hado/core/app/Http/Controllers/ActionController.php

<?php

namespace App\Http\Controllers;

use App\Delivery\EventActions;
use App\Models\Delivery;
use App\Models\Event;
use Illuminate\Http\JsonResponse;

/** Кнопки из каналов: подписанные ссылки по action_token доставки. Без SSO и CSRF. */
class ActionController extends Controller
{
    public function __construct(private readonly EventActions $actions) {}

    public function ack(string $token): JsonResponse
    {
        $event = $this->eventFor($token);
        $this->actions->ack($event);

        return response()->json(['state' => $event->fresh()->state->value]);
    }

    public function done(string $token): JsonResponse
    {
        $event = $this->eventFor($token);
        $this->actions->done($event);

        return response()->json(['state' => $event->fresh()->state->value]);
    }

    private function eventFor(string $token): Event
    {
        $delivery = Delivery::where('action_token', $token)->with('event.user')->first();
        abort_if($delivery === null, 404, 'Неизвестный токен');
        abort_if($delivery->event->isTerminal(), 410, 'Событие уже закрыто');

        return $delivery->event;
    }
}