feat(moderation): implement resource moderation queue and author deletions

GEMINI.md

@@ -1,8 +1,9 @@
 # Project Guidelines & Automated Checks
 
-## Formatting and Linting
+## Formatting, Linting & Builds
 - **Strict Trigger**: Do NOT run formatting, linting, or fix commands (`npm run format`, `composer lint`, `npm run lint`) during intermediate edits or regular conversational turns.
-- Only run the automated check commands when:
+- **Build Command**: Do NOT run `npm run build` during intermediate edits or conversational turns unless explicitly instructed by the user or strictly necessary for final pre-push verification.
+- Only run automated check commands when:
   1. The user explicitly instructs to `"push"` or `"commit"`.
   2. The user explicitly asks to check or fix formatting/linting issues.
 

app/Console/Commands/DeleteUnusedImages.php

@@ -7,6 +7,7 @@
 use App\Models\ForumPost;
 use App\Models\Notice;
 use App\Models\Resource;
+use App\Models\ResourceChangeRequest;
 use App\Models\SupportTicket;
 use App\Models\User;
 use Illuminate\Console\Command;
@@ -46,9 +47,19 @@ public function handle(): void
         );
 
         // Resource files (notes, images, videos — all stored under resources/)
+        // Also protects pending change requests awaiting moderation review
+        $activeResourceFiles = Resource::whereNotNull('file_path')->pluck('file_path')->toArray();
+        $pendingChangeRequestFiles = ResourceChangeRequest::where('status', 'pending')
+            ->whereNotNull('payload')
+            ->get()
+            ->pluck('payload.file_path')
+            ->filter()
+            ->values()
+            ->toArray();
+
         $this->cleanDirectory(
             'resources',
-            Resource::whereNotNull('file_path')->pluck('file_path')->toArray()
+            array_values(array_unique(array_merge($activeResourceFiles, $pendingChangeRequestFiles)))
         );
 
         // Forum post images

app/Http/Controllers/Admin/NodeController.php

@@ -8,6 +8,7 @@
 use App\Models\Node;
 use App\Models\Subject;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Str;
 use Inertia\Inertia;
 
@@ -25,7 +26,9 @@ public function show(Subject $subject, $path = null)
                 'subject' => $subject,
                 'nodes' => $nodes,
                 'resources' => [],
-
+                'pending_creates' => [],
+                'rejected_creates' => [],
+                'breadcrumb' => [],
             ]);
         }
 
@@ -42,13 +45,40 @@ public function show(Subject $subject, $path = null)
 
         foreach (array_slice($slugs, 1) as $slug) {
             $node = $node->children()->where('slug', $slug)->first();
+            if (! $node) {
+                abort(404);
+            }
         }
 
+        $pendingCreates = $node->pendingCreateRequests()
+            ->with('user:id,name,username')
+            ->get();
+
+        $rejectedCreates = $node->rejectedCreateRequests()
+            ->where('user_id', Auth::id())
+            ->with(['user:id,name,username', 'reviewer:id,name,username'])
+            ->latest('reviewed_at')
+            ->take(10)
+            ->get();
+
+        $resources = $node->resources()
+            ->with([
+                'pendingChangeRequest.user:id,name,username',
+                'latestRejectedChangeRequest' => function ($query) {
+                    $query->where('user_id', Auth::id())
+                        ->with('reviewer:id,name,username');
+                },
+            ])
+            ->get();
+
         return Inertia::render('admin/Node', [
             'subject' => $subject,
             'nodes' => $node->children,
-            'resources' => $node->resources ?? [],
-            'parent' => $node ? $node->append('is_effectively_frozen') : null,
+            'resources' => $resources,
+            'pending_creates' => $pendingCreates,
+            'rejected_creates' => $rejectedCreates,
+            'parent' => $node->append('is_effectively_frozen'),
+            'breadcrumb' => $node->breadcrumb(),
         ]);
     }
 

app/Http/Controllers/Admin/ResourceController.php

@@ -9,78 +9,160 @@
 use App\Http\Requests\Resource\UpdateResourceRequest;
 use App\Models\Node;
 use App\Models\Resource;
+use App\Models\ResourceChangeRequest;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Storage;
+use Illuminate\Validation\ValidationException;
 
 class ResourceController extends Controller
 {
+    /**
+     * Determine maximum allowed pending submissions for the user.
+     * Verified users: 100, Unverified users: 30.
+     */
+    protected function getMaxPendingSubmissions(): int
+    {
+        return Auth::user()?->is_verified ? 100 : 30;
+    }
+
+    /**
+     * Check if user would exceed their pending change requests quota.
+     * Throws standard ValidationException so it returns as a typed error in Inertia errors.
+     */
+    protected function ensureUnderPendingLimit(int $incomingCount = 1): void
+    {
+        if (Auth::user()?->can('moderate resources')) {
+            return;
+        }
+
+        $userId = Auth::id();
+        $maxLimit = $this->getMaxPendingSubmissions();
+
+        $currentPending = ResourceChangeRequest::where('user_id', $userId)
+            ->where('status', 'pending')
+            ->count();
+
+        if (($currentPending + $incomingCount) > $maxLimit) {
+            throw ValidationException::withMessages([
+                'pending_limit' => "আপনি সর্বোচ্চ {$maxLimit}টি কন্টেন্ট আপলোড করার অনুরোধ করতে পারেন। আপনার আপলোডকৃত {$currentPending}টি কন্টেন্ট বর্তমানে পর্যালোচনাধীন রয়েছে, তাই অনুগ্রহ করে অপেক্ষা করুন। ",
+            ]);
+        }
+    }
+
     public function store(StoreResourceRequest $request)
     {
         $validated = $request->validated();
-        $validated['user_id'] = Auth::id();
 
         if ($request->hasFile('file')) {
-            $path = $request->file('file')->store("resources/{$validated['resource_type']}s");
-            $validated['file_path'] = $path;
+            $validated['file_path'] = $request->file('file')->store("resources/{$validated['resource_type']}s");
         }
 
-        Resource::create($validated);
+        if ($request->user()->can('moderate resources')) {
+            $validated['user_id'] = Auth::id();
+            Resource::create($validated);
+
+            return back()->with('success', 'Resource created successfully.');
+        }
+
+        $this->ensureUnderPendingLimit(1);
+
+        ResourceChangeRequest::recordCreate(
+            Auth::id(),
+            (int) $validated['node_id'],
+            $validated
+        );
 
-        return back()->with('success', 'Resource created successfully.');
+        return back()->with('success', 'Resource submitted for moderation.');
     }
 
     public function update(UpdateResourceRequest $request, Resource $resource)
     {
         $validated = $request->validated();
 
         if ($request->hasFile('file')) {
-
-            if ($resource->file_path) {
+            if ($request->user()->can('moderate resources') && $resource->file_path) {
                 Storage::delete($resource->file_path);
             }
+            $validated['file_path'] = $request->file('file')->store("resources/{$validated['resource_type']}s");
+        }
 
-            $path = $request->file('file')
-                ->store("resources/{$validated['resource_type']}s");
+        if ($request->user()->can('moderate resources')) {
+            $resource->update($validated);
 
-            $validated['file_path'] = $path;
+            return back()->with('success', 'Resource updated successfully.');
         }
 
-        $resource->update($validated);
+        $this->ensureUnderPendingLimit(1);
 
-        return back()->with('success', 'Resource updated successfully.');
+        ResourceChangeRequest::recordUpdate(
+            Auth::id(),
+            $resource,
+            $validated
+        );
+
+        return back()->with('success', 'Resource update submitted for moderation.');
     }
 
     public function destroy(Resource $resource)
     {
-        if ($resource->file_path) {
-            Storage::delete($resource->file_path);
+        if (Auth::user()?->can('moderate resources')) {
+            if ($resource->file_path) {
+                Storage::delete($resource->file_path);
+            }
+            $resource->delete();
+
+            return redirect()->back()->with('success', 'Resource deleted successfully.');
         }
 
-        $resource->delete();
+        $this->ensureUnderPendingLimit(1);
+
+        ResourceChangeRequest::recordDelete(Auth::id(), $resource);
 
-        return redirect()->back()->with('success', 'Resource deleted successfully.');
+        return redirect()->back()->with('success', 'Resource deletion request submitted for moderation.');
     }
 
     public function storeBulkImages(BulkImageStoreRequest $request)
     {
         $validated = $request->validated();
+        $filesCount = count($request->file('files') ?? []);
+        $isModerator = $request->user()->can('moderate resources');
 
-        DB::transaction(function () use ($request, $validated) {
-            foreach ($request->file('files') as $index => $file) {
+        if (! $isModerator) {
+            $this->ensureUnderPendingLimit($filesCount);
+        }
 
-                $validated['title'] = $validated['custom_titles'][$index];
-                $validated['file_path'] = $file->store('resources/images');
-                $validated['user_id'] = Auth::id();
-                $validated['resource_type'] = 'image';
+        $userId = Auth::id();
+        $nodeId = (int) $validated['node_id'];
 
-                Resource::create($validated);
+        DB::transaction(function () use ($request, $validated, $userId, $nodeId, $isModerator) {
+            foreach ($request->file('files') as $index => $file) {
+                $filePath = $file->store('resources/images');
+                $title = $validated['custom_titles'][$index];
+
+                if ($isModerator) {
+                    Resource::create([
+                        'user_id' => $userId,
+                        'node_id' => $nodeId,
+                        'title' => $title,
+                        'resource_type' => 'image',
+                        'file_path' => $filePath,
+                    ]);
+                } else {
+                    ResourceChangeRequest::recordCreate($userId, $nodeId, [
+                        'title' => $title,
+                        'resource_type' => 'image',
+                        'file_path' => $filePath,
+                    ]);
+                }
             }
         });
 
-        return back()->with('success', 'Images uploaded successfully.');
+        $message = $isModerator ? 'Images uploaded successfully.' : 'Images submitted for moderation.';
+
+        return back()->with('success', $message);
     }
 
     public function storeBulkVideos(BulkVideoStoreRequest $request)
@@ -149,22 +231,41 @@ public function storeBulkVideos(BulkVideoStoreRequest $request)
         }
 
         $userId = Auth::id();
+        $nodeId = (int) $validated['node_id'];
+        $videosCount = count($videos);
+        $isModerator = $request->user()->can('moderate resources');
+
+        if (! $isModerator) {
+            $this->ensureUnderPendingLimit($videosCount);
+        }
 
-        DB::transaction(function () use ($videos, $validated, $userId) {
+        DB::transaction(function () use ($videos, $userId, $nodeId, $isModerator) {
             foreach ($videos as $video) {
                 $finalUrl = "https://www.youtube.com/watch?v={$video['video_id']}";
 
-                Resource::create([
-                    'user_id' => $userId,
-                    'node_id' => $validated['node_id'],
-                    'title' => $video['title'],
-                    'resource_type' => 'video',
-                    'external_url' => $finalUrl,
-                ]);
+                if ($isModerator) {
+                    Resource::create([
+                        'user_id' => $userId,
+                        'node_id' => $nodeId,
+                        'title' => $video['title'],
+                        'resource_type' => 'video',
+                        'external_url' => $finalUrl,
+                    ]);
+                } else {
+                    ResourceChangeRequest::recordCreate($userId, $nodeId, [
+                        'title' => $video['title'],
+                        'resource_type' => 'video',
+                        'external_url' => $finalUrl,
+                    ]);
+                }
             }
         });
 
-        return back()->with('success', 'YouTube playlist imported successfully.');
+        $message = $isModerator
+            ? 'YouTube playlist imported successfully.'
+            : 'YouTube playlist imported and submitted for moderation.';
+
+        return back()->with('success', $message);
     }
 
     public function bulkRename(Request $request, Node $node)