stage 1 of oauth removal, switch to sanctum pat tokens

app/Http/Controllers/Auth/AuthenticatedSessionController.php

@@ -50,12 +50,24 @@ class AuthenticatedSessionController extends Controller
             return Inertia::location(route('verification.notice'));
         }
 
+        $intended = $this->resolveIntended($request);
+        if ($intended !== null) {
+            $this->rememberTenantAdminTarget($request, $intended);
+
+            return Inertia::location($intended);
+        }
+
         $returnTo = $this->resolveReturnTo($request);
         if ($returnTo !== null) {
+            $this->rememberTenantAdminTarget($request, $returnTo);
+
             return Inertia::location($returnTo);
         }
 
-        return Inertia::location($this->defaultAdminPath());
+        $default = $this->defaultAdminPath();
+        $this->rememberTenantAdminTarget($request, $default);
+
+        return Inertia::location($default);
     }
 
     /**
@@ -79,7 +91,29 @@ class AuthenticatedSessionController extends Controller
             return null;
         }
 
-        return $this->decodeReturnTo($encoded, $request);
+        return $this->normalizeTenantAdminTarget(
+            $this->decodeReturnTo($encoded, $request),
+            $request
+        );
+    }
+
+    private function resolveIntended(Request $request): ?string
+    {
+        $intended = $request->session()->pull('url.intended');
+
+        if (! is_string($intended)) {
+            return null;
+        }
+
+        $trimmed = trim($intended);
+        if ($trimmed === '') {
+            return null;
+        }
+
+        return $this->normalizeTenantAdminTarget(
+            $this->decodeReturnTo($trimmed, $request),
+            $request
+        );
     }
 
     private function decodeReturnTo(string $value, Request $request): ?string
@@ -113,12 +147,73 @@ class AuthenticatedSessionController extends Controller
 
     private function defaultAdminPath(): string
     {
-        $base = rtrim(route('tenant.admin.app', absolute: false), '/');
-        if ($base === '') {
-            $base = '/event-admin';
+        $user = Auth::user();
+
+        // Block users with 'user' role - redirect to package selection
+        if ($user && $user->role === 'user') {
+            return '/packages';
         }
 
-        return $base.'/events';
+        // Super admins go to Filament superadmin panel
+        if ($user && $user->role === 'super_admin') {
+            return '/admin';
+        }
+
+        // Tenant admins go to their PWA dashboard
+        if ($user && $user->role === 'tenant_admin') {
+            return '/event-admin/dashboard';
+        }
+
+        // Fallback: redirect to packages (for users with no role)
+        return '/packages';
+    }
+
+    private function normalizeTenantAdminTarget(?string $target, Request $request): ?string
+    {
+        $user = Auth::user();
+
+        if (! $user || $user->role !== 'tenant_admin') {
+            return $target;
+        }
+
+        if ($target === null || $target === '') {
+            return '/event-admin/dashboard';
+        }
+
+        $parsed = parse_url($target);
+        $path = $target;
+        $hasScheme = false;
+
+        if ($parsed !== false) {
+            $hasScheme = isset($parsed['scheme']);
+            $host = $parsed['host'] ?? null;
+            $scheme = $parsed['scheme'] ?? null;
+            $requestHost = parse_url($request->getSchemeAndHttpHost(), PHP_URL_HOST);
+
+            if ($scheme && $host && $requestHost && ! Str::endsWith($host, $requestHost)) {
+                return '/event-admin/dashboard';
+            }
+
+            if (isset($parsed['path'])) {
+                $path = $parsed['path'];
+                if (isset($parsed['query'])) {
+                    $path .= '?'.$parsed['query'];
+                }
+                if (isset($parsed['fragment'])) {
+                    $path .= '#'.$parsed['fragment'];
+                }
+            }
+        }
+
+        if (! str_starts_with($path, '/')) {
+            $path = '/'.$path;
+        }
+
+        if (str_starts_with($path, '/event-admin') || str_starts_with($path, '/api/v1/oauth/authorize')) {
+            return $hasScheme ? $target : $path;
+        }
+
+        return '/event-admin/dashboard';
     }
 
     private function decodeBase64Url(string $value): ?string
@@ -137,4 +232,66 @@ class AuthenticatedSessionController extends Controller
 
         return $decoded;
     }
+
+    private function rememberTenantAdminTarget(Request $request, ?string $target): void
+    {
+        $user = Auth::user();
+
+        if (! $user || $user->role !== 'tenant_admin') {
+            return;
+        }
+
+        if (! is_string($target) || $target === '') {
+            return;
+        }
+
+        $normalized = $this->normalizeTenantAdminTarget($target, $request);
+
+        if (! is_string($normalized) || $normalized === '') {
+            return;
+        }
+
+        $path = $this->extractTenantAdminPath($normalized);
+
+        if ($path === null) {
+            return;
+        }
+
+        $request->session()->put('tenant_admin.return_to', $path);
+    }
+
+    private function extractTenantAdminPath(string $target): ?string
+    {
+        $value = trim($target);
+
+        if ($value === '') {
+            return null;
+        }
+
+        if (str_starts_with($value, '/event-admin')) {
+            return $value;
+        }
+
+        $parsed = parse_url($value);
+
+        if ($parsed === false) {
+            return null;
+        }
+
+        $path = $parsed['path'] ?? '';
+
+        if ($path === '' || ! str_starts_with($path, '/event-admin')) {
+            return null;
+        }
+
+        if (isset($parsed['query'])) {
+            $path .= '?'.$parsed['query'];
+        }
+
+        if (isset($parsed['fragment'])) {
+            $path .= '#'.$parsed['fragment'];
+        }
+
+        return $path;
+    }
 }