feat: api admin user and game policies

api/app/Http/Controllers/UserController.php

@@ -17,6 +17,8 @@ class UserController extends Controller
      */
     public function index(Request $request)
     {
+        $this->authorize('viewAny', User::class);
+
         $query = User::query();
 
         // Filtros úteis para o Backoffice
@@ -41,6 +43,8 @@ class UserController extends Controller
      */
     public function store(Request $request)
     {
+        $this->authorize('create', User::class);
+
         $validated = $request->validate([
             'name' => 'required|string|max:255',
             'nickname' => 'required|string|max:20|unique:users,nickname',
@@ -73,7 +77,11 @@ class UserController extends Controller
     public function show(User $user)
     {
         $currentUser = Auth::user();
-        if ($currentUser->id !== $user->id && $currentUser->type !== 'A') {
+
+        // Admins and owners get full profile, others get limited view
+        if ($currentUser->type === 'A' || $currentUser->id === $user->id) {
+            return response()->json($user);
+        } else {
             return response()->json([
                 'id' => $user->id,
                 'name' => $user->name,
@@ -82,8 +90,6 @@ class UserController extends Controller
                 'type' => $user->type,
             ]);
         }
-
-        return response()->json($user);
     }
 
     /**
@@ -92,12 +98,8 @@ class UserController extends Controller
      */
     public function update(Request $request, User $user)
     {
-        $currentUser = Auth::user();
-
-        if ($currentUser->id !== $user->id && $currentUser->type !== 'A') {
-            return response()->json(['message' => 'Unauthorized'], 403);
-        }
-
+        $this->authorize('update', $user);
+        
         $validated = $request->validate([
             'name' => 'sometimes|string|max:255',
             'nickname' => [
@@ -112,16 +114,8 @@ class UserController extends Controller
                 Rule::unique('users')->ignore($user->id),
             ],
             'password' => 'sometimes|string|min:3',
-            'blocked' => 'sometimes|boolean',
         ]);
 
-        if (isset($validated['blocked']) && $currentUser->type !== 'A') {
-            return response()->json(
-                ['message' => 'Only admins can block users'],
-                403,
-            );
-        }
-
         // Lógica de Upload de Foto (Exemplo Básico)
         // if ($request->hasFile('photo_avatar')) {
         //     $path = $request->file('photo_avatar')->store('avatars', 'public');
@@ -139,24 +133,24 @@ class UserController extends Controller
      */
     public function destroy(User $user)
     {
-        $currentUser = Auth::user();
+        $this->authorize('delete', $user);
 
-        if ($currentUser->id !== $user->id && $currentUser->type !== 'A') {
-            return response()->json(['message' => 'Unauthorized'], 403);
+        // Check if user has transactions or games - if so, soft delete
+        $hasTransactions = $user->transactions()->exists();
+        $hasGames = Game::where(function ($q) use ($user) {
+            $q->where('player1_user_id', $user->id)
+                ->orWhere('player2_user_id', $user->id);
+        })->exists();
+
+        if ($hasTransactions || $hasGames) {
+            $user->delete(); // Soft delete
+            $message = 'User account deactivated (soft-deleted due to transaction/game history)';
+        } else {
+            $user->forceDelete(); // Hard delete
+            $message = 'User permanently deleted';
         }
 
-        if ($currentUser->id === $user->id && $currentUser->type === 'A') {
-            if ($user->type === 'A') {
-                return response()->json(
-                    ['message' => 'Admins cannot delete their own account'],
-                    403,
-                );
-            }
-        }
-
-        $user->delete();
-
-        return response()->json(['message' => 'User deleted successfully']);
+        return response()->json(['message' => $message]);
     }
 
     /**
@@ -165,11 +159,7 @@ class UserController extends Controller
      */
     public function getMatches(Request $request, User $user)
     {
-        $currentUser = Auth::user();
-
-        if ($currentUser->id !== $user->id && $currentUser->type !== 'A') {
-            return response()->json(['message' => 'Unauthorized'], 403);
-        }
+        $this->authorize('view', $user);
 
         $matches = Game::query()
             ->where(function ($q) use ($user) {
@@ -187,14 +177,21 @@ class UserController extends Controller
 
     public function block(User $user)
     {
+        $this->authorize('block', $user);
+
         $user->blocked = true;
         $user->save();
 
+        // Revoke all active tokens for immediate effect
+        $user->tokens()->delete();
+
         return response()->json(['message' => 'User blocked successfully']);
     }
 
     public function unblock(User $user)
     {
+        $this->authorize('unblock', $user);
+
         $user->blocked = false;
         $user->save();