szkp-map-service/app/Http/Controllers/Api/VerifyPortalManageController.php

<?php

namespace App\Http\Controllers\Api;

use App\Http\Controllers\Controller;
use App\Models\Activity;
use App\Models\TicketGrabEvent;
use App\Models\TicketGrabEventVenue;
use App\Models\Venue;
use App\Support\ActivityVerifyPortalPin;
use App\Support\VenueVerifyPortalPin;
use App\Support\VerifyPortalCode;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;

class VerifyPortalManageController extends Controller
{
    public function activityShow(Request $request, Activity $activity): JsonResponse
    {
        $this->ensureActivityVenueAdmin($request, $activity);
        if ($activity->verify_portal_token === null || $activity->verify_portal_token === '') {
            $activity->forceFill(['verify_portal_token' => (string) \Illuminate\Support\Str::uuid()])->save();
        }
        VerifyPortalCode::ensureForActivity($activity);
        $activity->refresh();
        $pin = ActivityVerifyPortalPin::ensure($activity);

        return response()->json([
            'verify_portal_pin' => $pin,
            'credentials' => [],
        ]);
    }

    public function activityStore(Request $request, Activity $activity): void
    {
        abort(410, '活动核销已统一为全局核销页，仅需 6 位数字密码，无法再添加核销子账号');
    }

    public function activityUpdate(Request $request, Activity $activity, \App\Models\VerifyPortalCredential $verifyPortalCredential): void
    {
        abort(410, '活动核销已统一为全局核销页与 6 位数字密码');
    }

    public function activityDestroy(Request $request, Activity $activity, \App\Models\VerifyPortalCredential $verifyPortalCredential): void
    {
        abort(410, '活动核销已统一为全局核销页与 6 位数字密码');
    }

    /**
     * 抢票核销与本活动场次无关：与本抢票参与场馆对齐，每场管展示其场馆级 6 位口令（与活动共用同一登录页）。
     */
    public function ticketGrabShow(Request $request, TicketGrabEvent $ticketGrabEvent): JsonResponse
    {
        $this->ensureTicketGrabAdmin($request, $ticketGrabEvent);
        if ($ticketGrabEvent->verify_portal_token === null || $ticketGrabEvent->verify_portal_token === '') {
            $ticketGrabEvent->forceFill(['verify_portal_token' => (string) \Illuminate\Support\Str::uuid()])->save();
        }
        VerifyPortalCode::ensureForTicketGrabEvent($ticketGrabEvent);
        $ticketGrabEvent->refresh();

        $venueIds = TicketGrabEventVenue::query()
            ->where('ticket_grab_event_id', $ticketGrabEvent->id)
            ->orderBy('id')
            ->pluck('venue_id')
            ->unique()
            ->values();

        $venues = [];
        foreach ($venueIds as $vid) {
            $v = Venue::query()->find((int) $vid);
            if ($v === null) {
                continue;
            }
            $pin = VenueVerifyPortalPin::ensure($v);
            $venues[] = [
                'venue_id' => $v->id,
                'venue_name' => $v->name,
                'verify_portal_pin' => $pin,
            ];
        }

        return response()->json([
            'unified_verify_notice' => '与「活动核销」相同：浏览器打开统一核销登录页后，由各场馆使用自己的 6 位数字口令进入；口令仅核销本场馆的抢票预约。',
            'venues' => $venues,
        ]);
    }

    public function ticketGrabStore(Request $request, TicketGrabEvent $ticketGrabEvent): void
    {
        abort(410, '抢票核销已改为场馆维度 6 位数字口令，无法再添加核销子账号');
    }

    public function ticketGrabUpdate(
        Request $request,
        TicketGrabEvent $ticketGrabEvent,
        \App\Models\VerifyPortalCredential $verifyPortalCredential,
    ): void {
        abort(410, '抢票核销已改为场馆 6 位数字口令');
    }

    public function ticketGrabDestroy(
        Request $request,
        TicketGrabEvent $ticketGrabEvent,
        \App\Models\VerifyPortalCredential $verifyPortalCredential,
    ): void {
        abort(410, '抢票核销已改为场馆 6 位数字口令');
    }

    private function ensureActivityVenueAdmin(Request $request, Activity $activity): void
    {
        $user = $request->user();
        if ($user->isSuperAdmin()) {
            return;
        }
        if ($activity->submitted_by !== null && (int) $activity->submitted_by === (int) $user->id) {
            return;
        }
        $allowed = $user->venues()->where('venues.id', $activity->venue_id)->exists();
        abort_unless($allowed, 403, '仅可操作已绑定场馆');
    }

    private function ensureTicketGrabAdmin(Request $request, TicketGrabEvent $e): void
    {
        $pivots = TicketGrabEventVenue::query()
            ->where('ticket_grab_event_id', $e->id)
            ->pluck('venue_id')
            ->all();
        if ($pivots === []) {
            return;
        }
        $user = $request->user();
        if ($user->isSuperAdmin()) {
            return;
        }
        $allow = $user->venues()->pluck('venues.id');
        foreach (array_unique(array_map('intval', $pivots)) as $id) {
            if ($id > 0 && ! $allow->contains($id)) {
                abort(403, '仅可操作已绑定场馆');
            }
        }
    }
}