DADProject/api/app/Http/Controllers/UserController.php

<?php

namespace App\Http\Controllers;

use App\Models\Game;
use App\Models\User;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Hash;
use Illuminate\Validation\Rule;

class UserController extends Controller
{
    /**
     * GET /api/users
     * Lista todos os utilizadores (Apenas para Admins)
     */
    public function index(Request $request)
    {
        $this->authorize('viewAny', User::class);

        $query = User::query();

        // Filtros úteis para o Backoffice
        if ($request->has('type')) {
            $query->where('type', $request->type);
        }

        if ($request->has('search')) {
            $query->where(function ($q) use ($request) {
                $q->where('name', 'like', '%'.$request->search.'%')
                    ->orWhere('email', 'like', '%'.$request->search.'%')
                    ->orWhere('nickname', 'like', '%'.$request->search.'%');
            });
        }

        return response()->json($query->paginate(15));
    }

    /**
     * POST /api/users
     * Registar um novo utilizador (Admin only)
     */
    public function store(Request $request)
    {
        $this->authorize('create', User::class);

        $validated = $request->validate([
            'name' => 'required|string|max:255',
            'nickname' => 'required|string|max:20|unique:users,nickname',
            'email' => 'required|email|unique:users,email',
            'password' => 'required|string|min:3',
            'type' => 'required|in:A,U',
        ]);

        $validated['password'] = Hash::make($validated['password']);

        $user = User::create($validated);

        return response()->json($user, 201);
    }

    /**
     * GET /api/users/me
     * Retorna o perfil do utilizador autenticado atual.
     * Usado pelo VueJS para saber quem está logado.
     */
    public function me(Request $request)
    {
        return response()->json($request->user());
    }

    /**
     * GET /api/users/{user}
     * Mostra um perfil específico.
     */
    public function show(User $user)
    {
        $currentUser = Auth::user();

        // Admins and owners get full profile, others get limited view
        if ($currentUser->type === 'A' || $currentUser->id === $user->id) {
            return response()->json($user);
        } else {
            return response()->json([
                'id' => $user->id,
                'name' => $user->name,
                'nickname' => $user->nickname,
                'photo_avatar_filename' => $user->photo_avatar_filename,
                'type' => $user->type,
            ]);
        }
    }

    /**
     * PUT/PATCH /api/users/{user}
     * Atualizar perfil (Nome, Nickname, Password, Foto)
     */
    public function update(Request $request, User $user)
    {
        $this->authorize('update', $user);
        
        $validated = $request->validate([
            'name' => 'sometimes|string|max:255',
            'nickname' => [
                'sometimes',
                'string',
                'max:20',
                Rule::unique('users')->ignore($user->id),
            ],
            'email' => [
                'sometimes',
                'email',
                Rule::unique('users')->ignore($user->id),
            ],
            'password' => 'sometimes|string|min:3',
        ]);

        // Lógica de Upload de Foto (Exemplo Básico)
        // if ($request->hasFile('photo_avatar')) {
        //     $path = $request->file('photo_avatar')->store('avatars', 'public');
        //     $validated['photo_avatar_filename'] = basename($path);
        // }

        $user->update($validated);

        return response()->json($user);
    }

    /**
     * DELETE /api/users/{user}
     * Apagar conta (Soft Delete)
     */
    public function destroy(User $user)
    {
        $this->authorize('delete', $user);

        // Check if user has transactions or games - if so, soft delete
        $hasTransactions = $user->transactions()->exists();
        $hasGames = Game::where(function ($q) use ($user) {
            $q->where('player1_user_id', $user->id)
                ->orWhere('player2_user_id', $user->id);
        })->exists();

        if ($hasTransactions || $hasGames) {
            $user->delete(); // Soft delete
            $message = 'User account deactivated (soft-deleted due to transaction/game history)';
        } else {
            $user->forceDelete(); // Hard delete
            $message = 'User permanently deleted';
        }

        return response()->json(['message' => $message]);
    }

    /**
     * GET /api/users/{user}/matches
     * Histórico de Jogos Multiplayer do Utilizador
     */
    public function getMatches(Request $request, User $user)
    {
        $this->authorize('view', $user);

        $matches = Game::query()
            ->where(function ($q) use ($user) {
                $q->where('player1_user_id', $user->id)->orWhere(
                    'player2_user_id',
                    $user->id,
                );
            })
            ->with(['winner', 'player1', 'player2'])
            ->orderBy('began_at', 'desc')
            ->paginate(10);

        return response()->json($matches);
    }

    public function block(User $user)
    {
        $this->authorize('block', $user);

        $user->blocked = true;
        $user->save();

        // Revoke all active tokens for immediate effect
        $user->tokens()->delete();

        return response()->json(['message' => 'User blocked successfully']);
    }

    public function unblock(User $user)
    {
        $this->authorize('unblock', $user);

        $user->blocked = false;
        $user->save();

        return response()->json(['message' => 'User unblocked successfully']);
    }
}