feat: implement tenant OAuth flow and guest achievements

database/migrations/2025_09_17_184450_add_tenant_id_to_photos_table_new.php

@@ -12,9 +12,11 @@ return new class extends Migration
     public function up(): void
     {
         Schema::table('photos', function (Blueprint $table) {
-            $table->unsignedBigInteger('tenant_id')->nullable()->after('event_id');
-            $table->foreign('tenant_id')->references('id')->on('tenants')->onDelete('cascade');
-            $table->index('tenant_id');
+            if (!Schema::hasColumn('photos', 'tenant_id')) {
+                $table->unsignedBigInteger('tenant_id')->nullable()->after('event_id');
+                $table->foreign('tenant_id')->references('id')->on('tenants')->onDelete('cascade');
+                $table->index('tenant_id');
+            }
         });
     }
 
@@ -24,8 +26,10 @@ return new class extends Migration
     public function down(): void
     {
         Schema::table('photos', function (Blueprint $table) {
-            $table->dropForeign(['tenant_id']);
-            $table->dropColumn('tenant_id');
+            if (Schema::hasColumn('photos', 'tenant_id')) {
+                $table->dropForeign(['tenant_id']);
+                $table->dropColumn('tenant_id');
+            }
         });
     }
-};
+};

database/migrations/2025_09_18_170042_add_is_active_to_oauth_clients_table.php

@@ -0,0 +1,79 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        if (! Schema::hasColumn('oauth_clients', 'is_active')) {
+            Schema::table('oauth_clients', function (Blueprint $table) {
+                $table->boolean('is_active')->default(true);
+            });
+        }
+
+        $clients = DB::table('oauth_clients')->get(['id', 'scopes', 'redirect_uris', 'is_active']);
+
+        foreach ($clients as $client) {
+            $scopes = $this->normaliseValue($client->scopes, ['tenant:read', 'tenant:write']);
+            $redirects = $this->normaliseValue($client->redirect_uris);
+
+            DB::table('oauth_clients')
+                ->where('id', $client->id)
+                ->update([
+                    'scopes' => $scopes === null ? null : json_encode($scopes),
+                    'redirect_uris' => $redirects === null ? null : json_encode($redirects),
+                    'is_active' => $client->is_active ?? true,
+                ]);
+        }
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        if (Schema::hasColumn('oauth_clients', 'is_active')) {
+            Schema::table('oauth_clients', function (Blueprint $table) {
+                $table->dropColumn('is_active');
+            });
+        }
+    }
+
+    private function normaliseValue(mixed $value, ?array $fallback = null): ?array
+    {
+        if ($value === null) {
+            return $fallback;
+        }
+
+        if (is_array($value)) {
+            return $this->cleanArray($value) ?: $fallback;
+        }
+
+        if (is_string($value)) {
+            $decoded = json_decode($value, true);
+            if (json_last_error() === JSON_ERROR_NONE && is_array($decoded)) {
+                return $this->cleanArray($decoded) ?: $fallback;
+            }
+
+            $parts = preg_split('/[\r\n,]+/', $value) ?: [];
+            return $this->cleanArray($parts) ?: $fallback;
+        }
+
+        return $fallback;
+    }
+
+    private function cleanArray(array $items): array
+    {
+        $items = array_map(fn ($item) => is_string($item) ? trim($item) : $item, $items);
+        $items = array_filter($items, fn ($item) => ! ($item === null || $item === ''));
+
+        return array_values($items);
+    }
+};

database/migrations/2025_09_18_180407_add_tenant_id_to_oauth_clients_table.php

@@ -0,0 +1,36 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('oauth_clients', function (Blueprint $table) {
+            if (!Schema::hasColumn('oauth_clients', 'tenant_id')) {
+                $table->foreignId('tenant_id')
+                    ->nullable()
+                    ->after('client_secret')
+                    ->constrained('tenants')
+                    ->nullOnDelete();
+            }
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('oauth_clients', function (Blueprint $table) {
+            if (Schema::hasColumn('oauth_clients', 'tenant_id')) {
+                $table->dropConstrainedForeignId('tenant_id');
+            }
+        });
+    }
+};

database/migrations/2025_09_18_180414_add_client_id_to_refresh_tokens_table.php

@@ -0,0 +1,32 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('refresh_tokens', function (Blueprint $table) {
+            if (!Schema::hasColumn('refresh_tokens', 'client_id')) {
+                $table->string('client_id', 255)->nullable()->after('tenant_id')->index();
+            }
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('refresh_tokens', function (Blueprint $table) {
+            if (Schema::hasColumn('refresh_tokens', 'client_id')) {
+                $table->dropColumn('client_id');
+            }
+        });
+    }
+};