sfp_api_laravel_serprati/app/Services/AuthService.php

<?php

namespace App\Services;

use App\Models\User;
use App\Models\PersonalAccessToken;
use App\Models\UserAccessLog;
use App\Enums\UserStatusEnum;
use App\Enums\UserTypeEnum;
use Carbon\Carbon;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Str;

class AuthService
{
    public function login(string $identifier, string $password, string $tipo): ?array
    {
        $user = User::where("email", $identifier)
            ->orWhere("registration", $identifier)
            ->first();

        if (!$user || !Hash::check($password, $user->password)) {
            return null;
        }

        if ($user->type === UserTypeEnum::ASSOCIADO && $user->status === UserStatusEnum::REFUSED) {
            return ["error" => "refused"];
        }

        if ($user->type === UserTypeEnum::PARCEIRO && $user->status === UserStatusEnum::INACTIVE) {
            return ["error" => "inactive"];
        }

        if ($user->type === UserTypeEnum::ASSOCIADO && is_null($user->first_access_completed_at)) {
            return ["error" => "first_access_required"];
        }

        Auth::login($user);

        if ($user->type->value !== $tipo) {
            Auth::logout();
            return ["error" => "wrong_type"];
        }

        if (in_array($user->type, [UserTypeEnum::ASSOCIADO, UserTypeEnum::PARCEIRO])) {
            UserAccessLog::create([
                'user_id'     => $user->id,
                'accessed_at' => now(),
            ]);
        }

        $deviceId = Str::uuid()->toString();

        $accessToken = $user->createAccessToken($deviceId);
        $refreshToken = $user->createRefreshToken($deviceId);

        return [
            "payload" => [
                "access_token" => $accessToken,
                "user" => $user,
            ],
            "refreshToken" => $refreshToken,
        ];
    }

    public function refresh(string $refreshToken): ?array
    {
        if (!$refreshToken) {
            return null;
        }

        $tokenModel = PersonalAccessToken::findToken($refreshToken);

        if (
            !$tokenModel ||
            !in_array("refresh", $tokenModel->abilities) ||
            $tokenModel->expires_at < now()
        ) {
            return null;
        }

        $user = $tokenModel->tokenable;
        if (!$user) {
            return null;
        }

        $deviceId = Str::afterLast($tokenModel->name, "_");

        $tokens = $this->refreshTokenTransaction($tokenModel, $user, $deviceId);

        return [
            "payload" => [
                "access_token" => $tokens["access_token"],
                "user" => $user,
            ],
            "refreshToken" => $tokens["refresh_token"],
        ];
    }

    public function logout(): void
    {
        $user = Auth::user();
        if (!$user) {
            return;
        }

        $tokenName = $user->currentAccessToken()->name;
        $deviceId = Str::afterLast($tokenName, "_");

        $user
            ->tokens()
            ->where("name", "like", "%_{$deviceId}")
            ->delete();
    }

    protected function refreshTokenTransaction(
        PersonalAccessToken $tokenModel,
        User $user,
        string $deviceId,
    ): array {
        return DB::transaction(function () use (
            $tokenModel,
            $user,
            $deviceId,
        ): array {
            $tokenModel->update(["expires_at" => Carbon::now()]);

            $accessToken = $user->createAccessToken($deviceId);
            $refreshToken = $user->createRefreshToken($deviceId);

            return [
                "access_token" => $accessToken,
                "refresh_token" => $refreshToken,
            ];
        });
    }
}