pdv.backend/app/Http/Controllers/App/SaleController.php

<?php

namespace App\Http\Controllers\App;

use App\Http\Controllers\Controller;
use App\Http\Requests\App\SaleStoreRequest;
use App\Services\SaleService;
use App\Models\Sale;
use Illuminate\Http\Request;
use Notsoweb\ApiResponse\Enums\ApiResponse;

class SaleController extends Controller
{
    public function __construct(
        protected SaleService $saleService
    ) {}

    public function index(Request $request)
    {
        $sales = Sale::with(['details.inventory', 'details.serials', 'user', 'client'])
            ->orderBy('created_at', 'desc');

        // Filtrar por usuario: solo admin puede ver todas las ventas
        if (!auth()->user()->hasRole('admin')) {
            $sales->where('user_id', auth()->id());
        }

        if ($request->has('q') && $request->q) {
            $sales->where(function ($query) use ($request) {
                $query->where('invoice_number', 'like', "%{$request->q}%")
                    ->orWhereHas('user', fn($q) =>
                        $q->where('name', 'like', "%{$request->q}%")
                    );
            });
        }

        if ($request->has('cash_register_id')) {
            $sales->where('cash_register_id', $request->cash_register_id);
        }

        if ($request->has('status')) {
            $sales->where('status', $request->status);
        }

        return ApiResponse::OK->response([
            'sales' => $sales->paginate(config('app.pagination')),
        ]);
    }

    public function show(Sale $sale)
    {
        // Solo admin puede ver ventas de otros usuarios
        if (!auth()->user()->hasRole('admin') && $sale->user_id !== auth()->id()) {
            return ApiResponse::FORBIDDEN->response([
                'message' => 'No tienes permiso para ver esta venta.'
            ]);
        }

        return ApiResponse::OK->response([
            'model' => $sale->load(['details.inventory', 'user', 'client'])
        ]);
    }

    public function store(SaleStoreRequest $request)
    {
        $sale = $this->saleService->createSale($request->validated());

        return ApiResponse::CREATED->response([
            'model' => $sale,
        ]);
    }

    public function cancel(Sale $sale)
    {
        // Solo admin puede cancelar ventas de otros usuarios
        if (!auth()->user()->hasRole('admin') && $sale->user_id !== auth()->id()) {
            return ApiResponse::FORBIDDEN->response([
                'message' => 'No tienes permiso para cancelar esta venta.'
            ]);
        }

        try {
            $cancelledSale = $this->saleService->cancelSale($sale);

            return ApiResponse::OK->response([
                'model' => $cancelledSale,
                'message' => 'Venta cancelada exitosamente. Stock restaurado.'
            ]);
        } catch (\Exception $e) {
            return ApiResponse::BAD_REQUEST->response([
                'message' => $e->getMessage()
            ]);
        }
    }
}