some progress

app/Http/Controllers/SummaryReviewController.php

@@ -0,0 +1,55 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\Book;
+use App\Models\SummaryReview;
+use Illuminate\Http\Request;
+
+class SummaryReviewController extends Controller
+{
+    public function __construct()
+    {
+        $this->middleware('auth');
+    }
+
+    /**
+     * Store or update a user's review for a book summary.
+     */
+    public function store(Request $request, Book $book)
+    {
+        $data = $request->validate([
+            'rating' => 'required|integer|min:1|max:5',
+            'comment' => 'nullable|string|max:2000',
+        ]);
+
+        $review = SummaryReview::updateOrCreate(
+            [
+                'user_id' => $request->user()->id,
+                'book_id' => $book->id,
+            ],
+            [
+                'summary_id' => optional($book->summary)->id,
+                'rating' => $data['rating'],
+                'comment' => $data['comment'] ?? null,
+            ]
+        );
+
+        return back()->with('success', $review->wasRecentlyCreated ? 'Thanks for your review!' : 'Your review has been updated.');
+    }
+
+    /**
+     * Remove the specified review from storage.
+     */
+    public function destroy(Request $request, SummaryReview $review)
+    {
+        $this->authorizeAction($request, $review);
+        $review->delete();
+        return back()->with('success', 'Your review has been deleted.');
+    }
+
+    protected function authorizeAction(Request $request, SummaryReview $review): void
+    {
+        abort_unless($review->user_id === $request->user()->id, 403, 'Unauthorized');
+    }
+}