feat: enhance admin role management and reconciliation features

- Updated AGENTS.md to clarify site admin roles and their associated permissions.
- Refactored reconciliation controllers to include admin user validation and improved access control based on admin roles.
- Enhanced AdminReconcileJobService to support player-specific reconciliation and site-based job creation.
- Removed deprecated rebate commission report functionality from the API and related services.
- Improved dashboard overview builders to accommodate new site operator roles and their specific functionalities.

app/Http/Controllers/Api/V1/Admin/Reconcile/ReconcileItemIndexController.php

@@ -2,12 +2,15 @@
 
 namespace App\Http\Controllers\Api\V1\Admin\Reconcile;
 
+use App\Models\AdminSite;
 use App\Models\AdminUser;
 use App\Models\TransferOrder;
 use App\Models\ReconcileJob;
 use Illuminate\Http\Request;
 use App\Models\ReconcileItem;
+use App\Support\AdminAgentScope;
 use App\Support\AdminApiList;
+use App\Support\AdminReconcileScope;
 use Illuminate\Http\JsonResponse;
 use App\Http\Controllers\Controller;
 use App\Support\AdminTransferOrderCapabilities;
@@ -28,11 +31,27 @@ final class ReconcileItemIndexController extends Controller
         $admin = $request->lotteryAdmin();
         abort_if($admin === null, 401);
 
+        if ($denied = AdminReconcileScope::denyUnlessJobAccessible($admin, $reconcile_job)) {
+            return $denied;
+        }
+
         $p = AdminApiList::readPaging($request, 50, 200);
 
-        $paginator = $reconcile_job->items()
-            ->orderBy('id')
-            ->paginate($p['perPage'], ['*'], 'page', $p['page']);
+        $itemsQuery = $reconcile_job->items()->orderBy('id');
+        if (! $admin->isSuperAdmin()) {
+            $siteIds = $admin->accessibleAdminSiteIds() ?? [];
+            $siteCodes = $siteIds === []
+                ? []
+                : AdminSite::query()
+                    ->whereIn('id', $siteIds)
+                    ->pluck('code')
+                    ->map(static fn ($code): string => (string) $code)
+                    ->all();
+            $agent = AdminAgentScope::primaryAgentNode($admin);
+            AdminReconcileScope::applyItemsTransferPlayerScope($itemsQuery, $siteCodes, $agent);
+        }
+
+        $paginator = $itemsQuery->paginate($p['perPage'], ['*'], 'page', $p['page']);
 
         $transferNos = collect($paginator->items())
             ->map(fn (ReconcileItem $item) => $item->side_a_ref)

app/Http/Controllers/Api/V1/Admin/Reconcile/ReconcileJobIndexController.php

@@ -3,6 +3,7 @@
 namespace App\Http\Controllers\Api\V1\Admin\Reconcile;
 
 use App\Models\ReconcileJob;
+use App\Support\AdminReconcileScope;
 use Illuminate\Http\Request;
 use App\Support\AdminApiList;
 use Illuminate\Http\JsonResponse;
@@ -13,6 +14,9 @@ final class ReconcileJobIndexController extends Controller
 {
     public function __invoke(Request $request): JsonResponse
     {
+        $admin = $request->lotteryAdmin();
+        abort_if($admin === null, 401);
+
         $p = AdminApiList::readPaging($request);
         $type = trim((string) $request->query('reconcile_type', ''));
 
@@ -21,6 +25,8 @@ final class ReconcileJobIndexController extends Controller
             $q->where('reconcile_type', $type);
         }
 
+        AdminReconcileScope::applyToJobsQuery($q, $admin);
+
         $paginator = $q->paginate($p['perPage'], ['*'], 'page', $p['page']);
 
         return AdminApiList::json($paginator, fn (ReconcileJob $j) => $this->row($j));

app/Http/Controllers/Api/V1/Admin/Reconcile/ReconcileJobShowController.php

@@ -3,15 +3,24 @@
 namespace App\Http\Controllers\Api\V1\Admin\Reconcile;
 
 use App\Models\ReconcileJob;
+use App\Support\AdminReconcileScope;
 use App\Support\ApiResponse;
 use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
 use App\Http\Controllers\Controller;
 
 /** GET /api/v1/admin/reconcile-jobs/{reconcile_job} */
 final class ReconcileJobShowController extends Controller
 {
-    public function __invoke(ReconcileJob $reconcile_job): JsonResponse
+    public function __invoke(Request $request, ReconcileJob $reconcile_job): JsonResponse
     {
+        $admin = $request->lotteryAdmin();
+        abort_if($admin === null, 401);
+
+        if ($denied = AdminReconcileScope::denyUnlessJobAccessible($admin, $reconcile_job)) {
+            return $denied;
+        }
+
         return ApiResponse::success([
             'id' => (int) $reconcile_job->id,
             'job_no' => $reconcile_job->job_no,

app/Http/Controllers/Api/V1/Admin/Reports/AdminReportRebateCommissionController.php

@@ -1,47 +0,0 @@
-<?php
-
-namespace App\Http\Controllers\Api\V1\Admin\Reports;
-
-use App\Http\Controllers\Controller;
-use App\Http\Requests\Admin\AdminReportQueryRequest;
-use App\Services\Admin\AdminReportQueryService;
-use App\Support\AdminApiList;
-use App\Support\AdminScopePolicy;
-use Illuminate\Http\JsonResponse;
-
-/** GET /api/v1/admin/reports/rebate-commission */
-final class AdminReportRebateCommissionController extends Controller
-{
-    public function __invoke(AdminReportQueryRequest $request, AdminReportQueryService $service): JsonResponse
-    {
-        $admin = $request->lotteryAdmin();
-        abort_if($admin === null, 401);
-
-        $validated = $request->validated();
-        $p = AdminApiList::readPaging($request);
-        $range = $service->resolveDateRange($validated);
-        $playCode = isset($validated['play_code']) ? trim((string) $validated['play_code']) : null;
-        $scope = AdminScopePolicy::resolveContext($request, $admin, 'site_code', 'agent_node_id');
-
-        $paginator = $service->rebateCommissionPaginated(
-            $playCode !== '' ? $playCode : null,
-            $range['date_from'],
-            $range['date_to'],
-            $p['page'],
-            $p['perPage'],
-            $scope,
-        );
-
-        return AdminApiList::jsonWith($paginator, static function (object $row): array {
-            return [
-                'play_code' => (string) $row->play_code,
-                'total_rebate_minor' => (int) $row->total_rebate_minor,
-                'order_count' => (int) $row->order_count,
-                'ticket_item_count' => (int) $row->ticket_item_count,
-            ];
-        }, [
-            'currency_code' => $service->resolvePeriodCurrencyCode($range['date_from'], $range['date_to'], $scope),
-            'disclaimer' => 'wallet_instant_rebate_not_agent_period_settlement',
-        ]);
-    }
-}

app/Http/Requests/Admin/ReportJobStoreRequest.php

@@ -48,7 +48,6 @@ final class ReportJobStoreRequest extends ApiFormRequest
             'hot_number_risk_report',
             'play_dimension_report',
             'sold_out_number_report',
-            'rebate_commission_report',
             'audit_operation_report',
             'wallet_txns_daily',
             'transfer_orders_daily',