City10/app/Http/Controllers/Api/LegalController.php

<?php

namespace App\Http\Controllers\Api;

use App\Http\Controllers\Controller;
use App\Http\Requests\ConsentRequest;
use App\Models\LegalDocument;
use App\Models\UserConsent;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\DB;

/**
 * Legal document and consent endpoints.
 *
 * Exposes the current Terms of Use, Privacy Policy and Cookie Policy and
 * records auditable consent events required by the Brazilian LGPD.
 */
class LegalController extends Controller
{
    /**
     * Return the current version of every legal document.
     */
    public function index(Request $request): JsonResponse
    {
        $locale = $request->query('locale', 'pt_BR');

        $documents = LegalDocument::query()
            ->where('is_current', true)
            ->orderBy('type')
            ->get()
            ->map(fn (LegalDocument $doc): array => [
                'id' => $doc->id,
                'type' => $doc->type,
                'version' => $doc->version,
                'title' => $doc->title[$locale] ?? ($doc->title['pt_BR'] ?? $doc->type),
                'body' => $doc->body[$locale] ?? ($doc->body['pt_BR'] ?? ''),
                'published_at' => $doc->published_at?->toIso8601String(),
            ]);

        return response()->json(['documents' => $documents]);
    }

    /**
     * Return the consent status of the authenticated user.
     */
    public function status(Request $request): JsonResponse
    {
        $user = $request->user();

        $current = LegalDocument::query()->where('is_current', true)->get();
        $accepted = $user->consents()->get(['legal_document_id', 'accepted_at']);

        $items = $current->map(fn (LegalDocument $doc): array => [
            'id' => $doc->id,
            'type' => $doc->type,
            'version' => $doc->version,
            'accepted' => $accepted->contains('legal_document_id', $doc->id),
            'accepted_at' => $accepted->firstWhere('legal_document_id', $doc->id)?->accepted_at?->toIso8601String(),
        ]);

        return response()->json([
            'all_accepted' => $items->every(fn (array $item): bool => $item['accepted']),
            'documents' => $items,
        ]);
    }

    /**
     * Record the acceptance of all current legal documents.
     *
     * The event is stored with timestamp, client IP, user agent and the
     * exact document versions accepted, forming an immutable audit trail.
     */
    public function accept(ConsentRequest $request): JsonResponse
    {
        $user = $request->user();

        $documents = LegalDocument::query()->where('is_current', true)->get();

        DB::transaction(function () use ($user, $documents, $request): void {
            foreach ($documents as $document) {
                UserConsent::updateOrCreate(
                    [
                        'user_id' => $user->id,
                        'legal_document_id' => $document->id,
                    ],
                    [
                        'accepted_at' => now(),
                        'ip_address' => $request->ip(),
                        'user_agent' => (string) $request->userAgent(),
                        'source' => 'web_form',
                    ],
                );
            }
        });

        return response()->json([
            'message' => __('legal.accepted'),
            'accepted_at' => now()->toIso8601String(),
        ]);
    }

    /**
     * Return the full consent audit history of the authenticated user.
     */
    public function history(Request $request): JsonResponse
    {
        $history = $request->user()
            ->consents()
            ->with('document:id,type,version')
            ->orderByDesc('accepted_at')
            ->get()
            ->map(fn (UserConsent $consent): array => [
                'document_type' => $consent->document?->type,
                'document_version' => $consent->document?->version,
                'accepted_at' => $consent->accepted_at?->toIso8601String(),
                'ip_address' => $consent->ip_address,
                'source' => $consent->source,
            ]);

        return response()->json(['history' => $history]);
    }
}