Merge pull request #195 from fleetbase/fix/prevent-empty-email-phone-on-user-update

fix: prevent empty email/phone on user update

Author: roncodes

src/Http/Controllers/Internal/v1/UserController.php

@@ -8,6 +8,7 @@
 use Fleetbase\Exports\UserExport;
 use Fleetbase\Http\Controllers\FleetbaseController;
 use Fleetbase\Http\Requests\CreateUserRequest;
+use Fleetbase\Http\Requests\UpdateUserRequest;
 use Fleetbase\Http\Requests\ExportRequest;
 use Fleetbase\Http\Requests\Internal\AcceptCompanyInvite;
 use Fleetbase\Http\Requests\Internal\InviteUserRequest;
@@ -57,6 +58,16 @@ class UserController extends FleetbaseController
      */
     public $createRequest = CreateUserRequest::class;
 
+    /**
+     * Update user request.
+     *
+     * Enforces that email and phone cannot be set to an empty string
+     * and that uniqueness constraints are respected on update.
+     *
+     * @var UpdateUserRequest
+     */
+    public $updateRequest = UpdateUserRequest::class;
+
     /**
      * Creates a record with request payload.
      *
@@ -126,6 +137,11 @@ public function createRecord(Request $request)
      */
     public function updateRecord(Request $request, string $id)
     {
+        // Run the UpdateUserRequest validation rules before delegating to the
+        // model trait. This prevents email/phone being set to an empty string
+        // and enforces uniqueness constraints on partial (PATCH) updates.
+        $this->validateRequest($request);
+
         try {
             $record = $this->model->updateRecordFromRequest($request, $id, function (&$request, &$user) {
                 // Assign role if set

src/Http/Requests/UpdateUserRequest.php

@@ -0,0 +1,85 @@
+<?php
+
+namespace Fleetbase\Http\Requests;
+
+use Fleetbase\Rules\EmailDomainExcluded;
+use Fleetbase\Rules\ValidPhoneNumber;
+use Illuminate\Validation\Rule;
+
+class UpdateUserRequest extends FleetbaseRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     *
+     * @return bool
+     */
+    public function authorize()
+    {
+        return session('company');
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * Uses `sometimes` + `required` (the correct Laravel pattern for PATCH/PUT):
+     * - If the field is present in the payload it must pass all rules, including
+     *   `required` which rejects empty strings and null.
+     * - If the field is absent entirely it is skipped, allowing partial updates.
+     *
+     * @return array
+     */
+    public function rules()
+    {
+        // Resolve the target user UUID from the route parameter so that the
+        // uniqueness rules can correctly ignore the user's own current value.
+        $userId = $this->route('id');
+
+        return [
+            'name'  => ['sometimes', 'required', 'string', 'min:2', 'max:100'],
+
+            // Email must be a valid address, must not be empty, and must remain
+            // unique across non-deleted users — ignoring the current user's own row.
+            'email' => [
+                'sometimes',
+                'required',
+                'string',
+                'email',
+                'max:255',
+                Rule::unique('users', 'email')
+                    ->ignore($userId, 'uuid')
+                    ->whereNull('deleted_at'),
+                new EmailDomainExcluded(),
+            ],
+
+            // Phone is optional (some user types may not have one), but if it is
+            // supplied it must be a valid E.164 number and must remain unique.
+            // `nullable` allows explicit null to clear the field; `required_with`
+            // is not used here because phone is genuinely optional on some accounts.
+            'phone' => [
+                'sometimes',
+                'nullable',
+                new ValidPhoneNumber(),
+                Rule::unique('users', 'phone')
+                    ->ignore($userId, 'uuid')
+                    ->whereNull('deleted_at'),
+            ],
+        ];
+    }
+
+    /**
+     * Get the error messages for the defined validation rules.
+     *
+     * @return array
+     */
+    public function messages()
+    {
+        return [
+            'name.required'   => 'Name cannot be empty.',
+            'name.min'        => 'Name must be at least 2 characters.',
+            'email.required'  => 'Email address cannot be empty.',
+            'email.email'     => 'A valid email address is required.',
+            'email.unique'    => 'An account with this email address already exists.',
+            'phone.unique'    => 'An account with this phone number already exists.',
+        ];
+    }
+}