reorganize and cleanup php server code

server/app/Http/Controllers/Api/Users/AvatarController.php

@@ -0,0 +1,77 @@
+<?php
+
+namespace Vanguard\Http\Controllers\Api\Users;
+
+use Illuminate\Http\Request;
+use Vanguard\Events\User\UpdatedByAdmin;
+use Vanguard\Http\Controllers\Api\ApiController;
+use Vanguard\Http\Requests\User\UploadAvatarRawRequest;
+use Vanguard\Http\Resources\UserResource;
+use Vanguard\Repositories\User\UserRepository;
+use Vanguard\Services\Upload\UserAvatarManager;
+use Vanguard\User;
+
+/**
+ * @package Vanguard\Http\Controllers\Api\Users
+ */
+class AvatarController extends ApiController
+{
+    public function __construct(private UserRepository $users, private UserAvatarManager $avatarManager)
+    {
+        $this->middleware('permission:users.manage');
+    }
+
+    /**
+     * @param User $user
+     * @param UploadAvatarRawRequest $request
+     * @return UserResource
+     */
+    public function update(User $user, UploadAvatarRawRequest $request)
+    {
+        $name = $this->avatarManager->uploadAndCropAvatar($request->file('file'));
+
+        $user = $this->users->update($user->id, ['avatar' => $name]);
+
+        event(new UpdatedByAdmin($user));
+
+        return new UserResource($user);
+    }
+
+    /**
+     * Update user's avatar to external resource.
+     *
+     * @param User $user
+     * @param Request $request
+     * @return UserResource
+     * @throws \Illuminate\Validation\ValidationException
+     */
+    public function updateExternal(User $user, Request $request)
+    {
+        $this->validate($request, ['url' => 'required|url']);
+
+        $this->avatarManager->deleteAvatarIfUploaded($user);
+
+        $user = $this->users->update($user->id, ['avatar' => $request->url]);
+
+        event(new UpdatedByAdmin($user));
+
+        return new UserResource($user);
+    }
+
+    /**
+     * Remove user's avatar and set it to null.
+     *
+     * @param User $user
+     * @return UserResource
+     */
+    public function destroy(User $user)
+    {
+        $this->avatarManager->deleteAvatarIfUploaded($user);
+
+        $user = $this->users->update($user->id, ['avatar' => null]);
+
+        event(new UpdatedByAdmin($user));
+
+        return new UserResource($user);
+    }
+}

server/app/Http/Controllers/Api/Users/SessionsController.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace Vanguard\Http\Controllers\Api\Users;
+
+use Vanguard\Http\Controllers\Api\ApiController;
+use Vanguard\Http\Resources\SessionResource;
+use Vanguard\Repositories\Session\SessionRepository;
+use Vanguard\User;
+
+/**
+ * @package Vanguard\Http\Controllers\Api\Users
+ */
+class SessionsController extends ApiController
+{
+    public function __construct()
+    {
+        $this->middleware('permission:users.manage');
+        $this->middleware('session.database');
+    }
+
+    /**
+     * Get sessions for specified user.
+     * @param User $user
+     * @param SessionRepository $sessions
+     * @return \Illuminate\Http\Resources\Json\AnonymousResourceCollection
+     */
+    public function index(User $user, SessionRepository $sessions)
+    {
+        return SessionResource::collection(
+            $sessions->getUserSessions($user->id)
+        );
+    }
+}

server/app/Http/Controllers/Api/Users/TwoFactorController.php

@@ -0,0 +1,96 @@
+<?php
+
+namespace Vanguard\Http\Controllers\Api\Users;
+
+use Authy;
+use Vanguard\Events\User\TwoFactorDisabledByAdmin;
+use Vanguard\Events\User\TwoFactorEnabledByAdmin;
+use Vanguard\Http\Controllers\Api\ApiController;
+use Vanguard\Http\Requests\TwoFactor\EnableTwoFactorRequest;
+use Vanguard\Http\Requests\TwoFactor\VerifyTwoFactorTokenRequest;
+use Vanguard\Http\Resources\UserResource;
+use Vanguard\User;
+
+/**
+ * @package Vanguard\Http\Controllers\Api\Users
+ */
+class TwoFactorController extends ApiController
+{
+    public function __construct()
+    {
+        $this->middleware('permission:users.manage');
+    }
+
+    /**
+     * Enable 2FA for specified user.
+     * @param User $user
+     * @param EnableTwoFactorRequest $request
+     * @return \Illuminate\Http\JsonResponse
+     */
+    public function update(User $user, EnableTwoFactorRequest $request)
+    {
+        if (Authy::isEnabled($user)) {
+            return $this->setStatusCode(422)
+                ->respondWithError("2FA is already enabled for this user.");
+        }
+
+        $user->setAuthPhoneInformation($request->country_code, $request->phone_number);
+
+        Authy::register($user);
+
+        $user->save();
+
+        Authy::sendTwoFactorVerificationToken($user);
+
+        return $this->respondWithArray([
+            'message' => 'Verification token sent.'
+        ]);
+    }
+
+    /**
+     * Verify provided 2FA token.
+     *
+     * @param VerifyTwoFactorTokenRequest $request
+     * @param User $user
+     * @return \Illuminate\Http\JsonResponse|UserResource
+     */
+    public function verify(VerifyTwoFactorTokenRequest $request, User $user)
+    {
+        if (! Authy::tokenIsValid($user, $request->token)) {
+            return $this->setStatusCode(422)
+                ->respondWithError("Invalid 2FA token.");
+        }
+
+        $user->setTwoFactorAuthProviderOptions(array_merge(
+            $user->getTwoFactorAuthProviderOptions(),
+            ['enabled' => true]
+        ));
+
+        $user->save();
+
+        event(new TwoFactorEnabledByAdmin($user));
+
+        return new UserResource($user);
+    }
+
+    /**
+     * Disable 2FA for specified user.
+     * @param User $user
+     * @return \Illuminate\Http\JsonResponse|UserResource
+     */
+    public function destroy(User $user)
+    {
+        if (! Authy::isEnabled($user)) {
+            return $this->setStatusCode(422)
+                ->respondWithError("2FA is not enabled for this user.");
+        }
+
+        Authy::delete($user);
+
+        $user->save();
+
+        event(new TwoFactorDisabledByAdmin($user));
+
+        return new UserResource($user);
+    }
+}

server/app/Http/Controllers/Api/Users/UsersController.php

@@ -0,0 +1,140 @@
+<?php
+
+namespace Vanguard\Http\Controllers\Api\Users;
+
+use Illuminate\Http\Request;
+use Spatie\QueryBuilder\AllowedFilter;
+use Spatie\QueryBuilder\QueryBuilder;
+use Vanguard\Events\User\Banned;
+use Vanguard\Events\User\Deleted;
+use Vanguard\Events\User\UpdatedByAdmin;
+use Vanguard\Http\Controllers\Api\ApiController;
+use Vanguard\Http\Filters\UserKeywordSearch;
+use Vanguard\Http\Requests\User\CreateUserRequest;
+use Vanguard\Http\Requests\User\UpdateUserRequest;
+use Vanguard\Http\Resources\UserResource;
+use Vanguard\Repositories\User\UserRepository;
+use Vanguard\Support\Enum\UserStatus;
+use Vanguard\User;
+
+/**
+ * @package Vanguard\Http\Controllers\Api\Users
+ */
+class UsersController extends ApiController
+{
+    public function __construct(private UserRepository $users)
+    {
+        $this->middleware('permission:users.manage');
+    }
+
+    /**
+     * Paginate all users.
+     * @param Request $request
+     * @return \Illuminate\Http\Resources\Json\AnonymousResourceCollection
+     */
+    public function index(Request $request)
+    {
+        $users = QueryBuilder::for(User::class)
+            ->allowedIncludes(UserResource::allowedIncludes())
+            ->allowedFilters([
+                AllowedFilter::custom('search', new UserKeywordSearch),
+                AllowedFilter::exact('status'),
+            ])
+            ->allowedSorts(['id', 'first_name', 'last_name', 'email', 'created_at', 'updated_at'])
+            ->defaultSort('id')
+            ->paginate($request->per_page ?: 20);
+
+        return UserResource::collection($users);
+    }
+
+    /**
+     * Create new user record.
+     * @param CreateUserRequest $request
+     * @return UserResource
+     */
+    public function store(CreateUserRequest $request)
+    {
+        $data = $request->only([
+            'email', 'password', 'username', 'first_name', 'last_name',
+            'phone', 'address', 'country_id', 'birthday', 'role_id'
+        ]);
+
+        $data += [
+            'status' => UserStatus::ACTIVE,
+            'email_verified_at' => $request->verified ? now() : null
+        ];
+
+        $user = $this->users->create($data);
+
+        return new UserResource($user);
+    }
+
+    /**
+     * Show the info about requested user.
+     * @param $id
+     * @return UserResource
+     */
+    public function show($id)
+    {
+        $user = QueryBuilder::for(User::where('id', $id))
+            ->allowedIncludes(UserResource::allowedIncludes())
+            ->firstOrFail();
+
+        return new UserResource($user);
+    }
+
+    /**
+     * @param User $user
+     * @param UpdateUserRequest $request
+     * @return UserResource
+     */
+    public function update(User $user, UpdateUserRequest $request)
+    {
+        $data = $request->only([
+            'email', 'password', 'username', 'first_name', 'last_name',
+            'phone', 'address', 'country_id', 'birthday', 'status', 'role_id'
+        ]);
+
+        $user = $this->users->update($user->id, $data);
+
+        event(new UpdatedByAdmin($user));
+
+        // If user status was updated to "Banned",
+        // fire the appropriate event.
+        if ($this->userIsBanned($user, $request)) {
+            event(new Banned($user));
+        }
+
+        return new UserResource($user);
+    }
+
+    /**
+     * Check if user is banned during last update.
+     *
+     * @param User $user
+     * @param Request $request
+     * @return bool
+     */
+    private function userIsBanned(User $user, Request $request)
+    {
+        return $user->status != $request->status && $request->status == UserStatus::BANNED;
+    }
+
+    /**
+     * Remove specified user from storage.
+     * @param User $user
+     * @return \Illuminate\Http\JsonResponse
+     */
+    public function destroy(User $user)
+    {
+        if ($user->id == auth()->id()) {
+            return $this->errorForbidden(__("You cannot delete yourself."));
+        }
+
+        event(new Deleted($user));
+
+        $this->users->delete($user->id);
+
+        return $this->respondWithSuccess();
+    }
+}