fix(customer): save only profile fields on admin PUT

The list edit dumped the whole table row into update(); whitelist form and accounting fields, and skip hashing an empty password.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Admin/CustomerController.php

@@ -129,17 +129,39 @@ class CustomerController extends SuperController
 
     public function updateAdmin(Request $request , $id)
     {
-        $data = $request->all();
+        $id = (int) $id;
-        if (isset($data['mobile']) && !is_null($data['mobile'])){
+        $data = $request->only([
+            'fname',
+            'lname',
+            'mobile',
+            'password',
+            'birth_date',
+            'phone_number',
+            'province',
+            'city',
+            'n_code',
+            'add_user_limit',
+            'referral_to_id',
+            'pargar_account_id',
+            'moshtari_code',
+            'profit_amount_by_lvl',
+            'gold',
+        ]);
+
+        if (array_key_exists('password', $data) && trim((string) ($data['password'] ?? '')) === '') {
+            unset($data['password']);
+        }
+
+        if (isset($data['mobile']) && ! is_null($data['mobile']) && $data['mobile'] !== '') {
             $data['mobile'] = Customer::normalizeMobile($data['mobile']);
-            Customer::assertMobileUnique($data['mobile'], (int) $id);
+            Customer::assertMobileUnique($data['mobile'], $id);
         }
 
         if (array_key_exists('pargar_account_id', $data)) {
             $data['pargar_account_id'] = $this->normalizeAndAssertUniqueAccountingCode(
                 $data['pargar_account_id'],
                 'pargar_account_id',
-                (int) $id
+                $id
             );
         }
 
@@ -147,21 +169,34 @@ class CustomerController extends SuperController
             $data['moshtari_code'] = $this->normalizeAndAssertUniqueAccountingCode(
                 $data['moshtari_code'],
                 'moshtari_code',
-                (int) $id
+                $id
             );
         }
 
-        if (isset($data['gold'])){
+        $customer = Customer::findOrFail($id);
-            $user = Customer::find($id);
-            if ($user) {
-                $user->gold = $data['gold'];
-                $user->save();
-                $user["g"]=true;
-            }
-        }
-        $user["u"] = Customer::findOrFail($id)->update($data);
-        return response()->json($user);
 
+        if (array_key_exists('referral_to_id', $data) && filled($customer->referral_to_id)) {
+            unset($data['referral_to_id']);
+        }
+
+        if (isset($data['fname'], $data['lname'])) {
+            $data['name'] = trim($data['fname'].' '.$data['lname']);
+        }
+
+        $goldUpdated = false;
+        if (array_key_exists('gold', $data) && $data['gold'] !== null && $data['gold'] !== '') {
+            $customer->gold = $data['gold'];
+            $customer->save();
+            $goldUpdated = true;
+        }
+        unset($data['gold']);
+
+        $updated = $data === [] ? false : $customer->update($data);
+
+        return response()->json([
+            'g' => $goldUpdated,
+            'u' => $updated,
+        ]);
     }
 
     /**

app/Models/Customer.php

@@ -130,6 +130,9 @@ class Customer extends Authenticatable implements JWTSubject
 
 //   hash password
     public function setPasswordAttribute($value){
+        if ($value === null || $value === '') {
+            return;
+        }
         $this->attributes['password'] = Hash::make($value);
     }