fullname,
                'username'  => $request->username,
                'email'     => $request->email,
                'phone'     => $request->phone,
                'birthday'  => $request->birthday,
                'address'   => $request->address,
                'password'  => Hash::make($request->password),
            ]);

            $employee->syncRoles([$request->role]);

            DB::commit();

            return response()->json([
                'error'   => false,
                'message' => 'Employee created successfully',
                'data'    => $employee->load('roles'),
            ], 201);
        } catch (\Exception $e) {
            DB::rollBack();
            return response()->json([
                'error'   => true,
                'message' => $e->getMessage(),
            ], 500);
        }
    }

    public function show(int $id): JsonResponse
    {
        $employee = $this->employeeRepository->find($id);

        if (!$employee) {
            return response()->json([
                'error'   => true,
                'message' => "Can't find employee by ID #" . $id,
            ], 404);
        }

        return response()->json([
            'error' => false,
            'data'  => $employee->load('roles'),
        ]);
    }

    public function update(int $id, EmployeeRequest $request): JsonResponse
    {
        $employee = $this->employeeRepository->find($id);

        if (!$employee) {
            return response()->json([
                'error'   => true,
                'message' => "Can't find employee by ID #" . $id,
            ], 404);
        }

        $request->validated();

        $guardError = $this->guardEmployeeMutation($employee, $request->role);
        if ($guardError) {
            return $guardError;
        }

        try {
            DB::beginTransaction();

            $data = [
                'fullname'  => $request->fullname,
                'username'  => $request->username,
                'email'     => $request->email,
                'phone'     => $request->phone,
                'birthday'  => $request->birthday,
                'address'   => $request->address,
            ];

            if ($request->filled('password')) {
                $data['password'] = Hash::make($request->password);
            }

            $this->employeeRepository->update($id, $data);
            $employee->syncRoles([$request->role]);

            DB::commit();

            return response()->json([
                'error'   => false,
                'message' => 'Employee updated successfully',
                'data'    => $this->employeeRepository->find($id)->load('roles'),
            ]);
        } catch (\Exception $e) {
            DB::rollBack();
            return response()->json([
                'error'   => true,
                'message' => $e->getMessage(),
            ], 500);
        }
    }

    public function destroy(int $id): JsonResponse
    {
        $employee = $this->employeeRepository->find($id);

        if (!$employee) {
            return response()->json([
                'error'   => true,
                'message' => "Can't find employee by ID #" . $id,
            ], 404);
        }

        $currentUser = auth('admin')->user();
        if ($employee->hasRole('Full Administrator') && !$currentUser->hasRole('Full Administrator')) {
            return response()->json([
                'error'   => true,
                'message' => 'Bạn không có quyền xoá tài khoản Full Administrator.',
            ], 403);
        }

        try {
            DB::beginTransaction();
            $this->employeeRepository->delete($id);
            DB::commit();

            return response()->json([
                'error'   => false,
                'message' => 'Employee deleted successfully',
            ]);
        } catch (\Exception $e) {
            DB::rollBack();
            return response()->json([
                'error'   => true,
                'message' => $e->getMessage(),
            ], 500);
        }
    }

    private function guardEmployeeMutation($employee, string $requestedRole): ?JsonResponse
    {
        $currentUser = auth('admin')->user();

        if ($employee->hasRole('Full Administrator') && !$currentUser->hasRole('Full Administrator')) {
            return response()->json([
                'error'   => true,
                'message' => 'Bạn không có quyền sửa tài khoản Full Administrator.',
            ], 403);
        }

        if ($employee->id === $currentUser->id && !$currentUser->hasRole($requestedRole)) {
            return response()->json([
                'error'   => true,
                'message' => 'Bạn không thể tự đổi vai trò của chính mình.',
            ], 403);
        }

        if (in_array($requestedRole, ['Administrator', 'Full Administrator'], true) && !$currentUser->hasRole('Full Administrator')) {
            return response()->json([
                'error'   => true,
                'message' => 'Chỉ Full Administrator mới có quyền gán vai trò này.',
            ], 403);
        }

        return null;
    }

    public function roles(): JsonResponse
    {
        $roles = Role::where('guard_name', 'admin')->get(['id', 'name']);

        return response()->json([
            'error' => false,
            'data'  => $roles,
        ]);
    }
}