Phase 3 asset storage management

app/Http/Controllers/AttachmentController.php

@@ -8,32 +8,46 @@ use App\Models\JobPost;
 use App\Models\ProviderProfile;
 use App\Models\SocialPost;
 use App\Models\WorkOrder;
+use App\Models\Attachment;
+use App\Models\BuyerProfile;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Str;
 
 class AttachmentController extends Controller
 {
     public function store(Request $request): RedirectResponse
     {
+        $maxKb = (int) config('provider-exchange.attachments.max_kb');
+        $mimeTypes = (array) config('provider-exchange.attachments.allowed_mime_types');
+
         $data = $request->validate([
             'attachable_type' => ['required', 'string', 'in:provider_profile,buyer_profile,social_post,job_post,work_order,dispute,external_profile_import'],
             'attachable_id' => ['required', 'integer'],
             'kind' => ['nullable', 'string', 'max:255'],
             'caption' => ['nullable', 'string', 'max:1000'],
-            'file' => ['required', 'file', 'max:10240'],
+            'file' => ['required', 'file', 'max:'.$maxKb, 'mimetypes:'.implode(',', $mimeTypes)],
         ]);
 
         $attachable = $this->resolveAttachable($data['attachable_type'], (int) $data['attachable_id']);
         $this->authorizeAttachment($request, $attachable);
 
         $file = $request->file('file');
-        $path = $file->store('attachments/'.Str::slug($data['attachable_type']), 'public');
+        $disk = (string) config('provider-exchange.attachments.disk');
+        $root = trim((string) config('provider-exchange.attachments.root'), '/');
+        $directory = implode('/', array_filter([
+            $root ?: 'attachments',
+            Str::slug($data['attachable_type']),
+            now()->format('Y'),
+            now()->format('m'),
+        ]));
+        $path = $file->store($directory, $disk);
 
         $attachable->attachments()->create([
             'user_id' => $request->user()->id,
             'kind' => $data['kind'] ?? 'general',
-            'disk' => 'public',
+            'disk' => $disk,
             'path' => $path,
             'original_name' => $file->getClientOriginalName(),
             'mime_type' => $file->getClientMimeType(),
@@ -44,11 +58,35 @@ class AttachmentController extends Controller
         return back()->with('status', 'File uploaded.');
     }
 
+    public function destroy(Request $request, Attachment $attachment): RedirectResponse
+    {
+        $this->authorizeAttachment($request, $attachment->attachable);
+
+        if (
+            $attachment->user_id === $request->user()->id
+            || $request->user()->hasRole('admin')
+            || $this->ownsAttachable($request, $attachment->attachable)
+        ) {
+            $disk = $attachment->disk;
+            $path = $attachment->path;
+            $attachment->delete();
+
+            $stillReferenced = Attachment::where('disk', $disk)->where('path', $path)->exists();
+            if (! $stillReferenced) {
+                Storage::disk($disk)->delete($path);
+            }
+
+            return back()->with('status', 'File deleted.');
+        }
+
+        abort(403);
+    }
+
     private function resolveAttachable(string $type, int $id): mixed
     {
         return match ($type) {
             'provider_profile' => ProviderProfile::findOrFail($id),
-            'buyer_profile' => \App\Models\BuyerProfile::findOrFail($id),
+            'buyer_profile' => BuyerProfile::findOrFail($id),
             'social_post' => SocialPost::findOrFail($id),
             'job_post' => JobPost::findOrFail($id),
             'work_order' => WorkOrder::findOrFail($id),
@@ -63,7 +101,7 @@ class AttachmentController extends Controller
 
         if ($attachable instanceof ProviderProfile) {
             abort_unless($attachable->user_id === $user->id || $user->hasRole('admin'), 403);
-        } elseif ($attachable instanceof \App\Models\BuyerProfile) {
+        } elseif ($attachable instanceof BuyerProfile) {
             abort_unless($attachable->user_id === $user->id || $user->hasRole('admin'), 403);
         } elseif ($attachable instanceof SocialPost) {
             abort_unless($attachable->user_id === $user->id || $user->hasRole('admin'), 403);
@@ -77,4 +115,20 @@ class AttachmentController extends Controller
             abort_unless($attachable->providerProfile->user_id === $user->id || $user->hasRole('admin'), 403);
         }
     }
+
+    private function ownsAttachable(Request $request, mixed $attachable): bool
+    {
+        $userId = $request->user()->id;
+
+        return match (true) {
+            $attachable instanceof ProviderProfile => $attachable->user_id === $userId,
+            $attachable instanceof BuyerProfile => $attachable->user_id === $userId,
+            $attachable instanceof SocialPost => $attachable->user_id === $userId,
+            $attachable instanceof JobPost => $attachable->buyer_id === $userId,
+            $attachable instanceof WorkOrder => in_array($userId, [$attachable->buyer_id, $attachable->provider_id], true),
+            $attachable instanceof Dispute => in_array($userId, [$attachable->workOrder->buyer_id, $attachable->workOrder->provider_id], true),
+            $attachable instanceof ExternalProfileImport => $attachable->providerProfile->user_id === $userId,
+            default => false,
+        };
+    }
 }

app/Models/Attachment.php

@@ -6,6 +6,7 @@ use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
 use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Storage;
 
 #[Fillable(['user_id', 'kind', 'disk', 'path', 'original_name', 'mime_type', 'size', 'caption'])]
 class Attachment extends Model
@@ -19,4 +20,33 @@ class Attachment extends Model
     {
         return $this->belongsTo(User::class);
     }
+
+    public function publicUrl(): string
+    {
+        if ($this->disk === 'public') {
+            return asset('storage/'.$this->path);
+        }
+
+        return Storage::disk($this->disk)->url($this->path);
+    }
+
+    public function formattedSize(): string
+    {
+        $bytes = max(0, (int) $this->size);
+
+        if ($bytes >= 1048576) {
+            return round($bytes / 1048576, 1).' MB';
+        }
+
+        if ($bytes >= 1024) {
+            return round($bytes / 1024, 1).' KB';
+        }
+
+        return $bytes.' B';
+    }
+
+    public function isImage(): bool
+    {
+        return str_starts_with((string) $this->mime_type, 'image/');
+    }
 }