feat: fase 2 backend — crowd types, persons, sections, shifts, invite flow

- Crowd Types + Persons CRUD (73 tests)
- Festival Sections + Time Slots + Shifts CRUD met assign/claim flow (84 tests)
- Invite Flow + Member Management met InvitationService (109 tests)
- Schema v1.6 migraties volledig uitgevoerd
- DevSeeder bijgewerkt met crowd types voor testorganisatie

api/app/Http/Controllers/Api/V1/CompanyController.php

@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Api\V1\StoreCompanyRequest;
+use App\Http\Requests\Api\V1\UpdateCompanyRequest;
+use App\Http\Resources\Api\V1\CompanyResource;
+use App\Models\Company;
+use App\Models\Organisation;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
+use Illuminate\Support\Facades\Gate;
+
+final class CompanyController extends Controller
+{
+    public function index(Organisation $organisation): AnonymousResourceCollection
+    {
+        Gate::authorize('viewAny', [Company::class, $organisation]);
+
+        $companies = $organisation->companies()->get();
+
+        return CompanyResource::collection($companies);
+    }
+
+    public function store(StoreCompanyRequest $request, Organisation $organisation): JsonResponse
+    {
+        Gate::authorize('create', [Company::class, $organisation]);
+
+        $company = $organisation->companies()->create($request->validated());
+
+        return $this->created(new CompanyResource($company));
+    }
+
+    public function update(UpdateCompanyRequest $request, Organisation $organisation, Company $company): JsonResponse
+    {
+        Gate::authorize('update', [$company, $organisation]);
+
+        $company->update($request->validated());
+
+        return $this->success(new CompanyResource($company->fresh()));
+    }
+
+    public function destroy(Organisation $organisation, Company $company): JsonResponse
+    {
+        Gate::authorize('delete', [$company, $organisation]);
+
+        $company->delete();
+
+        return response()->json(null, 204);
+    }
+}

api/app/Http/Controllers/Api/V1/CrowdListController.php

@@ -0,0 +1,83 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Api\V1\StoreCrowdListRequest;
+use App\Http\Requests\Api\V1\UpdateCrowdListRequest;
+use App\Http\Resources\Api\V1\CrowdListResource;
+use App\Models\CrowdList;
+use App\Models\Event;
+use App\Models\Person;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
+use Illuminate\Support\Facades\Gate;
+
+final class CrowdListController extends Controller
+{
+    public function index(Event $event): AnonymousResourceCollection
+    {
+        Gate::authorize('viewAny', [CrowdList::class, $event]);
+
+        $crowdLists = $event->crowdLists()->withCount('persons')->get();
+
+        return CrowdListResource::collection($crowdLists);
+    }
+
+    public function store(StoreCrowdListRequest $request, Event $event): JsonResponse
+    {
+        Gate::authorize('create', [CrowdList::class, $event]);
+
+        $crowdList = $event->crowdLists()->create($request->validated());
+
+        return $this->created(new CrowdListResource($crowdList));
+    }
+
+    public function update(UpdateCrowdListRequest $request, Event $event, CrowdList $crowdList): JsonResponse
+    {
+        Gate::authorize('update', [$crowdList, $event]);
+
+        $crowdList->update($request->validated());
+
+        return $this->success(new CrowdListResource($crowdList->fresh()));
+    }
+
+    public function destroy(Event $event, CrowdList $crowdList): JsonResponse
+    {
+        Gate::authorize('delete', [$crowdList, $event]);
+
+        $crowdList->delete();
+
+        return response()->json(null, 204);
+    }
+
+    public function addPerson(Request $request, Event $event, CrowdList $crowdList): JsonResponse
+    {
+        Gate::authorize('managePerson', [$crowdList, $event]);
+
+        $validated = $request->validate([
+            'person_id' => ['required', 'ulid', 'exists:persons,id'],
+        ]);
+
+        $crowdList->persons()->syncWithoutDetaching([
+            $validated['person_id'] => [
+                'added_at' => now(),
+                'added_by_user_id' => $request->user()->id,
+            ],
+        ]);
+
+        return $this->success(new CrowdListResource($crowdList->fresh()->loadCount('persons')));
+    }
+
+    public function removePerson(Event $event, CrowdList $crowdList, Person $person): JsonResponse
+    {
+        Gate::authorize('managePerson', [$crowdList, $event]);
+
+        $crowdList->persons()->detach($person->id);
+
+        return response()->json(null, 204);
+    }
+}

api/app/Http/Controllers/Api/V1/CrowdTypeController.php

@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Api\V1\StoreCrowdTypeRequest;
+use App\Http\Requests\Api\V1\UpdateCrowdTypeRequest;
+use App\Http\Resources\Api\V1\CrowdTypeResource;
+use App\Models\CrowdType;
+use App\Models\Organisation;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
+use Illuminate\Support\Facades\Gate;
+
+final class CrowdTypeController extends Controller
+{
+    public function index(Organisation $organisation): AnonymousResourceCollection
+    {
+        Gate::authorize('viewAny', [CrowdType::class, $organisation]);
+
+        $crowdTypes = $organisation->crowdTypes()->where('is_active', true)->get();
+
+        return CrowdTypeResource::collection($crowdTypes);
+    }
+
+    public function store(StoreCrowdTypeRequest $request, Organisation $organisation): JsonResponse
+    {
+        Gate::authorize('create', [CrowdType::class, $organisation]);
+
+        $crowdType = $organisation->crowdTypes()->create($request->validated());
+
+        return $this->created(new CrowdTypeResource($crowdType));
+    }
+
+    public function update(UpdateCrowdTypeRequest $request, Organisation $organisation, CrowdType $crowdType): JsonResponse
+    {
+        Gate::authorize('update', [$crowdType, $organisation]);
+
+        $crowdType->update($request->validated());
+
+        return $this->success(new CrowdTypeResource($crowdType->fresh()));
+    }
+
+    public function destroy(Organisation $organisation, CrowdType $crowdType): JsonResponse
+    {
+        Gate::authorize('delete', [$crowdType, $organisation]);
+
+        if ($crowdType->persons()->exists()) {
+            $crowdType->update(['is_active' => false]);
+        } else {
+            $crowdType->delete();
+        }
+
+        return response()->json(null, 204);
+    }
+}

api/app/Http/Controllers/Api/V1/FestivalSectionController.php

@@ -0,0 +1,70 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Api\V1\ReorderFestivalSectionsRequest;
+use App\Http\Requests\Api\V1\StoreFestivalSectionRequest;
+use App\Http\Requests\Api\V1\UpdateFestivalSectionRequest;
+use App\Http\Resources\Api\V1\FestivalSectionResource;
+use App\Models\Event;
+use App\Models\FestivalSection;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
+use Illuminate\Support\Facades\Gate;
+
+final class FestivalSectionController extends Controller
+{
+    public function index(Event $event): AnonymousResourceCollection
+    {
+        Gate::authorize('viewAny', [FestivalSection::class, $event]);
+
+        $sections = $event->festivalSections()->ordered()->get();
+
+        return FestivalSectionResource::collection($sections);
+    }
+
+    public function store(StoreFestivalSectionRequest $request, Event $event): JsonResponse
+    {
+        Gate::authorize('create', [FestivalSection::class, $event]);
+
+        $section = $event->festivalSections()->create($request->validated());
+
+        return $this->created(new FestivalSectionResource($section));
+    }
+
+    public function update(UpdateFestivalSectionRequest $request, Event $event, FestivalSection $section): JsonResponse
+    {
+        Gate::authorize('update', [$section, $event]);
+
+        $section->update($request->validated());
+
+        return $this->success(new FestivalSectionResource($section->fresh()));
+    }
+
+    public function destroy(Event $event, FestivalSection $section): JsonResponse
+    {
+        Gate::authorize('delete', [$section, $event]);
+
+        $section->delete();
+
+        return response()->json(null, 204);
+    }
+
+    public function reorder(ReorderFestivalSectionsRequest $request, Event $event): JsonResponse
+    {
+        Gate::authorize('reorder', [FestivalSection::class, $event]);
+
+        foreach ($request->validated('sections') as $item) {
+            $event->festivalSections()
+                ->where('id', $item['id'])
+                ->update(['sort_order' => $item['sort_order']]);
+        }
+
+        $sections = $event->festivalSections()->ordered()->get();
+
+        return $this->success(FestivalSectionResource::collection($sections));
+    }
+}

api/app/Http/Controllers/Api/V1/InvitationController.php

@@ -0,0 +1,86 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Api\V1\AcceptInvitationRequest;
+use App\Http\Requests\Api\V1\StoreInvitationRequest;
+use App\Http\Resources\Api\V1\InvitationResource;
+use App\Models\Organisation;
+use App\Models\UserInvitation;
+use App\Services\InvitationService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Support\Facades\Gate;
+
+final class InvitationController extends Controller
+{
+    public function __construct(
+        private readonly InvitationService $invitationService,
+    ) {}
+
+    public function invite(StoreInvitationRequest $request, Organisation $organisation): JsonResponse
+    {
+        Gate::authorize('invite', $organisation);
+
+        $invitation = $this->invitationService->invite(
+            $organisation,
+            $request->validated('email'),
+            $request->validated('role'),
+            $request->user(),
+        );
+
+        return $this->created(
+            new InvitationResource($invitation->load(['organisation', 'invitedBy'])),
+            'Uitnodiging verstuurd',
+        );
+    }
+
+    public function show(string $token): JsonResponse
+    {
+        $invitation = UserInvitation::where('token', $token)
+            ->with(['organisation', 'invitedBy'])
+            ->first();
+
+        if (! $invitation) {
+            return $this->notFound('Uitnodiging niet gevonden');
+        }
+
+        return $this->success(new InvitationResource($invitation));
+    }
+
+    public function accept(AcceptInvitationRequest $request, string $token): JsonResponse
+    {
+        $invitation = UserInvitation::where('token', $token)->firstOrFail();
+
+        $user = $this->invitationService->accept(
+            $invitation,
+            $request->validated('password'),
+        );
+
+        $sanctumToken = $user->createToken('auth-token')->plainTextToken;
+
+        return $this->success([
+            'user' => [
+                'id' => $user->id,
+                'name' => $user->name,
+                'email' => $user->email,
+            ],
+            'token' => $sanctumToken,
+        ], 'Uitnodiging geaccepteerd');
+    }
+
+    public function revoke(Organisation $organisation, UserInvitation $invitation): JsonResponse
+    {
+        Gate::authorize('invite', $organisation);
+
+        if (! $invitation->isPending()) {
+            return $this->error('Alleen openstaande uitnodigingen kunnen worden ingetrokken.', 422);
+        }
+
+        $invitation->markAsExpired();
+
+        return response()->json(null, 204);
+    }
+}

api/app/Http/Controllers/Api/V1/LocationController.php

@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Api\V1\StoreLocationRequest;
+use App\Http\Requests\Api\V1\UpdateLocationRequest;
+use App\Http\Resources\Api\V1\LocationResource;
+use App\Models\Event;
+use App\Models\Location;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
+use Illuminate\Support\Facades\Gate;
+
+final class LocationController extends Controller
+{
+    public function index(Event $event): AnonymousResourceCollection
+    {
+        Gate::authorize('viewAny', [Location::class, $event]);
+
+        $locations = $event->locations()->orderBy('name')->get();
+
+        return LocationResource::collection($locations);
+    }
+
+    public function store(StoreLocationRequest $request, Event $event): JsonResponse
+    {
+        Gate::authorize('create', [Location::class, $event]);
+
+        $location = $event->locations()->create($request->validated());
+
+        return $this->created(new LocationResource($location));
+    }
+
+    public function update(UpdateLocationRequest $request, Event $event, Location $location): JsonResponse
+    {
+        Gate::authorize('update', [$location, $event]);
+
+        $location->update($request->validated());
+
+        return $this->success(new LocationResource($location->fresh()));
+    }
+
+    public function destroy(Event $event, Location $location): JsonResponse
+    {
+        Gate::authorize('delete', [$location, $event]);
+
+        $location->delete();
+
+        return response()->json(null, 204);
+    }
+}

api/app/Http/Controllers/Api/V1/MemberController.php

@@ -0,0 +1,84 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Api\V1\UpdateMemberRequest;
+use App\Http\Resources\Api\V1\MemberCollection;
+use App\Http\Resources\Api\V1\MemberResource;
+use App\Models\Organisation;
+use App\Models\User;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Support\Facades\Gate;
+
+final class MemberController extends Controller
+{
+    public function index(Organisation $organisation): MemberCollection
+    {
+        Gate::authorize('view', $organisation);
+
+        $members = $organisation->users()->get();
+
+        return new MemberCollection($members);
+    }
+
+    public function update(UpdateMemberRequest $request, Organisation $organisation, User $user): JsonResponse
+    {
+        Gate::authorize('invite', $organisation);
+
+        if ($request->user()->id === $user->id) {
+            return $this->error('Je kunt je eigen rol niet wijzigen.', 422);
+        }
+
+        $currentRole = $organisation->users()
+            ->where('user_id', $user->id)
+            ->first()?->pivot?->role;
+
+        if ($currentRole === 'org_admin' && $request->validated('role') !== 'org_admin') {
+            $adminCount = $organisation->users()
+                ->wherePivot('role', 'org_admin')
+                ->count();
+
+            if ($adminCount <= 1) {
+                return $this->error('De laatste org_admin kan niet worden gedegradeerd.', 422);
+            }
+        }
+
+        $organisation->users()->updateExistingPivot($user->id, [
+            'role' => $request->validated('role'),
+        ]);
+
+        return $this->success(
+            new MemberResource($organisation->users()->where('user_id', $user->id)->first()),
+        );
+    }
+
+    public function destroy(Organisation $organisation, User $user): JsonResponse
+    {
+        Gate::authorize('invite', $organisation);
+
+        if (request()->user()->id === $user->id) {
+            return $this->error('Je kunt je eigen account niet verwijderen uit de organisatie.', 422);
+        }
+
+        $currentRole = $organisation->users()
+            ->where('user_id', $user->id)
+            ->first()?->pivot?->role;
+
+        if ($currentRole === 'org_admin') {
+            $adminCount = $organisation->users()
+                ->wherePivot('role', 'org_admin')
+                ->count();
+
+            if ($adminCount <= 1) {
+                return $this->error('De laatste org_admin kan niet worden verwijderd.', 422);
+            }
+        }
+
+        $organisation->users()->detach($user->id);
+
+        return response()->json(null, 204);
+    }
+}

api/app/Http/Controllers/Api/V1/PersonController.php

@@ -0,0 +1,82 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Api\V1\StorePersonRequest;
+use App\Http\Requests\Api\V1\UpdatePersonRequest;
+use App\Http\Resources\Api\V1\PersonCollection;
+use App\Http\Resources\Api\V1\PersonResource;
+use App\Models\Event;
+use App\Models\Person;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Gate;
+
+final class PersonController extends Controller
+{
+    public function index(Request $request, Event $event): PersonCollection
+    {
+        Gate::authorize('viewAny', [Person::class, $event]);
+
+        $query = $event->persons()->with('crowdType');
+
+        if ($request->filled('crowd_type_id')) {
+            $query->where('crowd_type_id', $request->input('crowd_type_id'));
+        }
+
+        if ($request->filled('status')) {
+            $query->where('status', $request->input('status'));
+        }
+
+        return new PersonCollection($query->get());
+    }
+
+    public function show(Event $event, Person $person): JsonResponse
+    {
+        Gate::authorize('view', [$person, $event]);
+
+        $person->load(['crowdType', 'company']);
+
+        return $this->success(new PersonResource($person));
+    }
+
+    public function store(StorePersonRequest $request, Event $event): JsonResponse
+    {
+        Gate::authorize('create', [Person::class, $event]);
+
+        $person = $event->persons()->create($request->validated());
+
+        return $this->created(new PersonResource($person->fresh()->load('crowdType')));
+    }
+
+    public function update(UpdatePersonRequest $request, Event $event, Person $person): JsonResponse
+    {
+        Gate::authorize('update', [$person, $event]);
+
+        $person->update($request->validated());
+        $person->load(['crowdType', 'company']);
+
+        return $this->success(new PersonResource($person->fresh()->load(['crowdType', 'company'])));
+    }
+
+    public function destroy(Event $event, Person $person): JsonResponse
+    {
+        Gate::authorize('delete', [$person, $event]);
+
+        $person->delete();
+
+        return response()->json(null, 204);
+    }
+
+    public function approve(Event $event, Person $person): JsonResponse
+    {
+        Gate::authorize('approve', [$person, $event]);
+
+        $person->update(['status' => 'approved']);
+
+        return $this->success(new PersonResource($person->fresh()->load('crowdType')));
+    }
+}

api/app/Http/Controllers/Api/V1/ShiftController.php

@@ -0,0 +1,148 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Api\V1\AssignShiftRequest;
+use App\Http\Requests\Api\V1\StoreShiftRequest;
+use App\Http\Requests\Api\V1\UpdateShiftRequest;
+use App\Http\Resources\Api\V1\ShiftAssignmentResource;
+use App\Http\Resources\Api\V1\ShiftResource;
+use App\Models\Event;
+use App\Models\FestivalSection;
+use App\Models\Shift;
+use App\Models\ShiftAssignment;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
+use Illuminate\Support\Facades\Gate;
+
+final class ShiftController extends Controller
+{
+    public function index(Event $event, FestivalSection $section): AnonymousResourceCollection
+    {
+        Gate::authorize('viewAny', [Shift::class, $event]);
+
+        $shifts = $section->shifts()
+            ->with(['timeSlot', 'location'])
+            ->get();
+
+        return ShiftResource::collection($shifts);
+    }
+
+    public function store(StoreShiftRequest $request, Event $event, FestivalSection $section): JsonResponse
+    {
+        Gate::authorize('create', [Shift::class, $event]);
+
+        $shift = $section->shifts()->create($request->validated());
+        $shift->load(['timeSlot', 'location']);
+
+        return $this->created(new ShiftResource($shift));
+    }
+
+    public function update(UpdateShiftRequest $request, Event $event, FestivalSection $section, Shift $shift): JsonResponse
+    {
+        Gate::authorize('update', [$shift, $event, $section]);
+
+        $shift->update($request->validated());
+        $shift->load(['timeSlot', 'location']);
+
+        return $this->success(new ShiftResource($shift->fresh()->load(['timeSlot', 'location'])));
+    }
+
+    public function destroy(Event $event, FestivalSection $section, Shift $shift): JsonResponse
+    {
+        Gate::authorize('delete', [$shift, $event, $section]);
+
+        $shift->delete();
+
+        return response()->json(null, 204);
+    }
+
+    public function assign(AssignShiftRequest $request, Event $event, FestivalSection $section, Shift $shift): JsonResponse
+    {
+        Gate::authorize('assign', [$shift, $event, $section]);
+
+        $personId = $request->validated('person_id');
+
+        // Check if shift is full
+        $approvedCount = $shift->shiftAssignments()->where('status', 'approved')->count();
+        if ($approvedCount >= $shift->slots_total) {
+            return $this->error('Shift is vol — alle slots zijn bezet.', 422);
+        }
+
+        // Check overlap conflict if allow_overlap is false
+        if (! $shift->allow_overlap) {
+            $conflict = ShiftAssignment::where('person_id', $personId)
+                ->where('time_slot_id', $shift->time_slot_id)
+                ->whereNotIn('status', ['rejected', 'cancelled'])
+                ->exists();
+
+            if ($conflict) {
+                return $this->error('Deze persoon is al ingepland voor dit tijdslot.', 422);
+            }
+        }
+
+        $autoApprove = $section->crew_auto_accepts;
+
+        $assignment = $shift->shiftAssignments()->create([
+            'person_id' => $personId,
+            'time_slot_id' => $shift->time_slot_id,
+            'status' => $autoApprove ? 'approved' : 'approved',
+            'auto_approved' => $autoApprove,
+            'assigned_by' => $request->user()->id,
+            'assigned_at' => now(),
+            'approved_at' => now(),
+        ]);
+
+        // Update shift status if full
+        $newApprovedCount = $shift->shiftAssignments()->where('status', 'approved')->count();
+        if ($newApprovedCount >= $shift->slots_total) {
+            $shift->update(['status' => 'full']);
+        }
+
+        return $this->created(new ShiftAssignmentResource($assignment));
+    }
+
+    public function claim(AssignShiftRequest $request, Event $event, FestivalSection $section, Shift $shift): JsonResponse
+    {
+        Gate::authorize('claim', [$shift, $event, $section]);
+
+        $personId = $request->validated('person_id');
+
+        // Check claiming slots available
+        $claimedCount = $shift->shiftAssignments()
+            ->whereNotIn('status', ['rejected', 'cancelled'])
+            ->count();
+
+        if ($shift->slots_open_for_claiming <= 0 || $claimedCount >= $shift->slots_open_for_claiming) {
+            return $this->error('Geen claimbare slots beschikbaar voor deze shift.', 422);
+        }
+
+        // Check overlap conflict if allow_overlap is false
+        if (! $shift->allow_overlap) {
+            $conflict = ShiftAssignment::where('person_id', $personId)
+                ->where('time_slot_id', $shift->time_slot_id)
+                ->whereNotIn('status', ['rejected', 'cancelled'])
+                ->exists();
+
+            if ($conflict) {
+                return $this->error('Deze persoon is al ingepland voor dit tijdslot.', 422);
+            }
+        }
+
+        $autoApprove = $section->crew_auto_accepts;
+
+        $assignment = $shift->shiftAssignments()->create([
+            'person_id' => $personId,
+            'time_slot_id' => $shift->time_slot_id,
+            'status' => $autoApprove ? 'approved' : 'pending_approval',
+            'auto_approved' => $autoApprove,
+            'assigned_at' => now(),
+            'approved_at' => $autoApprove ? now() : null,
+        ]);
+
+        return $this->created(new ShiftAssignmentResource($assignment));
+    }
+}

api/app/Http/Controllers/Api/V1/TimeSlotController.php

@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Api\V1\StoreTimeSlotRequest;
+use App\Http\Requests\Api\V1\UpdateTimeSlotRequest;
+use App\Http\Resources\Api\V1\TimeSlotResource;
+use App\Models\Event;
+use App\Models\TimeSlot;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
+use Illuminate\Support\Facades\Gate;
+
+final class TimeSlotController extends Controller
+{
+    public function index(Event $event): AnonymousResourceCollection
+    {
+        Gate::authorize('viewAny', [TimeSlot::class, $event]);
+
+        $timeSlots = $event->timeSlots()->orderBy('date')->orderBy('start_time')->get();
+
+        return TimeSlotResource::collection($timeSlots);
+    }
+
+    public function store(StoreTimeSlotRequest $request, Event $event): JsonResponse
+    {
+        Gate::authorize('create', [TimeSlot::class, $event]);
+
+        $timeSlot = $event->timeSlots()->create($request->validated());
+
+        return $this->created(new TimeSlotResource($timeSlot));
+    }
+
+    public function update(UpdateTimeSlotRequest $request, Event $event, TimeSlot $timeSlot): JsonResponse
+    {
+        Gate::authorize('update', [$timeSlot, $event]);
+
+        $timeSlot->update($request->validated());
+
+        return $this->success(new TimeSlotResource($timeSlot->fresh()));
+    }
+
+    public function destroy(Event $event, TimeSlot $timeSlot): JsonResponse
+    {
+        Gate::authorize('delete', [$timeSlot, $event]);
+
+        $timeSlot->delete();
+
+        return response()->json(null, 204);
+    }
+}

api/app/Http/Requests/Api/V1/AcceptInvitationRequest.php

@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use App\Models\User;
+use App\Models\UserInvitation;
+use Illuminate\Foundation\Http\FormRequest;
+
+final class AcceptInvitationRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        $invitation = UserInvitation::where('token', $this->route('token'))->first();
+        $userExists = $invitation && User::where('email', $invitation->email)->exists();
+
+        return [
+            'name' => [$userExists ? 'nullable' : 'required', 'string', 'max:255'],
+            'password' => [$userExists ? 'nullable' : 'required', 'string', 'min:8', 'confirmed'],
+        ];
+    }
+}

api/app/Http/Requests/Api/V1/AssignShiftRequest.php

@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class AssignShiftRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'person_id' => ['required', 'ulid', 'exists:persons,id'],
+        ];
+    }
+}

api/app/Http/Requests/Api/V1/ReorderFestivalSectionsRequest.php

@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class ReorderFestivalSectionsRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'sections' => ['required', 'array'],
+            'sections.*.id' => ['required', 'ulid'],
+            'sections.*.sort_order' => ['required', 'integer', 'min:0'],
+        ];
+    }
+}

api/app/Http/Requests/Api/V1/StoreCompanyRequest.php

@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class StoreCompanyRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'type' => ['required', 'in:supplier,partner,agency,venue,other'],
+            'contact_name' => ['nullable', 'string', 'max:255'],
+            'contact_email' => ['nullable', 'email', 'max:255'],
+            'contact_phone' => ['nullable', 'string', 'max:30'],
+        ];
+    }
+}

api/app/Http/Requests/Api/V1/StoreCrowdListRequest.php

@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class StoreCrowdListRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'crowd_type_id' => ['required', 'ulid', 'exists:crowd_types,id'],
+            'name' => ['required', 'string', 'max:255'],
+            'type' => ['required', 'in:internal,external'],
+            'recipient_company_id' => ['nullable', 'ulid', 'exists:companies,id'],
+            'auto_approve' => ['sometimes', 'boolean'],
+            'max_persons' => ['nullable', 'integer', 'min:1'],
+        ];
+    }
+}

api/app/Http/Requests/Api/V1/StoreCrowdTypeRequest.php

@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class StoreCrowdTypeRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:100'],
+            'system_type' => ['required', 'in:CREW,GUEST,ARTIST,VOLUNTEER,PRESS,PARTNER,SUPPLIER'],
+            'color' => ['required', 'regex:/^#[0-9A-Fa-f]{6}$/'],
+            'icon' => ['nullable', 'string', 'max:50'],
+        ];
+    }
+}

api/app/Http/Requests/Api/V1/StoreFestivalSectionRequest.php

@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class StoreFestivalSectionRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'sort_order' => ['nullable', 'integer', 'min:0'],
+            'type' => ['nullable', 'in:standard,cross_event'],
+            'crew_auto_accepts' => ['nullable', 'boolean'],
+            'responder_self_checkin' => ['nullable', 'boolean'],
+        ];
+    }
+}

api/app/Http/Requests/Api/V1/StoreInvitationRequest.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class StoreInvitationRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'email' => ['required', 'email', 'max:255'],
+            'role' => ['required', 'in:org_admin,org_member,event_manager,staff_coordinator,volunteer_coordinator'],
+        ];
+    }
+}

api/app/Http/Requests/Api/V1/StoreLocationRequest.php

@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class StoreLocationRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'address' => ['nullable', 'string', 'max:255'],
+            'lat' => ['nullable', 'numeric', 'between:-90,90'],
+            'lng' => ['nullable', 'numeric', 'between:-180,180'],
+            'description' => ['nullable', 'string'],
+            'access_instructions' => ['nullable', 'string'],
+        ];
+    }
+}

api/app/Http/Requests/Api/V1/StorePersonRequest.php

@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class StorePersonRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'crowd_type_id' => ['required', 'ulid', 'exists:crowd_types,id'],
+            'name' => ['required', 'string', 'max:255'],
+            'email' => ['required', 'email', 'max:255'],
+            'phone' => ['nullable', 'string', 'max:30'],
+            'company_id' => ['nullable', 'ulid', 'exists:companies,id'],
+            'status' => ['nullable', 'in:invited,applied,pending,approved,rejected,no_show'],
+            'custom_fields' => ['nullable', 'array'],
+        ];
+    }
+}

api/app/Http/Requests/Api/V1/StoreShiftRequest.php

@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class StoreShiftRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'time_slot_id' => ['required', 'ulid', 'exists:time_slots,id'],
+            'location_id' => ['nullable', 'ulid', 'exists:locations,id'],
+            'title' => ['nullable', 'string', 'max:255'],
+            'description' => ['nullable', 'string'],
+            'instructions' => ['nullable', 'string'],
+            'coordinator_notes' => ['nullable', 'string'],
+            'slots_total' => ['required', 'integer', 'min:1'],
+            'slots_open_for_claiming' => ['required', 'integer', 'min:0', 'lte:slots_total'],
+            'report_time' => ['nullable', 'date_format:H:i'],
+            'actual_start_time' => ['nullable', 'date_format:H:i'],
+            'actual_end_time' => ['nullable', 'date_format:H:i'],
+            'is_lead_role' => ['nullable', 'boolean'],
+            'allow_overlap' => ['nullable', 'boolean'],
+            'status' => ['nullable', 'in:draft,open,full,in_progress,completed,cancelled'],
+        ];
+    }
+}

api/app/Http/Requests/Api/V1/StoreTimeSlotRequest.php

@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class StoreTimeSlotRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'person_type' => ['required', 'in:CREW,VOLUNTEER,PRESS,PHOTO,PARTNER'],
+            'date' => ['required', 'date'],
+            'start_time' => ['required', 'date_format:H:i'],
+            'end_time' => ['required', 'date_format:H:i'],
+            'duration_hours' => ['nullable', 'numeric', 'min:0.5', 'max:24'],
+        ];
+    }
+}

api/app/Http/Requests/Api/V1/UpdateCompanyRequest.php

@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class UpdateCompanyRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'name' => ['sometimes', 'string', 'max:255'],
+            'type' => ['sometimes', 'in:supplier,partner,agency,venue,other'],
+            'contact_name' => ['nullable', 'string', 'max:255'],
+            'contact_email' => ['nullable', 'email', 'max:255'],
+            'contact_phone' => ['nullable', 'string', 'max:30'],
+        ];
+    }
+}

api/app/Http/Requests/Api/V1/UpdateCrowdListRequest.php

@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class UpdateCrowdListRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'crowd_type_id' => ['sometimes', 'ulid', 'exists:crowd_types,id'],
+            'name' => ['sometimes', 'string', 'max:255'],
+            'type' => ['sometimes', 'in:internal,external'],
+            'recipient_company_id' => ['nullable', 'ulid', 'exists:companies,id'],
+            'auto_approve' => ['sometimes', 'boolean'],
+            'max_persons' => ['nullable', 'integer', 'min:1'],
+        ];
+    }
+}

api/app/Http/Requests/Api/V1/UpdateCrowdTypeRequest.php

@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class UpdateCrowdTypeRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'name' => ['sometimes', 'string', 'max:100'],
+            'color' => ['sometimes', 'regex:/^#[0-9A-Fa-f]{6}$/'],
+            'icon' => ['nullable', 'string', 'max:50'],
+            'is_active' => ['sometimes', 'boolean'],
+        ];
+    }
+}

api/app/Http/Requests/Api/V1/UpdateFestivalSectionRequest.php

@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class UpdateFestivalSectionRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'name' => ['sometimes', 'string', 'max:255'],
+            'sort_order' => ['sometimes', 'integer', 'min:0'],
+            'type' => ['sometimes', 'in:standard,cross_event'],
+            'crew_auto_accepts' => ['sometimes', 'boolean'],
+            'responder_self_checkin' => ['sometimes', 'boolean'],
+            'crew_need' => ['nullable', 'integer', 'min:0'],
+            'crew_invited_to_events' => ['sometimes', 'boolean'],
+            'added_to_timeline' => ['sometimes', 'boolean'],
+            'timed_accreditations' => ['sometimes', 'boolean'],
+            'crew_accreditation_level' => ['nullable', 'string', 'max:50'],
+            'public_form_accreditation_level' => ['nullable', 'string', 'max:50'],
+        ];
+    }
+}

api/app/Http/Requests/Api/V1/UpdateLocationRequest.php

@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class UpdateLocationRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'name' => ['sometimes', 'string', 'max:255'],
+            'address' => ['nullable', 'string', 'max:255'],
+            'lat' => ['nullable', 'numeric', 'between:-90,90'],
+            'lng' => ['nullable', 'numeric', 'between:-180,180'],
+            'description' => ['nullable', 'string'],
+            'access_instructions' => ['nullable', 'string'],
+        ];
+    }
+}

api/app/Http/Requests/Api/V1/UpdateMemberRequest.php

@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class UpdateMemberRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'role' => ['required', 'in:org_admin,org_member,event_manager,staff_coordinator,volunteer_coordinator'],
+        ];
+    }
+}

api/app/Http/Requests/Api/V1/UpdatePersonRequest.php

@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class UpdatePersonRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'crowd_type_id' => ['sometimes', 'ulid', 'exists:crowd_types,id'],
+            'name' => ['sometimes', 'string', 'max:255'],
+            'email' => ['sometimes', 'email', 'max:255'],
+            'phone' => ['nullable', 'string', 'max:30'],
+            'company_id' => ['nullable', 'ulid', 'exists:companies,id'],
+            'status' => ['sometimes', 'in:invited,applied,pending,approved,rejected,no_show'],
+            'is_blacklisted' => ['sometimes', 'boolean'],
+            'admin_notes' => ['nullable', 'string'],
+            'custom_fields' => ['nullable', 'array'],
+        ];
+    }
+}

api/app/Http/Requests/Api/V1/UpdateShiftRequest.php

@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class UpdateShiftRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'time_slot_id' => ['sometimes', 'ulid', 'exists:time_slots,id'],
+            'location_id' => ['nullable', 'ulid', 'exists:locations,id'],
+            'title' => ['nullable', 'string', 'max:255'],
+            'description' => ['nullable', 'string'],
+            'instructions' => ['nullable', 'string'],
+            'coordinator_notes' => ['nullable', 'string'],
+            'slots_total' => ['sometimes', 'integer', 'min:1'],
+            'slots_open_for_claiming' => ['sometimes', 'integer', 'min:0'],
+            'report_time' => ['nullable', 'date_format:H:i'],
+            'actual_start_time' => ['nullable', 'date_format:H:i'],
+            'actual_end_time' => ['nullable', 'date_format:H:i'],
+            'is_lead_role' => ['nullable', 'boolean'],
+            'allow_overlap' => ['nullable', 'boolean'],
+            'status' => ['sometimes', 'in:draft,open,full,in_progress,completed,cancelled'],
+        ];
+    }
+}

api/app/Http/Requests/Api/V1/UpdateTimeSlotRequest.php

@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class UpdateTimeSlotRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'name' => ['sometimes', 'string', 'max:255'],
+            'person_type' => ['sometimes', 'in:CREW,VOLUNTEER,PRESS,PHOTO,PARTNER'],
+            'date' => ['sometimes', 'date'],
+            'start_time' => ['sometimes', 'date_format:H:i'],
+            'end_time' => ['sometimes', 'date_format:H:i'],
+            'duration_hours' => ['nullable', 'numeric', 'min:0.5', 'max:24'],
+        ];
+    }
+}

api/app/Http/Resources/Api/V1/CompanyResource.php

@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources\Api\V1;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+final class CompanyResource extends JsonResource
+{
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'organisation_id' => $this->organisation_id,
+            'name' => $this->name,
+            'type' => $this->type,
+            'contact_name' => $this->contact_name,
+            'contact_email' => $this->contact_email,
+            'contact_phone' => $this->contact_phone,
+            'created_at' => $this->created_at->toIso8601String(),
+        ];
+    }
+}

api/app/Http/Resources/Api/V1/CrowdListResource.php

@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources\Api\V1;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+final class CrowdListResource extends JsonResource
+{
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'event_id' => $this->event_id,
+            'crowd_type_id' => $this->crowd_type_id,
+            'name' => $this->name,
+            'type' => $this->type,
+            'recipient_company_id' => $this->recipient_company_id,
+            'auto_approve' => $this->auto_approve,
+            'max_persons' => $this->max_persons,
+            'created_at' => $this->created_at->toIso8601String(),
+            'persons_count' => $this->whenCounted('persons'),
+        ];
+    }
+}

api/app/Http/Resources/Api/V1/CrowdTypeResource.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources\Api\V1;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+final class CrowdTypeResource extends JsonResource
+{
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'organisation_id' => $this->organisation_id,
+            'name' => $this->name,
+            'system_type' => $this->system_type,
+            'color' => $this->color,
+            'icon' => $this->icon,
+            'is_active' => $this->is_active,
+        ];
+    }
+}

api/app/Http/Resources/Api/V1/FestivalSectionResource.php

@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources\Api\V1;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+final class FestivalSectionResource extends JsonResource
+{
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'event_id' => $this->event_id,
+            'name' => $this->name,
+            'type' => $this->type,
+            'sort_order' => $this->sort_order,
+            'crew_need' => $this->crew_need,
+            'crew_auto_accepts' => $this->crew_auto_accepts,
+            'responder_self_checkin' => $this->responder_self_checkin,
+            'added_to_timeline' => $this->added_to_timeline,
+            'crew_accreditation_level' => $this->crew_accreditation_level,
+            'created_at' => $this->created_at->toIso8601String(),
+            'shifts_count' => $this->whenCounted('shifts'),
+        ];
+    }
+}

api/app/Http/Resources/Api/V1/InvitationResource.php

@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources\Api\V1;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+final class InvitationResource extends JsonResource
+{
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'email' => $this->email,
+            'role' => $this->role,
+            'status' => $this->isExpired() && $this->isPending() ? 'expired' : $this->status,
+            'expires_at' => $this->expires_at->toIso8601String(),
+            'created_at' => $this->created_at->toIso8601String(),
+            'organisation' => $this->whenLoaded('organisation', fn () => [
+                'name' => $this->organisation->name,
+            ]),
+            'invited_by' => $this->whenLoaded('invitedBy', fn () => [
+                'name' => $this->invitedBy?->name,
+            ]),
+        ];
+    }
+}

api/app/Http/Resources/Api/V1/LocationResource.php

@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources\Api\V1;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+final class LocationResource extends JsonResource
+{
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'event_id' => $this->event_id,
+            'name' => $this->name,
+            'address' => $this->address,
+            'lat' => $this->lat,
+            'lng' => $this->lng,
+            'description' => $this->description,
+            'access_instructions' => $this->access_instructions,
+            'created_at' => $this->created_at->toIso8601String(),
+        ];
+    }
+}

api/app/Http/Resources/Api/V1/MemberCollection.php

@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources\Api\V1;
+
+use App\Models\UserInvitation;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\ResourceCollection;
+
+final class MemberCollection extends ResourceCollection
+{
+    public $collects = MemberResource::class;
+
+    public function toArray(Request $request): array
+    {
+        return [
+            'data' => $this->collection,
+        ];
+    }
+
+    /** @return array<string, mixed> */
+    public function with(Request $request): array
+    {
+        $organisation = $request->route('organisation');
+
+        return [
+            'meta' => [
+                'total_members' => $this->collection->count(),
+                'pending_invitations_count' => UserInvitation::where('organisation_id', $organisation->id)
+                    ->pending()
+                    ->where('expires_at', '>', now())
+                    ->count(),
+            ],
+        ];
+    }
+}

api/app/Http/Resources/Api/V1/MemberResource.php

@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources\Api\V1;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+final class MemberResource extends JsonResource
+{
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'name' => $this->name,
+            'email' => $this->email,
+            'role' => $this->pivot?->role,
+            'avatar' => $this->avatar,
+            'event_roles' => $this->whenLoaded('events', fn () =>
+                $this->events->map(fn ($event) => [
+                    'event_id' => $event->id,
+                    'event_name' => $event->name,
+                    'role' => $event->pivot->role,
+                ])
+            ),
+        ];
+    }
+}

api/app/Http/Resources/Api/V1/PersonCollection.php

@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources\Api\V1;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\ResourceCollection;
+
+final class PersonCollection extends ResourceCollection
+{
+    public $collects = PersonResource::class;
+
+    public function toArray(Request $request): array
+    {
+        return [
+            'data' => $this->collection,
+        ];
+    }
+
+    public function with(Request $request): array
+    {
+        $persons = $this->collection;
+
+        $byCrowdType = $persons->groupBy(fn ($person) => $person->crowd_type_id);
+
+        $crowdTypeMeta = [];
+        foreach ($byCrowdType as $crowdTypeId => $group) {
+            $crowdTypeMeta[$crowdTypeId] = [
+                'approved_count' => $group->where('status', 'approved')->count(),
+                'pending_count' => $group->where('status', 'pending')->count(),
+            ];
+        }
+
+        return [
+            'meta' => [
+                'total' => $persons->count(),
+                'approved_count' => $persons->where('status', 'approved')->count(),
+                'pending_count' => $persons->where('status', 'pending')->count(),
+                'by_crowd_type' => $crowdTypeMeta,
+            ],
+        ];
+    }
+}

api/app/Http/Resources/Api/V1/PersonResource.php

@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources\Api\V1;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+final class PersonResource extends JsonResource
+{
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'event_id' => $this->event_id,
+            'name' => $this->name,
+            'email' => $this->email,
+            'phone' => $this->phone,
+            'status' => $this->status,
+            'is_blacklisted' => $this->is_blacklisted,
+            'admin_notes' => $this->admin_notes,
+            'custom_fields' => $this->custom_fields,
+            'created_at' => $this->created_at->toIso8601String(),
+            'crowd_type' => new CrowdTypeResource($this->whenLoaded('crowdType')),
+            'company' => new CompanyResource($this->whenLoaded('company')),
+        ];
+    }
+}

api/app/Http/Resources/Api/V1/ShiftAssignmentResource.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources\Api\V1;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+final class ShiftAssignmentResource extends JsonResource
+{
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'shift_id' => $this->shift_id,
+            'person_id' => $this->person_id,
+            'status' => $this->status,
+            'auto_approved' => $this->auto_approved,
+            'assigned_at' => $this->assigned_at?->toIso8601String(),
+            'approved_at' => $this->approved_at?->toIso8601String(),
+        ];
+    }
+}

api/app/Http/Resources/Api/V1/ShiftResource.php

@@ -0,0 +1,71 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources\Api\V1;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+final class ShiftResource extends JsonResource
+{
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'festival_section_id' => $this->festival_section_id,
+            'time_slot_id' => $this->time_slot_id,
+            'location_id' => $this->location_id,
+            'title' => $this->title,
+            'description' => $this->description,
+            'instructions' => $this->instructions,
+            'coordinator_notes' => $this->when(
+                $this->shouldShowCoordinatorNotes($request),
+                $this->coordinator_notes,
+            ),
+            'slots_total' => $this->slots_total,
+            'slots_open_for_claiming' => $this->slots_open_for_claiming,
+            'is_lead_role' => $this->is_lead_role,
+            'report_time' => $this->report_time,
+            'actual_start_time' => $this->actual_start_time,
+            'actual_end_time' => $this->actual_end_time,
+            'allow_overlap' => $this->allow_overlap,
+            'status' => $this->status,
+            'filled_slots' => $this->filled_slots,
+            'fill_rate' => $this->fill_rate,
+            'effective_start_time' => $this->effective_start_time,
+            'effective_end_time' => $this->effective_end_time,
+            'created_at' => $this->created_at->toIso8601String(),
+            'time_slot' => new TimeSlotResource($this->whenLoaded('timeSlot')),
+            'location' => new LocationResource($this->whenLoaded('location')),
+            'festival_section' => new FestivalSectionResource($this->whenLoaded('festivalSection')),
+        ];
+    }
+
+    private function shouldShowCoordinatorNotes(Request $request): bool
+    {
+        $user = $request->user();
+        if (! $user) {
+            return false;
+        }
+
+        if ($user->hasRole('super_admin')) {
+            return true;
+        }
+
+        $shift = $this->resource;
+        $event = $shift->festivalSection?->event;
+        if (! $event) {
+            return false;
+        }
+
+        return $event->organisation->users()
+            ->where('user_id', $user->id)
+            ->wherePivot('role', 'org_admin')
+            ->exists()
+            || $event->users()
+                ->where('user_id', $user->id)
+                ->wherePivot('role', 'event_manager')
+                ->exists();
+    }
+}

api/app/Http/Resources/Api/V1/TimeSlotResource.php

@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources\Api\V1;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+final class TimeSlotResource extends JsonResource
+{
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'event_id' => $this->event_id,
+            'name' => $this->name,
+            'person_type' => $this->person_type,
+            'date' => $this->date->toDateString(),
+            'start_time' => $this->start_time,
+            'end_time' => $this->end_time,
+            'duration_hours' => $this->duration_hours,
+            'created_at' => $this->created_at->toIso8601String(),
+        ];
+    }
+}