hsxtxxcykcds2026-backend/app/Http/Controllers/Api/AudienceAuthController.php

<?php

namespace App\Http\Controllers\Api;

use App\Http\Controllers\Controller;
use App\Models\AudienceRegistration;
use App\Models\Competition;
use App\Models\CompetitionPortalLocale;
use App\Models\SmsVerification;
use App\Models\User;
use App\Support\PortalLocale;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\DB;
use Illuminate\Validation\ValidationException;

class AudienceAuthController extends Controller
{
    public function login(Request $request): JsonResponse
    {
        $data = $request->validate([
            'mobile' => ['required', 'regex:/^1[3-9]\d{9}$/'],
            'code' => ['required', 'string', 'max:64'],
            'competition_slug' => ['required', 'string', 'max:64'],
            'lang' => ['sometimes', 'nullable', 'string', 'max:16'],
        ]);

        $signupLocale = PortalLocale::ZH;
        $signupLocaleLocked = false;
        $user = DB::transaction(function () use ($data, &$signupLocale, &$signupLocaleLocked) {
            $verification = SmsVerification::query()
                ->where('scene', SmsVerification::SCENE_AUDIENCE_LOGIN)
                ->where('mobile', $data['mobile'])
                ->where('status', SmsVerification::STATUS_SENT)
                ->where('expires_at', '>', now())
                ->latest('id')
                ->lockForUpdate()
                ->first();

            if ($verification === null || $verification->code !== $data['code']) {
                throw ValidationException::withMessages([
                    'code' => ['验证码无效或已过期'],
                ]);
            }

            $competition = Competition::query()
                ->where('slug', $data['competition_slug'])
                ->where('published', true)
                ->first();

            if ($competition === null) {
                throw ValidationException::withMessages([
                    'competition_slug' => ['赛事不存在或未发布'],
                ]);
            }

            $user = User::query()->firstOrCreate(
                ['mobile' => $data['mobile']],
                ['name' => null, 'email' => null, 'password' => null]
            );

            $requested = PortalLocale::fromRequest(isset($data['lang']) ? (string) $data['lang'] : null);
            $signupLocaleLocked = AudienceRegistration::existsForUserCompetition(
                (int) $user->id,
                (int) $competition->id
            );
            $signupLocale = CompetitionPortalLocale::resolveForLogin(
                (int) $user->id,
                (int) $competition->id,
                PortalLocale::PORTAL_AUDIENCE,
                $requested,
                $signupLocaleLocked
            );

            $verification->forceFill([
                'status' => SmsVerification::STATUS_USED,
                'used_at' => now(),
            ])->save();

            SmsVerification::query()
                ->where('scene', SmsVerification::SCENE_AUDIENCE_LOGIN)
                ->where('mobile', $data['mobile'])
                ->where('id', '<>', $verification->id)
                ->whereIn('status', [
                    SmsVerification::STATUS_PENDING,
                    SmsVerification::STATUS_SENT,
                ])
                ->update(['status' => SmsVerification::STATUS_EXPIRED]);

            return $user;
        });

        $user->tokens()->where('name', 'audience')->delete();
        $token = $user->createToken('audience')->plainTextToken;

        return response()->json([
            'token' => $token,
            'token_type' => 'Bearer',
            'signup_locale' => $signupLocale,
            'signup_locale_locked' => $signupLocaleLocked,
            'user' => [
                'id' => $user->id,
                'mobile' => $user->mobile,
                'name' => $user->name,
            ],
        ]);
    }
}