feat: source tokens and client events API

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCrwHHnGCB5XH968Nxokqw

core/app/Console/Commands/SourceCreate.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Source;
+use Illuminate\Console\Command;
+
+class SourceCreate extends Command
+{
+    protected $signature = 'hado:source:create {name : Имя источника, напр. docs}';
+
+    protected $description = 'Регистрирует сервис-клиент и печатает его токен (один раз)';
+
+    public function handle(): int
+    {
+        $name = (string) $this->argument('name');
+        if (Source::where('name', $name)->exists()) {
+            $this->error("Источник «{$name}» уже существует");
+
+            return self::FAILURE;
+        }
+
+        $token = 'hado_'.bin2hex(random_bytes(32));
+        Source::create(['name' => $name, 'token_hash' => hash('sha256', $token)]);
+
+        $this->info("Источник «{$name}» создан. Токен показывается один раз, в базе только хэш.");
+        $this->line("Token: {$token}");
+
+        return self::SUCCESS;
+    }
+}

core/app/Http/Controllers/Api/EventsController.php

@@ -0,0 +1,80 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Enums\DueMode;
+use App\Enums\EventState;
+use App\Http\Controllers\Controller;
+use App\Http\Requests\UpsertEventsRequest;
+use App\Ingest\EventUpserter;
+use App\Models\Event;
+use App\Models\Source;
+use App\Scheduling\DueResolver;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+
+class EventsController extends Controller
+{
+    public function __construct(private readonly EventUpserter $upserter) {}
+
+    public function upsert(UpsertEventsRequest $request): JsonResponse
+    {
+        /** @var Source $source */
+        $source = $request->attributes->get('source');
+
+        return response()->json(['events' => $this->upserter->upsert($source, $request->items())]);
+    }
+
+    public function show(Request $request): JsonResponse
+    {
+        $event = $this->lookup($request);
+
+        return response()->json(self::present($event));
+    }
+
+    public function destroy(Request $request): Response
+    {
+        $event = $this->lookup($request);
+        $event->update(['state' => EventState::Withdrawn]);
+
+        return response()->noContent();
+    }
+
+    private function lookup(Request $request): Event
+    {
+        $request->validate(['source_ref' => ['required', 'string'], 'topic' => ['sometimes', 'nullable', 'string']]);
+        /** @var Source $source */
+        $source = $request->attributes->get('source');
+        $event = $this->upserter->find($source, $request->query('source_ref'), (string) $request->query('topic', ''));
+        abort_if($event === null, 404, 'Событие не найдено');
+
+        return $event;
+    }
+
+    /** @return array<string,mixed> */
+    public static function present(Event $event): array
+    {
+        return [
+            'id' => $event->id,
+            'source_ref' => $event->source_ref,
+            'topic' => $event->topic,
+            'state' => $event->state->value,
+            'due_at' => self::dueAt($event),
+            'fire_at' => $event->fire_on->format('Y-m-d'),
+            'after_due' => $event->after_due->value,
+            'payload' => $event->payload,
+            'done_at' => $event->done_at?->toIso8601String(),
+        ];
+    }
+
+    private static function dueAt(Event $event): string
+    {
+        if ($event->due_mode === DueMode::Fixed) {
+            return $event->due_instant->toIso8601String();
+        }
+        $date = $event->due_date->format('Y-m-d');
+
+        return $event->due_time === DueResolver::WHOLE_DAY ? $date : $date.'T'.substr($event->due_time, 0, 5);
+    }
+}

core/app/Http/Middleware/AuthenticateSource.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Models\Source;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class AuthenticateSource
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $token = $request->bearerToken();
+        if ($token === null || $token === '') {
+            return response()->json(['message' => 'Нужен Bearer-токен источника'], 401);
+        }
+
+        $source = Source::where('token_hash', hash('sha256', $token))->first();
+        if ($source === null) {
+            return response()->json(['message' => 'Неизвестный токен источника'], 401);
+        }
+
+        $request->attributes->set('source', $source);
+
+        return $next($request);
+    }
+}

core/app/Http/Middleware/RemoteUser.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class RemoteUser
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        return $next($request);
+    }
+}

core/app/Http/Requests/UpsertEventsRequest.php

@@ -0,0 +1,67 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Ingest\DueAtParser;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Validator;
+use InvalidArgumentException;
+
+class UpsertEventsRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'events' => ['required', 'array', 'min:1', 'max:500'],
+            'events.*.user' => ['required', 'string', 'max:255'],
+            'events.*.source_ref' => ['required', 'string', 'max:255'],
+            'events.*.topic' => ['sometimes', 'nullable', 'string', 'max:255'],
+            'events.*.due_at' => ['required', 'string'],
+            'events.*.fire_at' => ['required', 'date_format:Y-m-d'],
+            'events.*.after_due' => ['required', 'in:keep,expire'],
+            'events.*.payload' => ['required', 'array'],
+            'events.*.payload.title' => ['required', 'string'],
+            'events.*.payload.subtitle' => ['sometimes', 'nullable', 'string'],
+            'events.*.payload.deep_link' => ['sometimes', 'nullable', 'string'],
+            'events.*.payload.done_label' => ['sometimes', 'nullable', 'string', 'max:64'],
+        ];
+    }
+
+    public function after(): array
+    {
+        return [function (Validator $v) {
+            foreach ((array) $this->input('events', []) as $i => $item) {
+                if (! is_array($item) || ! isset($item['due_at'], $item['fire_at']) || ! is_string($item['due_at'])) {
+                    continue;
+                }
+                try {
+                    $due = DueAtParser::parse($item['due_at']);
+                } catch (InvalidArgumentException $e) {
+                    $v->errors()->add("events.$i.due_at", $e->getMessage());
+
+                    continue;
+                }
+                // Проверка fire_at <= день срока — по поясу по умолчанию; для fixed это
+                // приближение, точный день пользователя известен только при upsert.
+                if ($v->errors()->missing("events.$i.fire_at") && $item['fire_at'] > $due->dayFor(config('hado.default_tz'))) {
+                    $v->errors()->add("events.$i.fire_at", 'fire_at не может быть позже дня срока');
+                }
+            }
+        }];
+    }
+
+    /** @return list<array<string,mixed>> */
+    public function items(): array
+    {
+        return array_map(function (array $item) {
+            $item['topic'] = (string) ($item['topic'] ?? '');
+
+            return $item;
+        }, $this->validated()['events']);
+    }
+}