feat(settings): add menu/show_to_user and public get_settings for client apps

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Admin/SettingsController.php

@@ -31,22 +31,37 @@ class SettingsController extends Controller
         if ($request->boolean('system_only')) {
             $local = $query->get();
 
-            return response()->json($this->authorizeSettingsPayload(
-                $this->composeSystemSettings($local)
-            ));
+            return response()->json($this->composeSystemSettings($local));
         }
 
         if ($request->boolean('editable_only')) {
             $local = $query->get();
 
-            return response()->json($this->authorizeSettingsPayload(
-                $this->composeEditableSettings($local)
-            ));
+            return response()->json($this->composeEditableSettings($local));
         }
 
         $local = $query->get();
 
-        return response()->json($this->authorizeSettingsPayload($this->composeGetSettings($local)));
+        return response()->json($this->composeGetSettings($local));
+    }
+
+    /**
+     * اپ کاربر (khanegi_user / theme / ghatreh) — فقط ردیف‌های show_to_user=1، بدون credential.
+     * پنل ادمین از admin/get_settings استفاده می‌کند.
+     */
+    public function publicIndex()
+    {
+        if (! Setting::hasShowToUserColumn()) {
+            return response()->json([]);
+        }
+
+        $local = Setting::query()
+            ->select(Setting::adminSelectColumns())
+            ->where('show_to_user', 1)
+            ->orderBy('key')
+            ->get();
+
+        return response()->json(Setting::forClientApi($this->composeGetSettings($local)));
     }
 
     /**
@@ -60,7 +75,7 @@ class SettingsController extends Controller
             ->orderBy('key')
             ->get();
 
-        return response()->json($this->authorizeSettingsPayload($rows));
+        return response()->json($rows);
     }
 
     public function edit(Request $request)
@@ -174,6 +189,10 @@ class SettingsController extends Controller
         $saMap = $overlay->catalogMap();
 
         $byKey = [];
+        $localByKey = [];
+        foreach ($localRows as $row) {
+            $localByKey[(string) $row->key] = $row;
+        }
 
         if ($saMap !== null) {
             foreach ($saMap as $key => $item) {
@@ -188,7 +207,7 @@ class SettingsController extends Controller
                 }
                 $value = $item['value'] ?? null;
                 if ($value !== null && $value !== '') {
-                    $byKey[(string) $key] = $this->overlayRowToSetting($item);
+                    $byKey[(string) $key] = $this->overlayRowToSetting($item, $localByKey[(string) $key] ?? null);
                 }
             }
             foreach ($localRows as $row) {
@@ -246,7 +265,7 @@ class SettingsController extends Controller
     }
 
     /**
-     * get_settings اپ/ادمین:
+     * get_settings ادمین (و پایهٔ publicIndex قبل از فیلتر show_to_user):
      *   can_edit=1 (+ runtime) از DB لوکال
      *   can_edit=0 از سوپرادمین؛ اگر کلید در SA نبود یا value خالی بود → کپی لوکال
      * اگر سوپرادمین در دسترس نباشد کل جدول لوکال برمی‌گردد.
@@ -259,6 +278,11 @@ class SettingsController extends Controller
             return $localRows;
         }
 
+        $localByKey = [];
+        foreach ($localRows as $row) {
+            $localByKey[(string) $row->key] = $row;
+        }
+
         $byKey = [];
 
         foreach ($localRows as $row) {
@@ -285,7 +309,7 @@ class SettingsController extends Controller
             }
             $value = $item['value'] ?? null;
             if ($value !== null && $value !== '') {
-                $byKey[$key] = $this->overlayRowToSetting($item);
+                $byKey[$key] = $this->overlayRowToSetting($item, $localByKey[$key] ?? null);
             }
         }
 
@@ -331,7 +355,7 @@ class SettingsController extends Controller
             ->values();
     }
 
-    private function overlayRowToSetting(array $item): Setting
+    private function overlayRowToSetting(array $item, ?Setting $local = null): Setting
     {
         $setting = new Setting();
         $setting->id = isset($item['id']) && is_numeric($item['id']) ? (int) $item['id'] : null;
@@ -342,6 +366,14 @@ class SettingsController extends Controller
         $setting->type = $item['type'] ?? '';
         $setting->is_active = $item['is_active'] ?? 1;
         $setting->can_edit = 0;
+        if ($local) {
+            if (Setting::hasMenuColumn()) {
+                $setting->menu = $local->menu;
+            }
+            if (Setting::hasShowToUserColumn()) {
+                $setting->show_to_user = $local->show_to_user;
+            }
+        }
 
         return $setting;
     }
@@ -359,20 +391,4 @@ class SettingsController extends Controller
 
         return $row;
     }
-
-    /**
-     * اپ کاربر (بدون auth ادمین) هرگز secret/credential نمی‌بیند.
-     * پنل ادمین با auth:user همه کلیدها را می‌بیند.
-     *
-     * @param  \Illuminate\Support\Collection|\Illuminate\Database\Eloquent\Collection|iterable  $rows
-     * @return \Illuminate\Support\Collection
-     */
-    private function authorizeSettingsPayload($rows)
-    {
-        if (auth('user')->check()) {
-            return collect($rows)->values();
-        }
-
-        return Setting::forPublicApi($rows);
-    }
 }