orderBy('created_at', 'desc'); // Filtrar por usuario: solo admin puede ver todas las ventas if (!auth()->user()->hasRole('admin')) { $sales->where('user_id', auth()->id()); } if ($request->has('q') && $request->q) { $sales->where(function ($query) use ($request) { $query->where('invoice_number', 'like', "%{$request->q}%") ->orWhereHas('user', fn($q) => $q->where('name', 'like', "%{$request->q}%") ); }); } if ($request->has('cash_register_id')) { $sales->where('cash_register_id', $request->cash_register_id); } if ($request->has('status')) { $sales->where('status', $request->status); } return ApiResponse::OK->response([ 'sales' => $sales->paginate(config('app.pagination')), ]); } public function show(Sale $sale) { // Solo admin puede ver ventas de otros usuarios if (!auth()->user()->hasRole('admin') && $sale->user_id !== auth()->id()) { return ApiResponse::FORBIDDEN->response([ 'message' => 'No tienes permiso para ver esta venta.' ]); } return ApiResponse::OK->response([ 'model' => $sale->load(['details.inventory', 'user', 'client']) ]); } public function store(SaleStoreRequest $request) { $sale = $this->saleService->createSale($request->validated()); return ApiResponse::CREATED->response([ 'model' => $sale, ]); } public function cancel(Sale $sale) { // Solo admin puede cancelar ventas de otros usuarios if (!auth()->user()->hasRole('admin') && $sale->user_id !== auth()->id()) { return ApiResponse::FORBIDDEN->response([ 'message' => 'No tienes permiso para cancelar esta venta.' ]); } try { $cancelledSale = $this->saleService->cancelSale($sale); return ApiResponse::OK->response([ 'model' => $cancelledSale, 'message' => 'Venta cancelada exitosamente. Stock restaurado.' ]); } catch (\Exception $e) { return ApiResponse::BAD_REQUEST->response([ 'message' => $e->getMessage() ]); } } }