auth tests

backend/app/Models/Lists/UserRole.php

@@ -0,0 +1,57 @@
+<?php
+
+namespace App\Models\Lists;
+
+use App\Models\User;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use OwenIt\Auditing\Auditable as AuditableTrait;
+use OwenIt\Auditing\Contracts\Auditable;
+
+class UserRole extends Model implements Auditable
+{
+    use AuditableTrait;
+    use HasFactory;
+
+    public const ADMIN = 'Admin';
+
+    public const SUPERVISOR = 'Supervisor';
+
+    public const USER = 'User';
+
+    public const GUEST = 'Guest';
+
+    protected $table = 'user_roles';
+
+    protected $fillable = [
+        'name',
+        'description',
+    ];
+
+    /**
+     * Utenti che hanno questo ruolo.
+     *
+     * @return HasMany<User, $this>
+     */
+    public function users(): HasMany
+    {
+        return $this->hasMany(User::class, 'role_id');
+    }
+
+    /**
+     * Ruolo predefinito di sistema: non eliminabile.
+     */
+    public function isSystemRole(): bool
+    {
+        return in_array($this->name, [self::ADMIN, self::SUPERVISOR, self::USER, self::GUEST], true);
+    }
+
+    /**
+     * Il ruolo è assegnato ad almeno un utente.
+     */
+    public function isInUse(): bool
+    {
+        return $this->users()->exists();
+    }
+}

backend/app/Models/User.php

@@ -2,20 +2,59 @@
 
 namespace App\Models;
 
-// use Illuminate\Contracts\Auth\MustVerifyEmail;
-use Database\Factories\UserFactory;
-use Illuminate\Database\Eloquent\Attributes\Fillable;
-use Illuminate\Database\Eloquent\Attributes\Hidden;
+use App\Models\Lists\UserRole;
+use App\Notifications\ResetPasswordNotification;
+use Illuminate\Contracts\Auth\MustVerifyEmail;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\SoftDeletes;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
+use Laravel\Fortify\TwoFactorAuthenticatable;
+use Laravel\Sanctum\HasApiTokens;
+use OwenIt\Auditing\Contracts\Auditable;
 
-#[Fillable(['name', 'email', 'password'])]
-#[Hidden(['password', 'remember_token'])]
-class User extends Authenticatable
+class User extends Authenticatable implements Auditable, MustVerifyEmail
 {
     /** @use HasFactory<UserFactory> */
-    use HasFactory, Notifiable;
+    use HasApiTokens, HasFactory, Notifiable, SoftDeletes;
+
+    use \OwenIt\Auditing\Auditable;
+    use TwoFactorAuthenticatable;
+
+    /**
+     * The attributes that are mass assignable.
+     *
+     * @var list<string>
+     */
+    protected $appends = ['setup_status'];
+
+    protected $auditExclude = ['password', 'remember_token', 'two_factor_secret'];
+
+    protected $fillable = [
+        'name',
+        'email',
+        'password',
+        'role_id',
+        'is_system',
+        'must_change_password',
+        'two_factor_secret',
+        'two_factor_recovery_codes',
+        'two_factor_setup_completed_at',
+        'email_verified_at',
+    ];
+
+    /**
+     * The attributes that should be hidden for serialization.
+     *
+     * @var list<string>
+     */
+    protected $hidden = [
+        'password',
+        'remember_token',
+        'two_factor_secret',
+        'two_factor_recovery_codes',
+    ];
 
     /**
      * Get the attributes that should be cast.
@@ -27,6 +66,43 @@ class User extends Authenticatable
         return [
             'email_verified_at' => 'datetime',
             'password' => 'hashed',
+            'role_id' => 'integer',
+            'must_change_password' => 'boolean',
+            'two_factor_setup_completed_at' => 'datetime',
+            'two_factor_confirmed_at' => 'datetime',
+            'is_system' => 'boolean',
+            'anonymized_at' => 'datetime',
         ];
     }
+
+    /**
+     * Ruolo applicativo dell'utente.
+     *
+     * @return BelongsTo<UserRole, $this>
+     */
+    public function role(): BelongsTo
+    {
+        return $this->belongsTo(UserRole::class, 'role_id');
+    }
+
+    /**
+     * Send the password reset notification.
+     */
+    public function sendPasswordResetNotification($token)
+    {
+        $this->notify(new ResetPasswordNotification($token));
+    }
+
+    public function getSetupStatusAttribute(): string
+    {
+        if ($this->must_change_password) {
+            return 'password_required';
+        }
+
+        if (is_null($this->two_factor_setup_completed_at)) {
+            return '2fa_setup_required';
+        }
+
+        return 'complete';
+    }
 }