phpvms/app/Http/Controllers/Auth/RegisterController.php

<?php

namespace App\Http\Controllers\Auth;

use App\Contracts\Controller;
use App\Enums\UserState;
use App\Models\Airline;
use App\Models\Invite;
use App\Models\User;
use App\Models\UserField;
use App\Models\UserFieldValue;
use App\Services\UserService;
use App\Support\Countries;
use App\Support\HttpClient;
use App\Support\Timezonelist;
use Exception;
use Illuminate\Contracts\Validation\Validator;
use Illuminate\Foundation\Auth\RegistersUsers;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Log;
use Illuminate\Support\Facades\Validator as ValidatorFacade;
use Illuminate\View\View;
use RuntimeException;

class RegisterController extends Controller
{
    use RegistersUsers;

    /**
     * Where to redirect users after login / registration.
     *
     * @var string
     */
    protected $redirectTo = '/';

    /**
     * RegisterController constructor.
     */
    public function __construct(
        private readonly HttpClient $httpClient,
        private readonly UserService $userService,
    ) {
        $this->middleware('guest');

        $this->redirectTo = config('phpvms.registration_redirect');
    }

    public function showRegistrationForm(Request $request): View
    {
        if (setting('general.disable_registrations', false)) {
            abort(403, 'Registrations are disabled');
        }

        if (setting('general.invite_only_registrations', false)) {
            if (!$request->has('invite') && !$request->has('token')) {
                abort(403, 'Registrations are invite only');
            }

            $invite = Invite::find($request->input('invite'));
            if (!$invite || $invite->token !== $request->input('token')) {
                abort(403, 'Invalid invite');
            }

            if ($invite->usage_limit && $invite->usage_count >= $invite->usage_limit) {
                abort(403, 'Invite has been used too many times');
            }

            if ($invite->expires_at && $invite->expires_at->isPast()) {
                abort(403, 'Invite has expired');
            }
        }

        $airlines = Airline::selectList();
        $userFields = UserField::where(['show_on_registration' => true, 'active' => true, 'internal' => false])->get();

        return view('auth.register', [
            'airports'   => [],
            'airlines'   => $airlines,
            'countries'  => Countries::getSelectList(),
            'timezones'  => Timezonelist::toArray(),
            'userFields' => $userFields,
            'hubs_only'  => setting('pilots.home_hubs_only'),
            'invite'     => $invite ?? null,
            'captcha'    => [
                'enabled'    => setting('captcha.enabled', false),
                'site_key'   => setting('captcha.site_key', ''),
                'secret_key' => setting('captcha.secret_key', ''),
            ],
        ]);
    }

    /**
     * Get a validator for an incoming registration request.
     */
    protected function validator(array $data): Validator
    {
        if (isset($data['email'])) {
            $data['email'] = mb_strtolower(trim((string) $data['email']));
        }

        $rules = [
            'name'            => 'required|max:255',
            'email'           => 'required|email|max:255|unique:users,email',
            'airline_id'      => 'required',
            'home_airport_id' => 'required',
            'password'        => 'required|min:5|confirmed',
            'toc_accepted'    => 'accepted',
        ];

        // Dynamically add the required fields
        $userFields = UserField::where([
            'show_on_registration' => true,
            'required'             => true,
            'internal'             => false,
            'active'               => true,
        ])->get();

        foreach ($userFields as $field) {
            $rules['field_'.$field->slug] = 'required';
        }

        /*
         * Validation for hcaptcha
         */
        $captcha_enabled = setting('captcha.enabled', false);
        if ($captcha_enabled === true) {
            $rules['h-captcha-response'] = [
                'required',
                function ($attribute, $value, $fail): void {
                    $response = $this->httpClient->form_post('https://hcaptcha.com/siteverify', [
                        'secret'   => setting('captcha.secret_key', ''),
                        'response' => $value,
                    ]);

                    if ($response['success'] !== true) {
                        Log::error('Captcha failed '.json_encode($response));
                        $fail('Captcha verification failed, please try again.');
                    }
                },
            ];
        }

        return ValidatorFacade::make($data, $rules);
    }

    /**
     * Get a validator for an incoming registration request.
     *
     * @throws Exception
     * @throws RuntimeException
     */
    protected function create(Request $request): User
    {
        if (setting('general.disable_registrations', false)) {
            abort(403, 'Registrations are disabled');
        }

        $request->merge([
            'email' => mb_strtolower(trim((string) $request->input('email'))),
        ]);

        if (setting('general.invite_only_registrations', false)) {
            if (!$request->has('invite') && !$request->has('invite_token')) {
                abort(403, 'Registrations are invite only');
            }

            $invite = Invite::find($request->input('invite'));
            if (!$invite || $invite->token !== base64_decode((string) $request->input('invite_token'))) {
                abort(403, 'Invalid invite');
            }

            if ($invite->usage_limit && $invite->usage_count >= $invite->usage_limit) {
                abort(403, 'Invite has been used too many times');
            }

            if ($invite->expires_at && $invite->expires_at->isPast()) {
                abort(403, 'Invite has expired');
            }

            if ($invite->email && $invite->email !== $request->input('email')) {
                abort(403, 'Invite is for a different email address');
            }

            $invite->update([
                'usage_count' => $invite->usage_count + 1,
            ]);
        }

        // Default options
        $opts = $request->all();
        $opts['password'] = Hash::make($opts['password']);

        if (setting('general.record_user_ip', true)) {
            $opts['last_ip'] = $request->ip();
        }

        // Convert transfer hours into minutes
        if (isset($opts['transfer_time'])) {
            $opts['transfer_time'] *= 60;
        }

        $user = $this->userService->createUser($opts);

        Log::info('User registered: ', $user->toArray());

        $userFields = UserField::where(['show_on_registration' => true, 'active' => true, 'internal' => false])->get();
        foreach ($userFields as $field) {
            $field_name = 'field_'.$field->slug;
            UserFieldValue::updateOrCreate([
                'user_field_id' => $field->id,
                'user_id'       => $user->id,
            ], ['value' => $opts[$field_name]]);
        }

        return $user;
    }

    /**
     * Handle a registration request for the application.
     *
     *
     * @throws Exception
     */
    public function register(Request $request): RedirectResponse|View
    {
        $this->validator($request->all())->validate();

        $user = $this->create($request);
        if ($user->state === UserState::PENDING) {
            return view('auth.pending');
        }

        $this->guard()->login($user);

        return redirect('/dashboard');
    }
}