updates

2026-10-19 14:11:28 +01:00
parent 26a2b448a5
commit ac0c5410c1
128 changed files with 5593 additions and 217 deletions
@@ -1,14 +1,49 @@
 <?php
+
 namespace App\Http\Controllers\Admin;
+
 use App\Http\Controllers\Controller;
 use App\Models\License;
-use App\Models\LicenseProduct;
+use App\Models\LicenseActivation;
 use App\Models\User;
 use Illuminate\Http\Request;
-final class AdminController extends Controller {
- public function index(){ return view('admin.index',['licenseCount'=>License::count(),'activeCount'=>License::whereNull('revoked_at')->count(),'activationCount'=>\App\Models\LicenseActivation::whereNull('deactivated_at')->count(),'userCount'=>User::count()]); }
- public function licenses(Request $r){ $q=License::with('product')->latest(); if($s=trim((string)$r->query('q'))) $q->where(fn($x)=>$x->where('customer_email','like',"%{$s}%")->orWhere('customer_name','like',"%{$s}%")->orWhere('license_key_last4','like',"%{$s}%")); return view('admin.licenses',['licenses'=>$q->paginate(50)->withQueryString()]); }
- public function show(License $license){$license->load(['product','activations']); return view('admin.license',compact('license'));}
- public function revoke(Request $request,License $license){$data=$request->validate(['reason'=>['nullable','string','max:255']]);$license->update(['revoked_at'=>now(),'revoke_reason'=>$data['reason']?:'Revoked by administrator']);return back()->with('status','Licence revoked.');}
- public function restore(License $license){$license->update(['revoked_at'=>null,'revoke_reason'=>null]);return back()->with('status','Licence restored.');}
+
+final class AdminController extends Controller
+{
+    public function index()
+    {
+        return view('admin.index', ['licenseCount' => License::count(), 'activeCount' => License::whereNull('revoked_at')->count(), 'activationCount' => LicenseActivation::whereNull('deactivated_at')->count(), 'userCount' => User::count()]);
+    }
+
+    public function licenses(Request $r)
+    {
+        $q = License::with('product')->latest();
+        if ($s = trim((string) $r->query('q'))) {
+            $q->where(fn ($x) => $x->where('customer_email', 'like', "%{$s}%")->orWhere('customer_name', 'like', "%{$s}%")->orWhere('license_key_last4', 'like', "%{$s}%"));
+        }
+
+return view('admin.licenses', ['licenses' => $q->paginate(50)->withQueryString()]);
+    }
+
+    public function show(License $license)
+    {
+        $license->load(['product', 'activations']);
+
+        return view('admin.license', compact('license'));
+    }
+
+    public function revoke(Request $request, License $license)
+    {
+        $data = $request->validate(['reason' => ['nullable', 'string', 'max:255']]);
+        $license->update(['revoked_at' => now(), 'revoke_reason' => $data['reason'] ?: 'Revoked by administrator']);
+
+        return back()->with('status', 'Licence revoked.');
+    }
+
+    public function restore(License $license)
+    {
+        $license->update(['revoked_at' => null, 'revoke_reason' => null]);
+
+        return back()->with('status','Licence restored.');
+    }
 }
@@ -0,0 +1,59 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Models\SupportTicket;
+use App\Models\User;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+
+final class SupportTicketController extends Controller
+{
+    public function index(Request $request)
+    {
+        $tickets = SupportTicket::query()
+            ->with('assignee')
+            ->when($request->filled('status'), fn ($q) => $q->where('status', $request->string('status')))
+            ->latest()
+            ->paginate(50)
+            ->withQueryString();
+
+        return view('admin.support.index', compact('tickets'));
+    }
+
+    public function show(SupportTicket $ticket)
+    {
+        $ticket->load(['user', 'assignee']);
+        if (auth()->user()) {
+            auth()->user()->unreadNotifications()->get()
+                ->filter(fn ($notification) => (int) ($notification->data['support_ticket_id'] ?? 0) === $ticket->id)
+                ->each->markAsRead();
+        }
+
+        return view('admin.support.show', [
+            'ticket' => $ticket,
+            'admins' => User::query()->where('is_admin', true)->orderBy('name')->get(['id', 'name', 'email']),
+        ]);
+    }
+
+    public function update(Request $request, SupportTicket $ticket): RedirectResponse
+    {
+        $data = $request->validate([
+            'status' => ['required', 'in:new,open,waiting,resolved,closed'],
+            'priority' => ['required', 'in:low,normal,high,urgent'],
+            'assigned_to' => ['nullable', 'integer', 'exists:users,id'],
+        ]);
+
+        if ($data['assigned_to'] ?? null) {
+            abort_unless(User::whereKey($data['assigned_to'])->where('is_admin', true)->exists(), 422);
+        }
+
+        $data['resolved_at'] = in_array($data['status'], ['resolved', 'closed'], true)
+            ? ($ticket->resolved_at ?? now())
+            : null;
+        $ticket->update($data);
+
+        return back()->with('status', 'Support ticket updated.');
+    }
+}
@@ -1,4 +1,5 @@
 <?php
+
 namespace App\Http\Controllers\Api;

 use App\Http\Controllers\Controller;
@@ -17,37 +18,147 @@ final class LicenseActivationController extends Controller
    public function activate(Request $request, LicenseSigner $signer): JsonResponse
    {
        $data = $request->validate([
-            'licenseKey'=>['required','string','max:128'],
-            'installationID'=>['required','uuid'],
-            'appVersion'=>['required','string','max:32'],
-            'platform'=>['required','string','max:32'],
+            'licenseKey' => ['required', 'string', 'max:128'],
+            'installationID' => ['required', 'uuid'],
+            'appVersion' => ['required', 'string', 'max:32'],
+            'platform' => ['required', 'string', 'max:32'],
        ]);

-        return DB::transaction(function () use ($data,$signer) {
-            $license = License::where('license_key_hash', LicenseKey::hash($data['licenseKey']))->lockForUpdate()->first();
-            if (!$license) throw ValidationException::withMessages(['licenseKey'=>'The licence key is not valid.']);
-            if (!$license->is_usable) return response()->json(['message'=>'This licence is expired or has been revoked.'], 403);
+        return DB::transaction(function () use ($data, $signer) {
+            $license = License::where('license_key_hash', LicenseKey::hash($data['licenseKey']))
+                ->lockForUpdate()
+                ->first();

-            $activation = LicenseActivation::where('license_id',$license->id)->where('installation_id',strtolower($data['installationID']))->first();
-            if ($activation && $activation->deactivated_at === null) {
-                $activation->update(['last_seen_at'=>now(),'platform'=>$data['platform'],'app_version'=>$data['appVersion']]);
-            } else {
-                $activeCount = LicenseActivation::where('license_id',$license->id)->whereNull('deactivated_at')->count();
-                if ($activeCount >= $license->activation_limit) return response()->json(['message'=>'This licence has reached its activation limit. Deactivate another Mac first.'], 409);
-                if ($activation) $activation->update(['deactivated_at'=>null,'activated_at'=>now(),'last_seen_at'=>now(),'platform'=>$data['platform'],'app_version'=>$data['appVersion']]);
-                else LicenseActivation::create(['license_id'=>$license->id,'installation_id'=>strtolower($data['installationID']),'platform'=>$data['platform'],'app_version'=>$data['appVersion'],'activated_at'=>now(),'last_seen_at'=>now()]);
+            if (! $license) {
+                throw ValidationException::withMessages(['licenseKey' => 'The licence key is not valid.']);
            }
-            return response()->json(['licenseToken'=>$signer->sign($license, $data['installationID'])]);
+
+            if (! $license->is_usable) {
+                return response()->json(['message' => 'This licence is expired or has been revoked.'], 403);
+            }
+
+            $installationID = strtolower($data['installationID']);
+            $activation = LicenseActivation::where('license_id', $license->id)
+                ->where('installation_id', $installationID)
+                ->first();
+
+            if ($activation && $activation->deactivated_at === null) {
+                $activation->update([
+                    'last_seen_at' => now(),
+                    'platform' => $data['platform'],
+                    'app_version' => $data['appVersion'],
+                ]);
+            } else {
+                $activeCount = LicenseActivation::where('license_id', $license->id)
+                    ->whereNull('deactivated_at')
+                    ->count();
+
+                if ($activeCount >= $license->activation_limit) {
+                    return response()->json(['message' => 'This licence has reached its activation limit. Deactivate another Mac first.'], 409);
+                }
+
+                if ($activation) {
+                    $activation->update([
+                        'deactivated_at' => null,
+                        'activated_at' => now(),
+                        'last_seen_at' => now(),
+                        'platform' => $data['platform'],
+                        'app_version' => $data['appVersion'],
+                    ]);
+                } else {
+                    LicenseActivation::create([
+                        'license_id' => $license->id,
+                        'installation_id' => $installationID,
+                        'platform' => $data['platform'],
+                        'app_version' => $data['appVersion'],
+                        'activated_at' => now(),
+                        'last_seen_at' => now(),
+                    ]);
+                }
+            }
+
+            return response()->json([
+                'licenseToken' => $signer->sign($license, $data['installationID']),
+            ]);
+        });
+    }
+
+    public function validateInstallation(
+        Request $request,
+        LicenseTokenVerifier $verifier,
+        LicenseSigner $signer,
+    ): JsonResponse {
+        $data = $request->validate([
+            'licenseToken' => ['required', 'string', 'max:8192'],
+            'installationID' => ['required', 'uuid'],
+            'appVersion' => ['required', 'string', 'max:32'],
+            'platform' => ['required', 'string', 'max:32'],
+        ]);
+
+        try {
+            $payload = $verifier->verify($data['licenseToken']);
+        } catch (\Throwable) {
+            return response()->json(['message' => 'The licence token is invalid.'], 400);
+        }
+
+        if (strcasecmp((string) ($payload['installationID'] ?? ''), $data['installationID']) !== 0) {
+            return response()->json(['message' => 'The installation does not match this licence token.'], 400);
+        }
+
+        return DB::transaction(function () use ($data, $payload, $signer) {
+            $license = License::whereKey((string) ($payload['licenseID'] ?? ''))
+                ->lockForUpdate()
+                ->first();
+
+            if (! $license || ! $license->is_usable) {
+                return response()->json(['message' => 'This licence is expired or has been revoked.'], 403);
+            }
+
+            $activation = LicenseActivation::where('license_id', $license->id)
+                ->where('installation_id', strtolower($data['installationID']))
+                ->first();
+
+            if (! $activation || $activation->deactivated_at !== null) {
+                return response()->json(['message' => 'This Mac has been deactivated from the licence portal.'], 403);
+            }
+
+            $activation->update([
+                'last_seen_at' => now(),
+                'platform' => $data['platform'],
+                'app_version' => $data['appVersion'],
+            ]);
+
+            return response()->json([
+                'active' => true,
+                // Refreshing the signed token also applies subscription edition/expiry changes
+                // without requiring the user to reactivate manually.
+                'licenseToken' => $signer->sign($license, $data['installationID']),
+            ]);
        });
    }

    public function deactivate(Request $request, LicenseTokenVerifier $verifier): JsonResponse
    {
-        $data = $request->validate(['licenseToken'=>['required','string','max:8192'],'installationID'=>['required','uuid']]);
-        try { $payload = $verifier->verify($data['licenseToken']); }
-        catch (\Throwable) { return response()->json(['message'=>'The licence token is invalid.'], 400); }
-        if (strcasecmp((string)($payload['installationID'] ?? ''), $data['installationID']) !== 0) return response()->json(['message'=>'The installation does not match this licence token.'], 400);
-        LicenseActivation::where('license_id',(string)($payload['licenseID'] ?? ''))->where('installation_id',strtolower($data['installationID']))->whereNull('deactivated_at')->update(['deactivated_at'=>now(),'last_seen_at'=>now()]);
-        return response()->json((object)[]);
+        $data = $request->validate([
+            'licenseToken' => ['required', 'string', 'max:8192'],
+            'installationID' => ['required', 'uuid'],
+        ]);
+
+        try {
+            $payload = $verifier->verify($data['licenseToken']);
+        } catch (\Throwable) {
+            return response()->json(['message' => 'The licence token is invalid.'], 400);
+        }
+
+        if (strcasecmp((string) ($payload['installationID'] ?? ''), $data['installationID']) !== 0) {
+            return response()->json(['message' => 'The installation does not match this licence token.'], 400);
+        }
+
+        LicenseActivation::where('license_id', (string) ($payload['licenseID'] ?? ''))
+            ->where('installation_id', strtolower($data['installationID']))
+            ->whereNull('deactivated_at')
+            ->update(['deactivated_at' => now(), 'last_seen_at' => now()]);
+
+        return response()->json((object) []);
    }
 }
@@ -1,8 +1,10 @@
 <?php
+
 namespace App\Http\Controllers\Api;

 use App\Http\Controllers\Controller;
 use App\Models\LicenseWebhookEvent;
+use App\Services\Licensing\LicenseDeliveryService;
 use App\Services\Payments\LemonSqueezyWebhookVerifier;
 use App\Services\Payments\PaddleWebhookVerifier;
 use App\Services\Payments\PurchaseProvisioner;
@@ -12,26 +14,65 @@ use Illuminate\Support\Facades\DB;

 final class PaymentWebhookController extends Controller
 {
-    public function __invoke(string $provider, Request $request, PurchaseProvisioner $provisioner): JsonResponse
+    public function __invoke(string $provider, Request $request, PurchaseProvisioner $provisioner, LicenseDeliveryService $delivery): JsonResponse
    {
-        $raw=(string)$request->getContent();
-        $verifier=match($provider){'paddle'=>app(PaddleWebhookVerifier::class),'lemon-squeezy'=>app(LemonSqueezyWebhookVerifier::class),default=>null};
-        if (!$verifier) return response()->json(['message'=>'Unknown webhook provider.'],404);
-        try { $verifier->verify($request,$raw); } catch (\Throwable $e) { report($e); return response()->json(['message'=>'Invalid webhook signature.'],400); }
-        try { $payload=json_decode($raw,true,flags:JSON_THROW_ON_ERROR); } catch (\Throwable) { return response()->json(['message'=>'Invalid JSON.'],400); }
-        $externalID=(string)($provider==='paddle'?($payload['event_id']??''):($payload['meta']['event_name']??'').':'.($payload['data']['id']??''));
-        $eventType=(string)($provider==='paddle'?($payload['event_type']??'unknown'):($payload['meta']['event_name']??'unknown'));
-        if ($externalID==='') return response()->json(['message'=>'Webhook event has no stable identifier.'],400);
+        $raw = (string) $request->getContent();
+        $verifier = match ($provider) {
+            'paddle' => app(PaddleWebhookVerifier::class),'lemon-squeezy' => app(LemonSqueezyWebhookVerifier::class),default => null
+        };
+        if (! $verifier) {
+            return response()->json(['message' => 'Unknown webhook provider.'], 404);
+        }
+        try {
+            $verifier->verify($request, $raw);
+        } catch (\Throwable $e) {
+            report($e);
+
+            return response()->json(['message' => 'Invalid webhook signature.'], 400);
+        }
+        try {
+            $payload = json_decode($raw, true, flags: JSON_THROW_ON_ERROR);
+        } catch (\Throwable) {
+            return response()->json(['message' => 'Invalid JSON.'], 400);
+        }
+        $externalID = (string) ($provider === 'paddle' ? ($payload['event_id'] ?? '') : ($payload['meta']['event_name'] ?? '').':'.($payload['data']['id'] ?? ''));
+        $eventType = (string) ($provider === 'paddle' ? ($payload['event_type'] ?? 'unknown') : ($payload['meta']['event_name'] ?? 'unknown'));
+        if ($externalID === '') {
+            return response()->json(['message' => 'Webhook event has no stable identifier.'], 400);
+        }

        try {
-            DB::transaction(function() use($provider,$externalID,$eventType,$payload,$raw,$provisioner){
-                $event=LicenseWebhookEvent::firstOrCreate(['provider'=>$provider,'external_event_id'=>$externalID],['event_type'=>$eventType,'payload_sha256'=>hash('sha256',$raw),'payload'=>$payload]);
-                if ($event->processed_at) return;
-                if (!hash_equals($event->payload_sha256,hash('sha256',$raw))) throw new \RuntimeException('Webhook ID was reused with a different payload.');
-                try { $provisioner->provision($provider,$payload); $event->update(['processed_at'=>now(),'processing_error'=>null]); }
-                catch (\Throwable $e) { $event->update(['processing_error'=>mb_substr($e->getMessage(),0,4000)]); throw $e; }
+            DB::transaction(function () use ($provider, $externalID, $eventType, $payload, $raw, $provisioner) {
+                $event = LicenseWebhookEvent::firstOrCreate(['provider' => $provider, 'external_event_id' => $externalID], ['event_type' => $eventType, 'payload_sha256' => hash('sha256', $raw), 'payload' => $payload]);
+                if ($event->processed_at) {
+                    return;
+                }
+                if (! hash_equals($event->payload_sha256, hash('sha256', $raw))) {
+                    throw new \RuntimeException('Webhook ID was reused with a different payload.');
+                }
+                try {
+                    $provisioner->provision($provider, $payload);
+                    $event->update(['processed_at' => now(), 'processing_error' => null]);
+                } catch (\Throwable $e) {
+                    $event->update(['processing_error' => mb_substr($e->getMessage(), 0, 4000)]);
+                    throw $e;
+                }
            });
-        } catch (\Throwable $e) { report($e); return response()->json(['message'=>'Webhook could not be processed.'],500); }
-        return response()->json(['ok'=>true]);
+        } catch (\Throwable $e) {
+            report($e);
+
+            return response()->json(['message' => 'Webhook could not be processed.'], 500);
+        }
+
+        // Delivery is intentionally outside the webhook transaction. A temporary mail
+        // outage must not roll back an otherwise valid Paddle event. Pending outbox
+        // rows remain available for portal resend or a later webhook delivery attempt.
+        try {
+            $delivery->deliverPending(10);
+        } catch (\Throwable $e) {
+            report($e);
+        }
+
+        return response()->json(['ok' => true]);
    }
 }
@@ -1,14 +1,35 @@
 <?php
+
 namespace App\Http\Controllers\Auth;
+
 use App\Http\Controllers\Controller;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
-final class AuthenticatedSessionController extends Controller {
- public function create(){ return view('auth.login'); }
- public function store(Request $request){
-   $credentials=$request->validate(['email'=>['required','email'],'password'=>['required','string']]);
-   if(!Auth::attempt(['email'=>strtolower($credentials['email']),'password'=>$credentials['password']], $request->boolean('remember'))){ return back()->withErrors(['email'=>'The supplied credentials are invalid.'])->onlyInput('email'); }
-   $request->session()->regenerate(); return redirect()->intended(route('portal.index'));
- }
- public function destroy(Request $request){ Auth::logout(); $request->session()->invalidate(); $request->session()->regenerateToken(); return redirect()->route('login'); }
+
+final class AuthenticatedSessionController extends Controller
+{
+    public function create()
+    {
+        return view('auth.login');
+    }
+
+    public function store(Request $request)
+    {
+        $credentials = $request->validate(['email' => ['required', 'email'], 'password' => ['required', 'string']]);
+        if (! Auth::attempt(['email' => strtolower($credentials['email']), 'password' => $credentials['password']], $request->boolean('remember'))) {
+            return back()->withErrors(['email' => 'The supplied credentials are invalid.'])->onlyInput('email');
+        }
+        $request->session()->regenerate();
+
+        return redirect()->intended(route('portal.index'));
+    }
+
+    public function destroy(Request $request)
+    {
+        Auth::logout();
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        return redirect()->route('login');
+    }
 }
@@ -1,10 +1,31 @@
 <?php
+
 namespace App\Http\Controllers\Auth;
+
 use App\Http\Controllers\Controller;
 use Illuminate\Foundation\Auth\EmailVerificationRequest;
 use Illuminate\Http\Request;
-final class EmailVerificationController extends Controller {
- public function notice(){ return view('auth.verify-email'); }
- public function verify(EmailVerificationRequest $request){ $request->fulfill(); return redirect()->route('portal.index')->with('status','Email verified.'); }
- public function resend(Request $request){ if(!$request->user()->hasVerifiedEmail()) $request->user()->sendEmailVerificationNotification(); return back()->with('status','Verification link sent.'); }
+
+final class EmailVerificationController extends Controller
+{
+    public function notice()
+    {
+        return view('auth.verify-email');
+    }
+
+    public function verify(EmailVerificationRequest $request)
+    {
+        $request->fulfill();
+
+        return redirect()->route('portal.index')->with('status', 'Email verified.');
+    }
+
+    public function resend(Request $request)
+    {
+        if (! $request->user()->hasVerifiedEmail()) {
+            $request->user()->sendEmailVerificationNotification();
+        }
+
+return back()->with('status', 'Verification link sent.');
+    }
 }
@@ -1,5 +1,7 @@
 <?php
+
 namespace App\Http\Controllers\Auth;
+
 use App\Http\Controllers\Controller;
 use App\Models\User;
 use Illuminate\Auth\Events\PasswordReset;
@@ -7,9 +9,35 @@ use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Password;
 use Illuminate\Support\Str;
 use Illuminate\Validation\Rules\Password as PasswordRule;
-final class PasswordController extends Controller {
- public function requestForm(){ return view('auth.forgot-password'); }
- public function email(Request $request){ $request->validate(['email'=>['required','email']]); $status=Password::sendResetLink(['email'=>strtolower($request->email)]); return $status===Password::RESET_LINK_SENT?back()->with('status',__($status)):back()->withErrors(['email'=>__($status)]); }
- public function resetForm(Request $request,string $token){ return view('auth.reset-password',['token'=>$token,'email'=>$request->query('email')]); }
- public function reset(Request $request){ $data=$request->validate(['token'=>['required'],'email'=>['required','email'],'password'=>['required','confirmed',PasswordRule::min(12)->letters()->mixedCase()->numbers()]]); $status=Password::reset($data,function(User $user,string $password){$user->forceFill(['password'=>$password,'remember_token'=>Str::random(60)])->save();event(new PasswordReset($user));}); return $status===Password::PASSWORD_RESET?redirect()->route('login')->with('status',__($status)):back()->withErrors(['email'=>__($status)]); }
+
+final class PasswordController extends Controller
+{
+    public function requestForm()
+    {
+        return view('auth.forgot-password');
+    }
+
+    public function email(Request $request)
+    {
+        $request->validate(['email' => ['required', 'email']]);
+        $status = Password::sendResetLink(['email' => strtolower($request->email)]);
+
+        return $status === Password::RESET_LINK_SENT ? back()->with('status', __($status)) : back()->withErrors(['email' => __($status)]);
+    }
+
+    public function resetForm(Request $request, string $token)
+    {
+        return view('auth.reset-password', ['token' => $token, 'email' => $request->query('email')]);
+    }
+
+    public function reset(Request $request)
+    {
+        $data = $request->validate(['token' => ['required'], 'email' => ['required', 'email'], 'password' => ['required', 'confirmed', PasswordRule::min(12)->letters()->mixedCase()->numbers()]]);
+        $status = Password::reset($data, function (User $user, string $password) {
+            $user->forceFill(['password' => $password, 'remember_token' => Str::random(60)])->save();
+            event(new PasswordReset($user));
+        });
+
+        return $status === Password::PASSWORD_RESET ? redirect()->route('login')->with('status', __($status)) : back()->withErrors(['email' => __($status)]);
+    }
 }
@@ -1,15 +1,29 @@
 <?php
+
 namespace App\Http\Controllers\Auth;
+
 use App\Http\Controllers\Controller;
 use App\Models\User;
 use Illuminate\Auth\Events\Registered;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Validation\Rules\Password;
-final class RegisteredUserController extends Controller {
- public function create(){ return view('auth.register'); }
- public function store(Request $request){
-   $data=$request->validate(['name'=>['required','string','max:120'],'email'=>['required','email','max:255','unique:users,email'],'password'=>['required','confirmed',Password::min(12)->letters()->mixedCase()->numbers()]]);
-   $user=User::create(['name'=>$data['name'],'email'=>strtolower($data['email']),'password'=>$data['password']]); event(new Registered($user)); Auth::login($user); $request->session()->regenerate(); return redirect()->route('verification.notice');
- }
+
+final class RegisteredUserController extends Controller
+{
+    public function create()
+    {
+        return view('auth.register');
+    }
+
+    public function store(Request $request)
+    {
+        $data = $request->validate(['name' => ['required', 'string', 'max:120'], 'email' => ['required', 'email', 'max:255', 'unique:users,email'], 'password' => ['required', 'confirmed', Password::min(12)->letters()->mixedCase()->numbers()]]);
+        $user = User::create(['name' => $data['name'], 'email' => strtolower($data['email']), 'password' => $data['password']]);
+        event(new Registered($user));
+        Auth::login($user);
+        $request->session()->regenerate();
+
+        return redirect()->route('verification.notice');
+    }
 }
@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use Illuminate\Contracts\View\View;
+use RuntimeException;
+
+final class CheckoutController extends Controller
+{
+    public function __invoke(): View
+    {
+        $paddle = config('rsync-studio.paddle');
+        $token = trim((string) ($paddle['client_side_token'] ?? ''));
+
+        if ($token === '') {
+            throw new RuntimeException('PADDLE_CLIENT_SIDE_TOKEN is not configured.');
+        }
+
+        $plans = [
+            'personal-monthly' => ['name' => 'Personal', 'billing' => 'Monthly', 'display_price' => '£1.99 / month', 'price_id' => $paddle['personal_monthly_price_id'], 'activation_limit' => 1],
+            'personal-annual' => ['name' => 'Personal', 'billing' => 'Annual', 'display_price' => '£14.99 / year', 'price_id' => $paddle['personal_annual_price_id'], 'activation_limit' => 1],
+            'professional-monthly' => ['name' => 'Professional', 'billing' => 'Monthly', 'display_price' => '£3.99 / month', 'price_id' => $paddle['professional_monthly_price_id'], 'activation_limit' => 3],
+            'professional-annual' => ['name' => 'Professional', 'billing' => 'Annual', 'display_price' => '£29.99 / year', 'price_id' => $paddle['professional_annual_price_id'], 'activation_limit' => 3],
+        ];
+
+        foreach ($plans as $plan) {
+            if (trim((string) $plan['price_id']) === '') {
+                throw new RuntimeException('One or more Paddle price IDs are not configured.');
+            }
+        }
+
+        return view('checkout.buy', [
+            'plans' => $plans,
+            'paddleToken' => $token,
+            'paddleEnvironment' => (string) ($paddle['environment'] ?? 'sandbox'),
+        ]);
+    }
+}
@@ -1,15 +1,142 @@
 <?php
+
 namespace App\Http\Controllers\Portal;
+
 use App\Http\Controllers\Controller;
 use App\Models\License;
 use App\Models\LicenseDeliveryOutbox;
+use App\Models\LicenseProduct;
+use App\Services\Payments\PaddleClient;
+use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Crypt;
 use Illuminate\Support\Facades\Mail;
-final class PortalController extends Controller {
- private function owned(Request $request){ return License::with(['product','activations'])->whereRaw('lower(customer_email) = ?', [strtolower($request->user()->email)]); }
- public function index(Request $request){ return view('portal.index',['licenses'=>$this->owned($request)->latest()->get()]); }
- public function show(Request $request,License $license){ abort_unless(strtolower((string)$license->customer_email)===strtolower($request->user()->email),404); $license->load(['product','activations']); return view('portal.show',compact('license')); }
- public function deactivate(Request $request,License $license,int $activation){ abort_unless(strtolower((string)$license->customer_email)===strtolower($request->user()->email),404); $item=$license->activations()->whereKey($activation)->firstOrFail(); if(!$item->deactivated_at){$item->update(['deactivated_at'=>now()]);} return back()->with('status','Activation released.'); }
- public function resend(Request $request,License $license){ abort_unless(strtolower((string)$license->customer_email)===strtolower($request->user()->email),404); $out=LicenseDeliveryOutbox::where('license_id',$license->id)->first(); if(!$out) return back()->withErrors(['licence'=>'This licence was issued manually and its full key is not recoverable. Contact support.']); $plain=Crypt::decryptString($out->encrypted_license_key); Mail::raw("Your Rsync Studio licence key is:\n\n{$plain}\n\nKeep this key private.",fn($m)=>$m->to($request->user()->email)->subject('Your Rsync Studio licence key')); $out->update(['delivered_at'=>now()]); return back()->with('status','Licence key sent to your verified email address.'); }
+use RuntimeException;
+
+final class PortalController extends Controller
+{
+    public function __construct(private PaddleClient $paddle) {}
+
+    private function owned(Request $request)
+    {
+        return License::with(['product', 'activations'])
+            ->whereRaw('lower(customer_email) = ?', [strtolower($request->user()->email)]);
+    }
+
+    public function index(Request $request)
+    {
+        $licenses = $this->owned($request)->latest()->get();
+        $hasProfessional = $licenses->contains(fn (License $license) => $license->is_usable && $license->edition === 'Professional');
+
+        return view('portal.index', compact('licenses', 'hasProfessional'));
+    }
+
+    public function show(Request $request, License $license)
+    {
+        $this->authorise($request, $license);
+        $license->load(['product', 'activations']);
+
+        return view('portal.show', compact('license'));
+    }
+
+    public function upgrade(Request $request, License $license): RedirectResponse
+    {
+        $this->authorise($request, $license);
+        abort_unless($license->payment_provider === 'paddle' && $license->external_subscription_id, 422);
+        abort_unless($license->edition === 'Personal' && $license->is_usable, 422);
+
+        $targetPriceID = $this->professionalPriceFor($license);
+        $targetProduct = LicenseProduct::query()
+            ->where('payment_provider', 'paddle')
+            ->where('external_price_id', $targetPriceID)
+            ->where('active', true)
+            ->firstOrFail();
+
+        try {
+            $subscription = $this->paddle->updateSubscriptionPrice($license->external_subscription_id, $targetPriceID);
+        } catch (RuntimeException $exception) {
+            return back()->withErrors(['licence' => $exception->getMessage()]);
+        }
+
+        // Apply the entitlement immediately. Paddle webhooks remain authoritative and
+        // will reconcile subscription status/current-period details afterwards.
+        $license->update([
+            'license_product_id' => $targetProduct->id,
+            'edition' => $targetProduct->edition,
+            'activation_limit' => $targetProduct->activation_limit,
+            'max_major_version' => $targetProduct->max_major_version,
+            'external_price_id' => $targetPriceID,
+            'subscription_status' => (string) ($subscription['status'] ?? $license->subscription_status),
+            'revoked_at' => null,
+            'revoke_reason' => null,
+        ]);
+
+        return redirect()->route('portal.show', $license)->with('status', 'Upgraded to Professional. Your existing Paddle subscription was changed; no second subscription was created.');
+    }
+
+    public function cancel(Request $request, License $license): RedirectResponse
+    {
+        $this->authorise($request, $license);
+        abort_unless($license->payment_provider === 'paddle' && $license->external_subscription_id, 422);
+        abort_unless(! in_array($license->subscription_status, ['canceled'], true), 422);
+
+        try {
+            $this->paddle->cancelSubscriptionImmediately($license->external_subscription_id);
+        } catch (RuntimeException $exception) {
+            return back()->withErrors(['licence' => $exception->getMessage()]);
+        }
+
+        $license->update([
+            'subscription_status' => 'canceled',
+            'expires_at' => now(),
+            'revoked_at' => now(),
+            'revoke_reason' => 'Subscription canceled from licence portal',
+            'cancel_scheduled_at' => null,
+        ]);
+
+        return redirect()->route('portal.index')->with('status', 'Subscription canceled in Paddle and the licence is no longer active.');
+    }
+
+    public function deactivate(Request $request, License $license, int $activation)
+    {
+        $this->authorise($request, $license);
+        $item = $license->activations()->whereKey($activation)->firstOrFail();
+        if (! $item->deactivated_at) {
+            $item->update(['deactivated_at' => now()]);
+        }
+
+        return back()->with('status', 'Mac deactivated. Rsync Studio will detect this through the licensing API.');
+    }
+
+    public function resend(Request $request, License $license)
+    {
+        $this->authorise($request, $license);
+        $out = LicenseDeliveryOutbox::where('license_id', $license->id)->first();
+        if (! $out) {
+            return back()->withErrors(['licence' => 'This licence was issued manually and its full key is not recoverable. Contact support.']);
+        }
+
+        $plain = Crypt::decryptString($out->encrypted_license_key);
+        Mail::raw("Your Rsync Studio licence key is:\n\n{$plain}\n\nKeep this key private.", fn ($m) => $m->to($request->user()->email)->subject('Your Rsync Studio licence key'));
+        $out->update(['delivered_at' => now()]);
+
+        return back()->with('status', 'Licence key sent to your verified email address.');
+    }
+
+    private function authorise(Request $request, License $license): void
+    {
+        abort_unless(strtolower((string) $license->customer_email) === strtolower($request->user()->email), 404);
+    }
+
+    private function professionalPriceFor(License $license): string
+    {
+        $paddle = config('rsync-studio.paddle');
+        $current = (string) $license->external_price_id;
+
+        if ($current === (string) ($paddle['personal_annual_price_id'] ?? '')) {
+            return (string) ($paddle['professional_annual_price_id'] ?? '');
+        }
+
+        return (string) ($paddle['professional_monthly_price_id'] ?? '');
+    }
 }
@@ -0,0 +1,92 @@
+<?php
+
+namespace App\Http\Controllers\Support;
+
+use App\Http\Controllers\Controller;
+use App\Models\SupportTicket;
+use App\Models\User;
+use App\Notifications\NewSupportTicket;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Str;
+
+final class SupportController extends Controller
+{
+    public function create(Request $request)
+    {
+        return view('support', [
+            'categories' => [
+                'technical' => 'Technical support',
+                'licensing' => 'Licence & activation',
+                'billing' => 'Billing & subscription',
+                'feature' => 'Feature request',
+                'privacy' => 'Privacy / data request',
+                'general' => 'General enquiry',
+            ],
+        ]);
+    }
+
+    public function store(Request $request): RedirectResponse
+    {
+        // Honeypot: bots tend to fill hidden fields. Return success without retaining spam.
+        if (filled($request->input('company_website'))) {
+            return back()->with('status', 'Your support request has been received.');
+        }
+
+        $data = $request->validate([
+            'name' => ['required', 'string', 'max:120'],
+            'email' => ['required', 'email:rfc', 'max:254'],
+            'category' => ['required', 'in:technical,licensing,billing,feature,privacy,general'],
+            'subject' => ['required', 'string', 'max:180'],
+            'message' => ['required', 'string', 'min:10', 'max:10000'],
+            'privacy_notice' => ['accepted'],
+        ]);
+
+        $ticket = SupportTicket::create([
+            'user_id' => $request->user()?->id,
+            'reference' => $this->reference(),
+            'name' => $data['name'],
+            'email' => strtolower($data['email']),
+            'category' => $data['category'],
+            'subject' => $data['subject'],
+            'message' => $data['message'],
+            'privacy_notice_accepted_at' => now(),
+        ]);
+
+        $this->notifyTeam($ticket);
+
+        Mail::raw(
+            "We received your Rsync Studio support request.\n\nReference: {$ticket->reference}\nSubject: {$ticket->subject}\n\nWe will reply to this email address. Please keep the reference in any follow-up.",
+            fn ($mail) => $mail->to($ticket->email)->subject("Rsync Studio support request {$ticket->reference}")
+        );
+
+        return redirect()->route('support')->with('status', "Support request {$ticket->reference} received. A confirmation has been emailed to you.");
+    }
+
+    private function notifyTeam(SupportTicket $ticket): void
+    {
+        if (config('rsync-studio.support.notify_admin_users', true)) {
+            User::query()->where('is_admin', true)->get()->each->notify(new NewSupportTicket($ticket));
+        }
+
+        $emails = collect(config('rsync-studio.support.alert_emails', []))
+            ->filter(fn ($email) => filter_var($email, FILTER_VALIDATE_EMAIL))
+            ->unique()
+            ->values();
+
+        if ($emails->isNotEmpty()) {
+            Notification::route('mail', $emails->all())->notify(new NewSupportTicket($ticket));
+        }
+    }
+
+    private function reference(): string
+    {
+        do {
+            $reference = 'RS-'.now()->format('ymd').'-'.Str::upper(Str::random(6));
+        } while (SupportTicket::where('reference', $reference)->exists());
+
+        return $reference;
+    }
+}