osint/app/Http/Controllers/InvestigationAccessController.php

<?php

namespace App\Http\Controllers;

use App\Models\Group;
use App\Models\Investigation;
use App\Models\User;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\View\View;

class InvestigationAccessController extends Controller
{
    public function index(Request $request, Investigation $investigation): View
    {
        $this->authorize('manageAccess', $investigation);

        $investigation->load('users', 'groups');

        $availableGroups = Group::query()
            ->where('owner_id', $request->user()->id)
            ->orWhereHas('members', fn ($q) => $q->where('users.id', $request->user()->id))
            ->whereNotIn('id', $investigation->groups->pluck('id'))
            ->orderBy('name')
            ->get();

        return view('investigations.access', [
            'investigation' => $investigation,
            'availableGroups' => $availableGroups,
        ]);
    }

    public function storeUser(Request $request, Investigation $investigation): RedirectResponse
    {
        $this->authorize('manageAccess', $investigation);

        $data = $request->validate([
            'email' => ['required', 'email'],
            'role' => ['required', 'string', 'in:viewer,editor'],
        ]);

        $user = User::where('email', $data['email'])->first();

        if (! $user) {
            return back()->withErrors(['email' => 'No user found with that email address.']);
        }

        if ($user->id === $investigation->owner_id) {
            return back()->withErrors(['email' => 'The owner already has full access.']);
        }

        $investigation->users()->syncWithoutDetaching([$user->id => ['role' => $data['role']]]);

        return redirect()->route('investigations.access.index', $investigation);
    }

    public function destroyUser(Investigation $investigation, User $user): RedirectResponse
    {
        $this->authorize('manageAccess', $investigation);

        $investigation->users()->detach($user->id);

        return redirect()->route('investigations.access.index', $investigation);
    }

    public function storeGroup(Request $request, Investigation $investigation): RedirectResponse
    {
        $this->authorize('manageAccess', $investigation);

        $data = $request->validate([
            'group_id' => ['required', 'integer', 'exists:groups,id'],
            'role' => ['required', 'string', 'in:viewer,editor'],
        ]);

        $group = Group::findOrFail($data['group_id']);

        abort_unless($group->isAccessibleBy($request->user()), 403);

        $investigation->groups()->syncWithoutDetaching([$group->id => ['role' => $data['role']]]);

        return redirect()->route('investigations.access.index', $investigation);
    }

    public function destroyGroup(Investigation $investigation, Group $group): RedirectResponse
    {
        $this->authorize('manageAccess', $investigation);

        $investigation->groups()->detach($group->id);

        return redirect()->route('investigations.access.index', $investigation);
    }
}