lotteryLaravel/app/Support/AdminAgentScope.php

<?php

namespace App\Support;

use App\Models\AdminUser;
use App\Models\AgentNode;
use App\Models\Player;
use Illuminate\Database\Eloquent\Builder;

/**
 * 代理子树数据范围（P1：节点访问；P2 起叠加玩家 agent_node_id）。
 */
final class AdminAgentScope
{
    public static function primaryAgentNode(AdminUser $admin): ?AgentNode
    {
        if ($admin->isSuperAdmin()) {
            return null;
        }

        $agentId = $admin->primaryAgentNodeId();
        if ($agentId === null) {
            return null;
        }

        return AgentNode::query()->find($agentId);
    }

    public static function nodeVisibleTo(AdminUser $admin, AgentNode $node): bool
    {
        if ($admin->isSuperAdmin()) {
            return true;
        }

        // Agent account (bound via agent node) - check first
        // Even if they also have site roles, agent binding takes precedence for visibility
        $actor = self::primaryAgentNode($admin);
        if ($actor !== null) {
            return $node->isSameOrDescendantOf($actor);
        }

        // Check if admin is a platform account (bound via admin_user_site_roles)
        $accessibleSiteIds = $admin->accessibleAdminSiteIds();
        if ($accessibleSiteIds !== null) {
            // Platform account (site admin) can see all nodes in the site
            return in_array((int) $node->admin_site_id, $accessibleSiteIds, true);
        }

        return false;
    }

    public static function playerAccessible(AdminUser $admin, Player $player): bool
    {
        if ($admin->isSuperAdmin()) {
            return true;
        }

        // Check if admin is a platform account (bound via admin_user_site_roles)
        $accessibleSiteIds = $admin->accessibleAdminSiteIds();
        if ($accessibleSiteIds !== null) {
            // Platform account (site admin) can access all players in the site
            // Site check is done by AdminSiteScope::playerAccessible before calling this
            return true;
        }

        // Agent account (bound via agent node)
        $actor = self::primaryAgentNode($admin);
        if ($actor === null) {
            return false;
        }

        if ($player->agent_node_id === null) {
            return false;
        }

        $playerAgent = AgentNode::query()->find((int) $player->agent_node_id);
        if ($playerAgent === null) {
            return false;
        }

        return $playerAgent->isSameOrDescendantOf($actor);
    }

    public static function nodeManageableBy(AdminUser $admin, AgentNode $node): bool
    {
        if ($admin->isSuperAdmin()) {
            return true;
        }

        if (! $admin->hasPermissionCode('agent.node.manage')) {
            return false;
        }

        return self::nodeVisibleTo($admin, $node);
    }

    /** 占成/授信/回水仅可由上级或平台修改，代理本人不可改自己的 profile。 */
    public static function nodeProfileEditableBy(AdminUser $admin, AgentNode $node): bool
    {
        if ($admin->isSuperAdmin()) {
            return true;
        }

        // 一级代理 profile 仅超管可维护（站点总额度、占成、回水等）
        if ($node->isRoot()) {
            return false;
        }

        if (
            ! $admin->hasPermissionCode('agent.profile.manage')
            && ! $admin->hasPermissionCode('agent.node.manage')
        ) {
            return false;
        }

        // Check if admin is a platform account (bound via admin_user_site_roles)
        $accessibleSiteIds = $admin->accessibleAdminSiteIds();
        if ($accessibleSiteIds !== null) {
            // Platform account (site admin) can edit all nodes in the site
            // EXCEPT their own bound agent node
            if (in_array((int) $node->admin_site_id, $accessibleSiteIds, true)) {
                $actor = self::primaryAgentNode($admin);
                if ($actor !== null && (int) $actor->id === (int) $node->id) {
                    return false; // Cannot edit own bound node
                }
                return true;
            }
            return false;
        }

        // Agent account (bound via agent node)
        $actor = self::primaryAgentNode($admin);
        if ($actor === null) {
            return false;
        }

        if ((int) $actor->id === (int) $node->id) {
            return false;
        }

        return $node->isDescendantOf($actor);
    }

    /**
     * @return Builder<AgentNode>
     */
    public static function visibleNodesQuery(AdminUser $admin, int $adminSiteId): Builder
    {
        $query = AgentNode::query()
            ->where('admin_site_id', $adminSiteId)
            ->orderBy('path');

        if ($admin->isSuperAdmin()) {
            return $query;
        }

        // Agent account (bound via agent node) - check first
        // Even if they also have site roles, agent binding takes precedence
        $actor = self::primaryAgentNode($admin);
        if ($actor !== null) {
            if ((int) $actor->admin_site_id !== $adminSiteId) {
                return $query->whereRaw('0 = 1');
            }
            return $query->where('path', 'like', $actor->path.'%');
        }

        // Check if admin is a platform account (bound via admin_user_site_roles)
        $accessibleSiteIds = $admin->accessibleAdminSiteIds();
        if ($accessibleSiteIds !== null) {
            // Platform account (site admin) can see all nodes in the site
            if (in_array($adminSiteId, $accessibleSiteIds, true)) {
                return $query;
            }
            return $query->whereRaw('0 = 1');
        }

        return $query->whereRaw('0 = 1');
    }

    /**
     * 玩家必须落在当前代理子树（agent_node_id 必填，由迁移回填根代理）。
     *
     * @param  Builder<Player>  $query
     */
    public static function applyToPlayerQuery(Builder $query, AdminUser $admin): void
    {
        if ($admin->isSuperAdmin()) {
            return;
        }

        // Check if admin is a platform account (bound via admin_user_site_roles)
        $accessibleSiteIds = $admin->accessibleAdminSiteIds();
        if ($accessibleSiteIds !== null) {
            // Platform account (site admin) - site filtering is handled by AdminSiteScope
            // No agent node filtering needed
            return;
        }

        // Agent account (bound via agent node)
        $actor = self::primaryAgentNode($admin);
        if ($actor === null) {
            $query->whereRaw('0 = 1');

            return;
        }

        if (! \Illuminate\Support\Facades\Schema::hasColumn('players', 'agent_node_id')) {
            return;
        }

        $subtreeIds = AgentNode::query()
            ->where('path', 'like', $actor->path.'%')
            ->pluck('id')
            ->all();

        if ($subtreeIds === []) {
            $query->whereRaw('0 = 1');

            return;
        }

        $query->whereIn('agent_node_id', $subtreeIds);
    }

    /**
     * 在已有站点/代理范围上，再按指定节点子树收窄（超管筛选用）。
     *
     * @param  Builder<Player>  $query
     */
    public static function applyRequestedAgentNodeFilter(Builder $query, AdminUser $admin, int $agentNodeId): void
    {
        $node = AgentNode::query()->find($agentNodeId);
        if ($node === null || ! self::nodeVisibleTo($admin, $node)) {
            $query->whereRaw('0 = 1');

            return;
        }

        if (! \Illuminate\Support\Facades\Schema::hasColumn('players', 'agent_node_id')) {
            return;
        }

        $subtreeIds = AgentNode::query()
            ->where('path', 'like', $node->path.'%')
            ->pluck('id')
            ->all();

        if ($subtreeIds === []) {
            $query->whereRaw('0 = 1');

            return;
        }

        $query->whereIn('agent_node_id', $subtreeIds);
    }
}