feat(metadata): fresh metadata implementation

app/Domains/Metadata/Http/Controllers/CustomFieldsController.php

@@ -0,0 +1,119 @@
+<?php
+
+namespace App\Domains\Metadata\Http\Controllers;
+
+use App\Domains\Metadata\Application\CustomFieldService;
+use App\Domains\Metadata\Http\Requests\CustomFieldRequest;
+use App\Domains\Metadata\Http\Resources\CustomFieldResource;
+use App\Domains\Metadata\Models\CustomField;
+use App\Platform\Http\Controller;
+use Illuminate\Http\Request;
+
+/**
+ * The definitions behind the extra questions a company asks on its records.
+ *
+ * A definition carries its own default answer, which arrives beside the
+ * validated attributes rather than among them: the form request never lists
+ * `default_answer`, because the column it belongs in follows from the field's
+ * input type and is settled by the service.
+ */
+class CustomFieldsController extends Controller
+{
+    public function __construct(
+        private readonly CustomFieldService $customFieldService,
+    ) {}
+
+    /**
+     * A page of the company's definitions, newest first.
+     *
+     * The raw input goes to the filter scope untouched, so `type` (matched
+     * against the model the field is attached to) and `search` are both read
+     * there. A `limit` of "all" makes the pagination scope hand back the whole
+     * collection instead of a paginator; with no `limit` a page holds five.
+     */
+    public function index(Request $request)
+    {
+        $this->authorize('viewAny', CustomField::class);
+
+        $perPage = $request->has('limit') ? $request->limit : 5;
+
+        $definitions = CustomField::applyFilters($request->all())
+            ->whereCompany()
+            ->latest()
+            ->paginateData($perPage);
+
+        return CustomFieldResource::collection($definitions);
+    }
+
+    /**
+     * Define a new field. The company comes from the request header rather
+     * than the body, and the slug is minted once, here, from the model type
+     * and the name.
+     */
+    public function store(CustomFieldRequest $request)
+    {
+        $this->authorize('create', CustomField::class);
+
+        $companyId = (int) $request->header('company');
+
+        $customField = $this->customFieldService->create(
+            $request->validated(),
+            $request->input('default_answer'),
+            $companyId,
+        );
+
+        return new CustomFieldResource($customField);
+    }
+
+    public function show(CustomField $customField)
+    {
+        $this->authorize('view', $customField);
+
+        return new CustomFieldResource($customField);
+    }
+
+    /**
+     * Rewrite a definition in place. The slug is not among the attributes the
+     * service touches, so a renamed field answers to the name it was born
+     * with — which is what keeps existing formatting placeholders working.
+     */
+    public function update(CustomFieldRequest $request, CustomField $customField)
+    {
+        $this->authorize('update', $customField);
+
+        $this->customFieldService->update(
+            $customField,
+            $request->validated(),
+            $request->input('default_answer'),
+        );
+
+        return new CustomFieldResource($customField);
+    }
+
+    /**
+     * Delete a definition together with every answer ever recorded against it.
+     *
+     * The payload publishes `in_use`, but this endpoint never consults it:
+     * stored answers are swept first, the definition goes second, and there is
+     * no guard and nothing to confirm. Warning the operator is left to the
+     * interface. The probe in front of the sweep is redundant — an
+     * unconditional delete would remove the same rows — and is kept so the
+     * query trace stays what callers have always seen.
+     */
+    public function destroy(CustomField $customField)
+    {
+        $this->authorize('delete', $customField);
+
+        $answers = $customField->customFieldValues();
+
+        if ($answers->exists()) {
+            $answers->delete();
+        }
+
+        $customField->forceDelete();
+
+        return response()->json([
+            'success' => true,
+        ]);
+    }
+}

app/Domains/Metadata/Http/Controllers/NotesController.php

@@ -0,0 +1,114 @@
+<?php
+
+namespace App\Domains\Metadata\Http\Controllers;
+
+use App\Domains\Metadata\Http\Requests\NotesRequest;
+use App\Domains\Metadata\Http\Resources\NoteResource;
+use App\Domains\Metadata\Models\Note;
+use App\Platform\Http\Controller;
+use Illuminate\Http\Request;
+
+/**
+ * The company's library of reusable note templates.
+ *
+ * Reading answers to one ability and writing to another, which is why the
+ * gates below are named rather than resolved from the model: a member may be
+ * allowed to pick a note for a document without being allowed to edit the
+ * library it came from.
+ */
+class NotesController extends Controller
+{
+    /**
+     * A page of the company's notes, newest first, ten to a page unless the
+     * caller asks for a different size. The `type` and `search` narrowings are
+     * read off the raw input by the filter scope.
+     */
+    public function index(Request $request)
+    {
+        $this->authorize('view notes');
+
+        $perPage = $request->limit ?? 10;
+
+        $notes = Note::latest()
+            ->whereCompany()
+            ->applyFilters($request->all())
+            ->paginate($perPage);
+
+        return NoteResource::collection($notes);
+    }
+
+    /**
+     * Add a note to the library. The 201 comes from the resource itself, which
+     * notices it is wrapping a model that was only just created.
+     */
+    public function store(NotesRequest $request)
+    {
+        $this->authorize('manage notes');
+
+        $note = Note::create($request->getNotesPayload());
+
+        $this->demoteRivalDefaults($note);
+
+        return new NoteResource($note);
+    }
+
+    public function show(Note $note)
+    {
+        $this->authorize('view notes', $note);
+
+        return new NoteResource($note);
+    }
+
+    /**
+     * Edit a note. The demotion sweep runs on the saved state, so switching a
+     * note's type and its default flag in one request promotes it inside the
+     * type it has just moved to.
+     */
+    public function update(NotesRequest $request, Note $note)
+    {
+        $this->authorize('manage notes', $note);
+
+        $note->update($request->getNotesPayload());
+
+        $this->demoteRivalDefaults($note);
+
+        return new NoteResource($note);
+    }
+
+    /**
+     * Drop a note from the library. Nothing looks for references first —
+     * whether a document still names this note is not this endpoint's concern.
+     */
+    public function destroy(Note $note)
+    {
+        $this->authorize('manage notes', $note);
+
+        $note->delete();
+
+        return response()->json([
+            'success' => true,
+        ]);
+    }
+
+    /**
+     * A type can only have one default, so promoting one note clears the flag
+     * on the rest.
+     *
+     * KNOWN DEFECT, reproduced on purpose: "the rest" is narrowed by type and
+     * by "not this row" and by nothing else — no company narrowing — so saving
+     * a default note here also clears the default flag on other tenants' notes
+     * of the same type. The correction is scheduled to reach every install at
+     * once and is deliberately not made here.
+     */
+    private function demoteRivalDefaults(Note $note): void
+    {
+        if (! $note->is_default) {
+            return;
+        }
+
+        Note::where('id', '!=', $note->id)
+            ->where('type', $note->type)
+            ->where('is_default', true)
+            ->update(['is_default' => false]);
+    }
+}