add all controllers logic

app/Http/Middleware/ApiDocsAuth.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\DB;
+use PHPOpenSourceSaver\JWTAuth\Exceptions\JWTException;
+use PHPOpenSourceSaver\JWTAuth\Facades\JWTAuth;
+use Symfony\Component\HttpFoundation\Response;
+
+class ApiDocsAuth
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $user = Auth::user();
+        if (!$user) {
+            $authHeader = (string) $request->header('Authorization');
+            if ($authHeader !== '' && stripos($authHeader, 'Bearer ') === 0) {
+                $token = trim(substr($authHeader, 7));
+                if ($token === '') {
+                    return $this->deny('Missing token.', 401);
+                }
+
+                try {
+                    $user = JWTAuth::setToken($token)->authenticate();
+                    if ($user) {
+                        Auth::setUser($user);
+                    }
+                } catch (JWTException $e) {
+                    $user = null;
+                }
+            }
+        }
+
+        if (!$user) {
+            return $this->deny('Unauthorized access to documentation.', 401);
+        }
+
+        if (!$this->userIsAdmin((int) $user->id)) {
+            return $this->deny('Admin privileges required.', 403);
+        }
+
+        return $next($request);
+    }
+
+    private function userIsAdmin(int $userId): bool
+    {
+        return DB::table('user_roles as ur')
+            ->join('roles as r', 'r.id', '=', 'ur.role_id')
+            ->where('ur.user_id', $userId)
+            ->whereNull('ur.deleted_at')
+            ->whereRaw('LOWER(r.name) = ?', ['admin'])
+            ->exists();
+    }
+
+    private function deny(string $message, int $status): Response
+    {
+        return response()->json([
+            'status' => false,
+            'message' => $message,
+        ], $status);
+    }
+}

app/Http/Middleware/ApiJwtAuth.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use PHPOpenSourceSaver\JWTAuth\Exceptions\JWTException;
+use PHPOpenSourceSaver\JWTAuth\Facades\JWTAuth;
+use Symfony\Component\HttpFoundation\Response;
+
+class ApiJwtAuth
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        try {
+            $user = JWTAuth::parseToken()->authenticate();
+            if (!$user) {
+                return response()->json(['status' => false, 'message' => 'Unauthorized.'], 401);
+            }
+
+            Auth::setUser($user);
+        } catch (JWTException $e) {
+            return response()->json(['status' => false, 'message' => 'Unauthorized.'], 401);
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/CleanupScheduler.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Services\System\CleanupSchedulerService;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class CleanupScheduler
+{
+    public function __construct(private CleanupSchedulerService $service)
+    {
+    }
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        $cacheKey = 'last_cleanup_run';
+        if ($this->service->shouldRun($cacheKey, 2)) {
+            $this->service->runUnverifiedCleanup();
+            $this->service->markRun($cacheKey);
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/PrimeTimezone.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Services\System\TimeService;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class PrimeTimezone
+{
+    public function __construct(private TimeService $timeService)
+    {
+    }
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        try {
+            $this->timeService->primeFromRequest($request);
+        } catch (\Throwable $e) {
+            // ignore; fallback detection still works
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/RequirePermission.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Services\Auth\PermissionCheckService;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class RequirePermission
+{
+    public function __construct(private PermissionCheckService $permissions)
+    {
+    }
+
+    public function handle(Request $request, Closure $next, string $permission): Response
+    {
+        $userId = (int) ($request->user()?->id ?? 0);
+        if ($userId <= 0) {
+            return response()->json(['status' => false, 'message' => 'Unauthorized.'], 401);
+        }
+
+        if (!$this->permissions->hasPermission($userId, $permission)) {
+            if ($request->expectsJson()) {
+                return response()->json(['status' => false, 'message' => 'Access denied.'], 403);
+            }
+            return response()->json(['status' => false, 'message' => 'Access denied.'], 403);
+        }
+
+        return $next($request);
+    }
+}