Add members invite, role change, and remove CRUD

app/Application/Members/MemberService.php

@@ -0,0 +1,130 @@
+<?php
+
+namespace App\Application\Members;
+
+use App\Domain\Shared\Enums\TenantRole;
+use App\Infrastructure\Persistence\Eloquent\Tenant;
+use App\Infrastructure\Persistence\Eloquent\TenantMembership;
+use App\Infrastructure\Persistence\Eloquent\User;
+use Illuminate\Support\Facades\Password;
+use Illuminate\Support\Str;
+use Illuminate\Validation\ValidationException;
+
+final class MemberService
+{
+    /**
+     * @return array{membership: TenantMembership, created_user: bool}
+     */
+    public function invite(
+        Tenant $tenant,
+        string $email,
+        TenantRole $role,
+        ?string $name = null,
+    ): array {
+        $email = Str::lower(trim($email));
+        $user = User::query()->where('email', $email)->first();
+        $createdUser = false;
+
+        if ($user === null) {
+            $resolvedName = filled($name) ? trim($name) : Str::before($email, '@');
+
+            $user = User::query()->create([
+                'name' => $resolvedName !== '' ? $resolvedName : $email,
+                'email' => $email,
+                'password' => Str::password(32),
+            ]);
+            $createdUser = true;
+        }
+
+        if (
+            TenantMembership::query()
+                ->where('tenant_id', $tenant->id)
+                ->where('user_id', $user->id)
+                ->exists()
+        ) {
+            throw ValidationException::withMessages([
+                'email' => ['This user is already a member of this tenant.'],
+            ]);
+        }
+
+        $membership = TenantMembership::query()->create([
+            'tenant_id' => $tenant->id,
+            'user_id' => $user->id,
+            'role' => $role,
+        ]);
+
+        if ($createdUser) {
+            Password::sendResetLink(['email' => $user->email]);
+        }
+
+        return [
+            'membership' => $membership->load('user'),
+            'created_user' => $createdUser,
+        ];
+    }
+
+    public function updateRole(
+        Tenant $tenant,
+        TenantMembership $membership,
+        TenantRole $role,
+    ): TenantMembership {
+        $this->assertMembershipBelongsToTenant($membership, $tenant);
+
+        if (
+            $membership->role === TenantRole::TenantAdmin
+            && $role !== TenantRole::TenantAdmin
+            && $this->isLastTenantAdmin($tenant, $membership)
+        ) {
+            throw ValidationException::withMessages([
+                'role' => ['Cannot demote the last tenant admin.'],
+            ]);
+        }
+
+        $membership->role = $role;
+        $membership->save();
+
+        return $membership->fresh(['user']);
+    }
+
+    public function remove(
+        Tenant $tenant,
+        TenantMembership $membership,
+        User $actor,
+    ): void {
+        $this->assertMembershipBelongsToTenant($membership, $tenant);
+
+        if ($membership->user_id === $actor->id) {
+            throw ValidationException::withMessages([
+                'member' => ['You cannot remove yourself from the tenant.'],
+            ]);
+        }
+
+        if (
+            $membership->role === TenantRole::TenantAdmin
+            && $this->isLastTenantAdmin($tenant, $membership)
+        ) {
+            throw ValidationException::withMessages([
+                'member' => ['Cannot remove the last tenant admin.'],
+            ]);
+        }
+
+        $membership->delete();
+    }
+
+    private function assertMembershipBelongsToTenant(TenantMembership $membership, Tenant $tenant): void
+    {
+        if ($membership->tenant_id !== $tenant->id) {
+            abort(404);
+        }
+    }
+
+    private function isLastTenantAdmin(Tenant $tenant, TenantMembership $membership): bool
+    {
+        $adminCount = TenantMembership::query()
+            ->where('tenant_id', $tenant->id)
+            ->where('role', TenantRole::TenantAdmin->value)
+            ->count();
+
+        return $adminCount <= 1 && $membership->role === TenantRole::TenantAdmin;
+    }
+}

app/Http/Controllers/Api/V1/MemberController.php

@@ -2,21 +2,31 @@
 
 namespace App\Http\Controllers\Api\V1;
 
+use App\Application\Audit\AuditLogger;
+use App\Application\Members\MemberService;
+use App\Domain\Shared\Enums\TenantRole;
 use App\Http\Controllers\Concerns\ResolvesTenantContext;
 use App\Http\Controllers\Controller;
 use App\Http\Resources\MemberResource;
 use App\Infrastructure\Persistence\Eloquent\TenantMembership;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+use Illuminate\Validation\Rule;
 
 class MemberController extends Controller
 {
     use ResolvesTenantContext;
 
+    public function __construct(
+        private readonly AuditLogger $auditLogger,
+        private readonly MemberService $memberService,
+    ) {}
+
     public function index(Request $request, string $tenantId): JsonResponse
     {
         $tenant = $this->resolvedTenant($request);
-        $this->authorize('view', $tenant);
+        $this->authorize('viewAny', [TenantMembership::class, $tenant]);
 
         $members = TenantMembership::query()
             ->with('user')
@@ -28,4 +38,120 @@ public function index(Request $request, string $tenantId): JsonResponse
             'data' => MemberResource::collection($members),
         ]);
     }
+
+    public function store(Request $request, string $tenantId): JsonResponse
+    {
+        $tenant = $this->resolvedTenant($request);
+        $this->authorize('create', [TenantMembership::class, $tenant]);
+
+        $validated = $request->validate([
+            'email' => ['required', 'email', 'max:255'],
+            'name' => ['nullable', 'string', 'max:255'],
+            'role' => ['required', Rule::enum(TenantRole::class)],
+        ]);
+
+        $role = $validated['role'] instanceof TenantRole
+            ? $validated['role']
+            : TenantRole::from($validated['role']);
+
+        $result = $this->memberService->invite(
+            $tenant,
+            $validated['email'],
+            $role,
+            $validated['name'] ?? null,
+        );
+
+        $membership = $result['membership'];
+
+        $this->auditLogger->logFromRequest(
+            $request,
+            action: 'member.invited',
+            resourceType: 'tenant_membership',
+            resourceId: $membership->public_id,
+            tenantId: $tenant->id,
+            summary: [
+                'email' => $membership->user?->email,
+                'role' => $membership->role?->value ?? $membership->role,
+                'created_user' => $result['created_user'],
+            ],
+        );
+
+        return response()->json([
+            'data' => new MemberResource($membership),
+        ], 201);
+    }
+
+    public function update(Request $request, string $tenantId, string $memberId): JsonResponse
+    {
+        $tenant = $this->resolvedTenant($request);
+        $membership = $this->findMembership($tenant->id, $memberId);
+        $this->authorize('update', [$membership, $tenant]);
+
+        $validated = $request->validate([
+            'role' => ['required', Rule::enum(TenantRole::class)],
+        ]);
+
+        $role = $validated['role'] instanceof TenantRole
+            ? $validated['role']
+            : TenantRole::from($validated['role']);
+
+        $previousRole = $membership->role?->value ?? $membership->role;
+        $membership = $this->memberService->updateRole(
+            $tenant,
+            $membership,
+            $role,
+        );
+
+        $this->auditLogger->logFromRequest(
+            $request,
+            action: 'member.role_changed',
+            resourceType: 'tenant_membership',
+            resourceId: $membership->public_id,
+            tenantId: $tenant->id,
+            summary: [
+                'email' => $membership->user?->email,
+                'from' => $previousRole,
+                'to' => $membership->role?->value ?? $membership->role,
+            ],
+        );
+
+        return response()->json([
+            'data' => new MemberResource($membership),
+        ]);
+    }
+
+    public function destroy(Request $request, string $tenantId, string $memberId): Response
+    {
+        $tenant = $this->resolvedTenant($request);
+        $membership = $this->findMembership($tenant->id, $memberId);
+        $this->authorize('delete', [$membership, $tenant]);
+
+        $actor = $this->resolvedActorUser($request);
+        $summary = [
+            'email' => $membership->user?->email,
+            'role' => $membership->role?->value ?? $membership->role,
+        ];
+
+        $this->memberService->remove($tenant, $membership, $actor);
+
+        $this->auditLogger->logFromRequest(
+            $request,
+            action: 'member.removed',
+            resourceType: 'tenant_membership',
+            resourceId: $memberId,
+            tenantId: $tenant->id,
+            summary: $summary,
+        );
+
+        return response()->noContent();
+    }
+
+    private function findMembership(int $tenantId, string $memberId): TenantMembership
+    {
+        return TenantMembership::query()
+            ->with('user')
+            ->where('tenant_id', $tenantId)
+            ->where('public_id', $memberId)
+            ->firstOrFail();
+    }
 }

app/Http/Resources/MemberResource.php

@@ -18,6 +18,7 @@ public function toArray(Request $request): array
             'name' => $this->user?->name,
             'email' => $this->user?->email,
             'role' => $this->role?->value ?? $this->role,
+            'created_at' => $this->created_at?->toIso8601String(),
         ];
     }
 }

app/Policies/MemberPolicy.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Policies;
+
+use App\Infrastructure\Persistence\Eloquent\Tenant;
+use App\Infrastructure\Persistence\Eloquent\TenantMembership;
+use App\Policies\Concerns\InteractsWithTenantAccess;
+use Illuminate\Contracts\Auth\Authenticatable;
+
+class MemberPolicy
+{
+    use InteractsWithTenantAccess;
+
+    public function viewAny(Authenticatable $user, Tenant $tenant): bool
+    {
+        return $this->actorHasTenantAccess($tenant);
+    }
+
+    public function create(Authenticatable $user, Tenant $tenant): bool
+    {
+        return $this->actorIsTenantAdmin($tenant);
+    }
+
+    public function update(Authenticatable $user, TenantMembership $membership, Tenant $tenant): bool
+    {
+        if ($membership->tenant_id !== $tenant->id) {
+            return false;
+        }
+
+        return $this->actorIsTenantAdmin($tenant);
+    }
+
+    public function delete(Authenticatable $user, TenantMembership $membership, Tenant $tenant): bool
+    {
+        return $this->update($user, $membership, $tenant);
+    }
+}

app/Providers/AuthServiceProvider.php

@@ -9,9 +9,11 @@
 use App\Infrastructure\Persistence\Eloquent\Task;
 use App\Infrastructure\Persistence\Eloquent\TaskRun;
 use App\Infrastructure\Persistence\Eloquent\Tenant;
+use App\Infrastructure\Persistence\Eloquent\TenantMembership;
 use App\Policies\ApiKeyPolicy;
 use App\Policies\EndpointProfilePolicy;
 use App\Policies\EnvironmentPolicy;
+use App\Policies\MemberPolicy;
 use App\Policies\SecretPolicy;
 use App\Policies\TaskPolicy;
 use App\Policies\TaskRunPolicy;
@@ -29,6 +31,7 @@ class AuthServiceProvider extends ServiceProvider
         EndpointProfile::class => EndpointProfilePolicy::class,
         Task::class => TaskPolicy::class,
         TaskRun::class => TaskRunPolicy::class,
+        TenantMembership::class => MemberPolicy::class,
     ];
 
     public function boot(): void