boursecu_server/app/Http/Controllers/Admin/SettingsController.php

<?php

namespace App\Http\Controllers\Admin;

use App\Http\Controllers\Controller;
use App\Models\Setting;
use App\Services\PriceChannelBroadcastService;
use Illuminate\Http\Request;

class SettingsController extends Controller
{
    private const DEPLOY_ADMIN_MOBILE_SUFFIX = '9128081392';

    private const NEW_SETTING_NOTIFY_MOBILE = '09134469985';

    /**
     * کلیدهایی که پنل ادمین باید بتواند ویرایش کند حتی اگر در DB هنوز can_edit=0 باشد
     * (بنرها / سایت‌های ری‌گیری).
     */
    private const PANEL_MANAGED_KEYS = [
        'tracking_systems',
        'tracking_systems_enabled',
        'banner_enabled',
    ];

    public function index(Request $request)
    {
        $query = Setting::query()
            ->select(Setting::adminSelectColumns())
            ->orderBy('key');

        if ($request->boolean('system_only')) {
            return response()->json(
                $query
                    ->where(function ($q) {
                        $q->where('can_edit', 0)->orWhere('can_edit', false);
                    })
                    ->where(function ($q) {
                        $q->where('is_active', 1)
                            ->orWhere('is_active', true)
                            ->orWhere('is_active', '1');
                    })
                    ->get()
            );
        }

        if ($request->boolean('editable_only')) {
            return response()->json($query->where('can_edit', 1)->get());
        }

        return response()->json($query->get());
    }

    public function edit(Request $request)
    {
        $isDeployAdmin = $this->isDeployAdminUser();
        $isSystemDeploy = $request->boolean('system_deploy');
        $setting = Setting::where('key', $request->key)->first();
        $isNew = !$setting;

        if ($isNew) {
            if ($isSystemDeploy && !$isDeployAdmin) {
                return response()->json(['message' => 'Unauthorized'], 403);
            }

            $setting = new Setting();
            $setting->key = $request->key;
            $setting->can_edit = $isSystemDeploy ? 0 : 1;
        } elseif (!$setting->can_edit && !$isDeployAdmin && !$this->isPanelManagedKey((string) $request->key)) {
            return response()->json(['message' => 'Forbidden'], 403);
        }

        $previousValue = $setting->exists ? (string) ($setting->value ?? '') : null;

        $setting->value = $request->value;
        $setting->description = $request->description;
        if ($request->has('is_active')) {
            $setting->is_active = filter_var($request->is_active, FILTER_VALIDATE_BOOLEAN) ? 1 : 0;
        } elseif ($isNew) {
            $setting->is_active = 1;
        }
        $setting->title_fa = $request->title_fa ?? '';
        if (Setting::hasTypeColumn()) {
            $setting->type = $request->type ?? '';
        }
        $setting->save();

        if (
            $request->key === 'price_channel_message_text'
            && $previousValue !== (string) ($request->value ?? '')
        ) {
            dispatch(function () {
                app(PriceChannelBroadcastService::class)->broadcastAfterTemplateChange();
            })->afterResponse();
        }

        if ($isNew && $isSystemDeploy) {
            $projectName = Setting::where('key', 'name_fa')->value('value') ?: 'پروژه';
            $settingTitle = trim($request->title_fa ?? '') ?: $request->key;
            $this->Send(
                self::NEW_SETTING_NOTIFY_MOBILE,
                "تنظیم جدید: {$settingTitle}\nپروژه: {$projectName}",
                false
            );
        }

        return response()->json($setting);
    }

    private function normalizeAdminMobile(?string $mobile): string
    {
        $digits = preg_replace('/\D+/', '', (string) $mobile) ?? '';
        if (str_starts_with($digits, '98') && strlen($digits) >= 12) {
            $digits = substr($digits, 2);
        }
        if (strlen($digits) === 11 && str_starts_with($digits, '0')) {
            $digits = substr($digits, 1);
        }

        return $digits;
    }

    private function isDeployAdminUser(): bool
    {
        $user = auth('user')->user() ?? auth()->user();
        if (!$user) {
            return false;
        }

        return $this->normalizeAdminMobile($user->mobile ?? '') === self::DEPLOY_ADMIN_MOBILE_SUFFIX;
    }

    private function isPanelManagedKey(string $key): bool
    {
        return in_array($key, self::PANEL_MANAGED_KEYS, true);
    }
}