sfp_api_laravel_serprati/app/Http/Requests/FirstAccessRegisterRequest.php

<?php

namespace App\Http\Requests;

use App\Enums\UserTypeEnum;
use App\Models\User;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rule;
use Illuminate\Validation\Rules\Password;

class FirstAccessRegisterRequest extends FormRequest
{
    public function rules(): array
    {
        $user   = $this->existingUser();
        $userId = $user?->id;

        return [
            'token'        => 'required|string',
            'registration' => ['required', 'string', 'max:255', Rule::unique('users', 'registration')->ignore($userId)],
            'name'         => 'required|string|max:255',
            'cpf'          => ['required', 'string', 'max:14', Rule::unique('users', 'cpf')->ignore($userId)],
            'email'        => ['required', 'email', 'max:255', Rule::unique('users', 'email')->ignore($userId)],
            'phone'        => 'required|string|max:20',
            'position_id'  => 'required|integer|exists:positions,id',
            'sector_id'    => 'required|integer|exists:sectors,id',
            'password'     => ['required', 'confirmed', Password::min(8)->mixedCase()->numbers()],
            // Obrigatória apenas quando a administração ainda não cadastrou uma foto para o associado.
            'photo'        => ['nullable', Rule::requiredIf(fn(): bool => !$user?->photo_path), 'image', 'max:5120'],
        ];
    }

    /**
     * Associado que já existe com este crachá — as regras de unicidade ignoram o próprio registro.
     */
    private function existingUser(): ?User
    {
        return User::where('type', UserTypeEnum::ASSOCIADO)
            ->where('registration', $this->input('registration'))
            ->first();
    }
}