lotteryLaravel/app/Support/AdminSiteScope.php

<?php

namespace App\Support;

use App\Models\AdminSite;
use App\Models\AdminUser;
use App\Models\Player;
use App\Lottery\ErrorCode;
use App\Support\ApiMessage;
use App\Support\ApiResponse;
use Illuminate\Database\Eloquent\Builder;
use Illuminate\Http\JsonResponse;

/**
 * 后台站点数据范围：非超管仅可访问 {@see AdminUser::accessibleAdminSiteIds()} 绑定站点。
 *
 * 对应产品「site_only / site_all_data」；运行时以 admin_user_site_roles 为准（非已废弃的 admin_data_scopes 表）。
 */
final class AdminSiteScope
{
    /**
     * @return list<string>|null `null` 表示不限制（超管）
     */
    public static function accessibleSiteCodes(AdminUser $admin): ?array
    {
        $siteIds = $admin->accessibleAdminSiteIds();
        if ($siteIds === null) {
            return null;
        }

        if ($siteIds === []) {
            return [];
        }

        return AdminSite::query()
            ->whereIn('id', $siteIds)
            ->orderBy('code')
            ->pluck('code')
            ->map(static fn ($code): string => (string) $code)
            ->values()
            ->all();
    }

    public static function siteCodeAllowed(AdminUser $admin, string $siteCode): bool
    {
        $allowed = self::accessibleSiteCodes($admin);
        if ($allowed === null) {
            return true;
        }

        return in_array($siteCode, $allowed, true);
    }

    public static function playerAccessible(AdminUser $admin, Player $player): bool
    {
        return self::siteCodeAllowed($admin, (string) $player->site_code);
    }

    /**
     * @param  Builder<Player>  $query
     */
    public static function applyToPlayerQuery(Builder $query, AdminUser $admin): void
    {
        $codes = self::accessibleSiteCodes($admin);
        if ($codes === null) {
            return;
        }

        if ($codes === []) {
            $query->whereRaw('0 = 1');

            return;
        }

        $query->whereIn('site_code', $codes);
    }

    /**
     * 在站点范围基础上，可选按请求的 site_code 再收窄。
     *
     * @param  Builder<Player>  $query
     */
    public static function applyPlayerFilters(Builder $query, AdminUser $admin, ?string $requestedSiteCode): void
    {
        self::applyToPlayerQuery($query, $admin);

        $siteCode = is_string($requestedSiteCode) ? trim($requestedSiteCode) : '';
        if ($siteCode === '') {
            return;
        }

        if (! self::siteCodeAllowed($admin, $siteCode)) {
            $query->whereRaw('0 = 1');

            return;
        }

        $query->where('site_code', $siteCode);
    }

    /**
     * @param  Builder<mixed>  $query
     */
    public static function applyViaPlayerRelation(Builder $query, AdminUser $admin, string $relation = 'player'): void
    {
        $codes = self::accessibleSiteCodes($admin);
        if ($codes === null) {
            return;
        }

        if ($codes === []) {
            $query->whereRaw('0 = 1');

            return;
        }

        $query->whereHas($relation, static function (Builder $playerQuery) use ($codes): void {
            $playerQuery->whereIn('site_code', $codes);
        });
    }

    /**
     * @param  Builder<mixed>  $query
     */
    public static function applyViaPlayerRelationWithSiteCode(
        Builder $query,
        AdminUser $admin,
        ?string $requestedSiteCode,
        string $relation = 'player',
    ): void {
        self::applyViaPlayerRelation($query, $admin, $relation);

        $siteCode = is_string($requestedSiteCode) ? trim($requestedSiteCode) : '';
        if ($siteCode === '') {
            return;
        }

        if (! self::siteCodeAllowed($admin, $siteCode)) {
            $query->whereRaw('0 = 1');

            return;
        }

        $query->whereHas($relation, static function (Builder $playerQuery) use ($siteCode): void {
            $playerQuery->where('site_code', $siteCode);
        });
    }

    public static function denyUnlessPlayerAccessible(AdminUser $admin, Player $player): ?JsonResponse
    {
        if (! self::playerAccessible($admin, $player)) {
            return ApiMessage::errorResponse(
                request(),
                'admin.site_player_access_denied',
                ErrorCode::AdminForbidden->value,
                null,
                403,
            );
        }

        return null;
    }
}