update controllers logic

app/Http/Controllers/Api/Finance/PurchaseOrderController.php

@@ -2,7 +2,7 @@
 
 namespace App\Http\Controllers\Api\Finance;
 
-use App\Http\Controllers\Api\BaseApiController;
+use App\Http\Controllers\Api\Core\BaseApiController;
 use App\Http\Requests\PurchaseOrders\PurchaseOrderIndexRequest;
 use App\Http\Resources\PurchaseOrders\PurchaseOrderItemResource;
 use App\Http\Resources\PurchaseOrders\PurchaseOrderResource;
@@ -99,6 +99,10 @@ class PurchaseOrderController extends BaseApiController
             }
         }
 
+        if (auth()->user() === null) {
+            return response()->json(['ok' => false, 'message' => 'Unauthorized.'], 401);
+        }
+
         try {
             $po = $this->createService->create($payload);
         } catch (RuntimeException $e) {
@@ -137,7 +141,11 @@ class PurchaseOrderController extends BaseApiController
         }
 
         $user = auth()->user();
-        $issuedBy = $user ? (string) ($user->email ?? $user->username ?? $user->id) : 'system';
+        if ($user === null) {
+            return response()->json(['ok' => false, 'message' => 'Unauthorized.'], 401);
+        }
+
+        $issuedBy = (string) ($user->email ?? $user->username ?? $user->id);
 
         try {
             $result = $this->receiveService->receive($id, $payload['items'], $issuedBy);
@@ -156,6 +164,10 @@ class PurchaseOrderController extends BaseApiController
 
     public function cancel(int $id): JsonResponse
     {
+        if (auth()->user() === null) {
+            return response()->json(['ok' => false, 'message' => 'Unauthorized.'], 401);
+        }
+
         $po = PurchaseOrder::query()->find($id);
         if (!$po) {
             return response()->json(['ok' => false, 'message' => 'Purchase order not found.'], 404);