crewli/api/app/Models/Scopes/FormFieldChildTableMorphScope.php

<?php

declare(strict_types=1);

namespace App\Models\Scopes;

use App\Models\Event;
use App\Models\FormBuilder\FormField;
use App\Models\FormBuilder\FormFieldLibrary;
use App\Models\FormBuilder\FormSchema;
use App\Models\Organisation;
use Illuminate\Database\Eloquent\Builder;
use Illuminate\Database\Eloquent\Model;
use Illuminate\Database\Eloquent\Scope;

/**
 * Shared base for the four polymorphic morph-scope siblings on the
 * form-field child tables (form_field_bindings,
 * form_field_validation_rules, form_field_configs, form_field_options).
 *
 * Each child table holds rows owned via (owner_type, owner_id) where
 * owner_type ∈ {form_field, form_field_library}. This scope enforces
 * organisation-tenancy on those rows by resolving the request's
 * organisation context and constraining the visible rows to:
 *
 *   owner_id ∈ (
 *     SELECT id FROM form_fields
 *       WHERE form_schema_id ∈ (
 *         SELECT id FROM form_schemas WHERE organisation_id = ?
 *       )
 *     UNION
 *     SELECT id FROM form_field_library
 *       WHERE organisation_id = ?
 *   )
 *
 * Concrete subclasses are marker classes — they exist solely to preserve
 * class identity for `Model::withoutGlobalScope(SubclassName::class)`
 * call sites in cascade observers, backfill migrations, and platform
 * super_admin escape paths.
 *
 * If a future sibling needs to vary the morph aliases or the
 * owner-chain, the relevant private helpers can be promoted to
 * protected and overridden — but YAGNI applies until that need
 * concretely materialises.
 *
 * Background: addendum §Q3 WS-5a/b/c/d Uitvoering tracked the
 * extraction-deferral discipline ("premature abstraction from N is
 * still premature when sibling N+1 is about to land"). All four
 * concrete implementations exist; this class is the answer to
 * "what actually varies" — nothing.
 */
abstract class FormFieldChildTableMorphScope implements Scope
{
    private const OWNER_TYPE_FIELD = 'form_field';
    private const OWNER_TYPE_LIBRARY = 'form_field_library';

    public function __construct(
        private readonly ?string $organisationId = null,
    ) {}

    public function apply(Builder $builder, Model $model): void
    {
        $orgId = $this->resolveOrganisationId();
        if ($orgId === null) {
            return;
        }

        $fieldIds = FormField::query()
            ->withoutGlobalScope(OrganisationScope::class)
            ->whereIn(
                'form_schema_id',
                FormSchema::query()
                    ->withoutGlobalScope(OrganisationScope::class)
                    ->where('organisation_id', $orgId)
                    ->select('id'),
            )
            ->select('id');

        $libraryIds = FormFieldLibrary::query()
            ->withoutGlobalScope(OrganisationScope::class)
            ->where('organisation_id', $orgId)
            ->select('id');

        $table = $model->getTable();

        $builder->where(function (Builder $outer) use ($table, $fieldIds, $libraryIds): void {
            $outer->where(function (Builder $q) use ($table, $fieldIds): void {
                $q->where("$table.owner_type", self::OWNER_TYPE_FIELD)
                    ->whereIn("$table.owner_id", $fieldIds);
            })->orWhere(function (Builder $q) use ($table, $libraryIds): void {
                $q->where("$table.owner_type", self::OWNER_TYPE_LIBRARY)
                    ->whereIn("$table.owner_id", $libraryIds);
            });
        });
    }

    private function resolveOrganisationId(): ?string
    {
        if ($this->organisationId !== null) {
            return $this->organisationId;
        }

        $route = request()->route();
        if ($route === null) {
            return null;
        }

        $org = $route->parameter('organisation');

        if ($org instanceof Organisation) {
            return $org->id;
        }

        if (is_string($org) && $org !== '') {
            return $org;
        }

        $event = $route->parameter('event');
        if ($event instanceof Event) {
            return $event->organisation_id;
        }

        return null;
    }
}