laravel-backend/app/Http/Controllers/ContactController.php

<?php

namespace App\Http\Controllers;

use App\Services\MemberService;
use App\Services\ContactService;
use App\Http\Requests\Member\ContactStore;

class ContactController extends Controller
{

    private $contactService;
    private $memberService;

    public function __construct(
        MemberService $memberService,
        ContactService $contactService
    ) {
        $this->contactService = $contactService;
        $this->memberService = $memberService;
        $this->middleware('auth:sanctum');
    }

    public function index()
    {
        $contacts = $this->contactService->getAll();

        return response()->json($contacts, 201);
    }

    public function store(ContactStore $request)
    {
        $member = $this->memberService->get($request->member_id);

        if (!$member) {
            return response()->json(['message' => 'Member not found.'], 404);
        }

        $isSuperAdmin = auth()->user()->hasRole('super_admin');
        $isAdmin = auth()->user()->hasRole('admin');
        $isSuperAdminOrAdmin = $isSuperAdmin || $isAdmin;
        $isUserDelegated = $member->user_id === auth()->user()->id;

        if (
            !$isSuperAdmin &&
            !$isAdmin &&
            !$isUserDelegated
        ) {
            return response()->json(['message' => 'You have no rights to do this'], 401);
        }

        $request_data = $request->validated();

        // if is an user delegated to work with that member, remove approved_by and approved_at
        $request_data['revisor_id'] = $isSuperAdminOrAdmin ? auth()->user()->id : null;
        $request_data['approved_at'] = $isSuperAdminOrAdmin ? now() : null;

        $contact = $this->contactService->save($request_data);

        return response()->json($contact, 201);
    }

    public function show($id)
    {
        $contact = $this->contactService->get($id);

        return response()->json($contact);
    }

    public function destroy($id)
    {
        $isSuperAdmin = auth()->user()->hasRole('super_admin');
        $isAdmin = auth()->user()->hasRole('admin');
        $isSuperAdminOrAdmin = $isSuperAdmin || $isAdmin;

        if (!$isSuperAdminOrAdmin) {
            return response()->json(['message' => 'You have no rights to do this'], 401);
        }

        $this->contactService->delete($id);
        return response()->json(null, 204);
    }
}