Feat/user resource panel admin

app-modules/identity/database/factories/UserFactory.php

@@ -31,10 +31,35 @@ public function definition(): array
 
     public function superAdmin(): static
     {
-        return $this->afterCreating(function (User $user): void {
-            Role::findOrCreate(UserRole::SuperAdmin->value, UserRole::GUARD);
+        return $this->withRole(UserRole::SuperAdmin);
+    }
+
+    public function staff(): static
+    {
+        return $this->withRole(UserRole::Staff);
+    }
+
+    public function compliance(): static
+    {
+        return $this->withRole(UserRole::Compliance);
+    }
+
+    public function recruiter(): static
+    {
+        return $this->withRole(UserRole::Recruiter);
+    }
+
+    public function squadCaptain(): static
+    {
+        return $this->withRole(UserRole::SquadCaptain);
+    }
+
+    private function withRole(UserRole $role): static
+    {
+        return $this->afterCreating(function (User $user) use ($role): void {
+            Role::findOrCreate($role->value, UserRole::GUARD);
 
-            $user->assignRole(UserRole::SuperAdmin);
+            $user->assignRole($role);
         });
     }
 }

app-modules/identity/database/migrations/2026_09_14_120000_add_deleted_at_to_users_table.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', static function (Blueprint $table): void {
+            $table->timestampTz('deleted_at')->nullable();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', static function (Blueprint $table): void {
+            $table->dropColumn('deleted_at');
+        });
+    }
+};

app-modules/identity/database/migrations/2026_09_14_200835_make_users_username_unique_index_partial.php

@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    /**
+     * Uma conta soft-deletada não pode travar o `username` pra sempre — sem
+     * isso, `MergeAccountsAction` (e qualquer novo cadastro) esbarra em
+     * "duplicate key" ao tentar reaproveitar o username de um usuário
+     * apenas soft-deletado.
+     */
+    public function up(): void
+    {
+        DB::statement('ALTER TABLE users DROP CONSTRAINT users_username_unique');
+        DB::statement('CREATE UNIQUE INDEX users_username_unique ON users (username) WHERE deleted_at IS NULL');
+    }
+
+    public function down(): void
+    {
+        DB::statement('DROP INDEX users_username_unique');
+        DB::statement('ALTER TABLE users ADD CONSTRAINT users_username_unique UNIQUE (username)');
+    }
+};

app-modules/identity/src/Auth/Actions/FindOrCreateUserByProvider.php

@@ -5,6 +5,7 @@
 namespace He4rt\Identity\Auth\Actions;
 
 use He4rt\Identity\Auth\DTOs\OAuthUserDTO;
+use He4rt\Identity\Auth\Exceptions\AccountSoftDeletedException;
 use He4rt\Identity\ExternalIdentity\Models\ExternalIdentity;
 use He4rt\Identity\User\Models\User;
 use Illuminate\Database\UniqueConstraintViolationException;
@@ -36,17 +37,23 @@ private function findExistingUser(OAuthUserDTO $oauthUser): ?User
             ->where('model_type', (new User)->getMorphClass())
             ->first();
 
-        if ($identity?->model instanceof User) {
-            return $identity->model;
+        $user = $identity !== null
+            ? User::query()->withTrashed()->find($identity->model_id)
+            : null;
+
+        if (!$user instanceof User && $oauthUser->email !== null) {
+            $user = User::query()->withTrashed()->where('email', $oauthUser->email)->first();
+        }
+
+        if ($user === null) {
+            return null;
         }
 
-        if ($oauthUser->email !== null) {
-            return User::query()
-                ->where('email', $oauthUser->email)
-                ->first();
+        if ($user->trashed()) {
+            throw AccountSoftDeletedException::make();
         }
 
-        return null;
+        return $user;
     }
 
     private function createUser(OAuthUserDTO $oauthUser): User

app-modules/identity/src/Auth/Exceptions/AccountSoftDeletedException.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace He4rt\Identity\Auth\Exceptions;
+
+final class AccountSoftDeletedException extends OAuthFlowException
+{
+    public static function make(): self
+    {
+        return new self('This account was deleted and cannot be reactivated by logging in again.');
+    }
+}

app-modules/identity/src/Auth/Exceptions/OAuthFlowException.php

@@ -7,7 +7,7 @@
 use He4rt\Identity\ExternalIdentity\Enums\IdentityProvider;
 use RuntimeException;
 
-final class OAuthFlowException extends RuntimeException
+class OAuthFlowException extends RuntimeException
 {
     public static function providerNotSupported(string $provider): self
     {
@@ -34,6 +34,11 @@ public static function tokenExchangeFailed(string $provider, string $error): sel
         return new self(sprintf('Token exchange failed for "%s": %s', $provider, $error));
     }
 
+    public static function accountSoftDeleted(): self
+    {
+        return new self('This account was deleted and cannot be reactivated by logging in again.');
+    }
+
     public static function emailUnavailable(string $provider): self
     {
         return new self(sprintf(

app-modules/identity/src/Auth/Http/Controllers/OAuthController.php

@@ -9,6 +9,7 @@
 use He4rt\Identity\Auth\Actions\HandleOAuthCallbackAction;
 use He4rt\Identity\Auth\DTOs\OAuthStateDTO;
 use He4rt\Identity\Auth\Enums\OAuthIntent;
+use He4rt\Identity\Auth\Exceptions\AccountSoftDeletedException;
 use He4rt\Identity\Auth\Exceptions\OAuthFlowException;
 use He4rt\Identity\ExternalIdentity\Enums\IdentityProvider;
 use Illuminate\Http\RedirectResponse;
@@ -64,6 +65,10 @@ public function getAuthenticate(string $provider, HandleOAuthCallbackAction $act
 
         try {
             $result = $action->execute($state, $identityProvider, $code);
+        } catch (AccountSoftDeletedException) {
+            session()->flash('error', 'Esta conta foi excluída e não pode ser reativada fazendo login novamente.');
+
+            return redirect()->to($state->returnUrl ?? '/');
         } catch (OAuthFlowException $oAuthFlowException) {
             Log::warning('OAuth flow failed', ['provider' => $provider, 'error' => $oAuthFlowException->getMessage()]);
 

app-modules/identity/src/Authorization/Enums/UserRole.php

@@ -24,13 +24,21 @@ enum UserRole: string implements HasColor, HasDescription, HasIcon, HasLabel
     use StringifyEnum;
 
     case SuperAdmin = 'super-admin';
+    case Staff = 'staff';
+    case Compliance = 'compliance';
+    case Recruiter = 'recruiter';
+    case SquadCaptain = 'squad_captain';
 
     public const string GUARD = 'web';
 
     public function getLabel(): string
     {
         return match ($this) {
             self::SuperAdmin => 'Super admin',
+            self::Staff => 'Staff',
+            self::Compliance => 'Compliance',
+            self::Recruiter => 'Recrutador',
+            self::SquadCaptain => 'Capitão de squad',
         };
     }
 
@@ -41,20 +49,32 @@ public function getColor(): array
     {
         return match ($this) {
             self::SuperAdmin => Color::Red,
+            self::Staff => Color::Amber,
+            self::Compliance => Color::Orange,
+            self::Recruiter => Color::Blue,
+            self::SquadCaptain => Color::Purple,
         };
     }
 
     public function getDescription(): string
     {
         return match ($this) {
             self::SuperAdmin => 'Acesso total ao painel admin. Passa por cima de qualquer verificação de permissão.',
+            self::Staff => 'Gerencia usuários: edita identidade, perfil e endereço, e pode soft-deletar.',
+            self::Compliance => 'Acumula as permissões de Staff e é o único papel que pode excluir um usuário permanentemente.',
+            self::Recruiter => 'Vê a ficha de um membro para fins de recrutamento, sem acesso a moderação.',
+            self::SquadCaptain => 'Vê a ficha de um membro do squad, sem acesso a moderação.',
         };
     }
 
     public function getIcon(): Heroicon
     {
         return match ($this) {
             self::SuperAdmin => Heroicon::OutlinedShieldCheck,
+            self::Staff => Heroicon::OutlinedIdentification,
+            self::Compliance => Heroicon::OutlinedScale,
+            self::Recruiter => Heroicon::OutlinedBriefcase,
+            self::SquadCaptain => Heroicon::OutlinedFlag,
         };
     }
 }

app-modules/identity/src/IdentityServiceProvider.php

@@ -15,6 +15,7 @@ class IdentityServiceProvider extends ServiceProvider
     public function boot(): void
     {
         $this->loadMigrationsFrom(__DIR__.'/../database/migrations');
+        $this->loadTranslationsFrom(__DIR__.'/../lang', 'identity');
 
         Relation::morphMap([
             'user' => User::class,

app-modules/identity/src/User/Models/User.php

@@ -18,6 +18,8 @@
 use He4rt\Identity\User\Enums\UserSituation;
 use He4rt\Identity\User\Observers\UserObserver;
 use He4rt\Profile\Models\Profile;
+use He4rt\Profile\Models\ProfileSkill;
+use He4rt\Profile\Models\WorkExperience;
 use Illuminate\Database\Eloquent\Attributes\Hidden;
 use Illuminate\Database\Eloquent\Attributes\ObservedBy;
 use Illuminate\Database\Eloquent\Attributes\Table;
@@ -26,8 +28,10 @@
 use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Database\Eloquent\Concerns\HasUuids;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Relations\HasManyThrough;
 use Illuminate\Database\Eloquent\Relations\HasOne;
 use Illuminate\Database\Eloquent\Relations\MorphMany;
+use Illuminate\Database\Eloquent\SoftDeletes;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
 use Spatie\MediaLibrary\HasMedia;
@@ -44,9 +48,10 @@
  * @property CarbonInterface|null $suspended_until
  * @property CarbonInterface|null $banned_at
  * @property CarbonInterface|null $first_login_at
- * @property string|null $remember_token
+ * @property CarbonInterface|null $deleted_at
  * @property CarbonInterface|null $created_at
  * @property CarbonInterface|null $updated_at
+ * @property string|null $remember_token
  * @property-read UserSituation $situation
  * @property-read Collection<int, Role> $roles
  */
@@ -65,12 +70,47 @@ final class User extends Authenticatable implements FilamentUser, HasMedia, HasN
     use HasUuids;
     use InteractsWithMedia;
     use Notifiable;
+    use SoftDeletes;
 
     public function isSuperAdmin(): bool
     {
         return $this->hasRole(UserRole::SuperAdmin);
     }
 
+    public function isStaff(): bool
+    {
+        return $this->hasRole(UserRole::Staff);
+    }
+
+    public function isCompliance(): bool
+    {
+        return $this->hasRole(UserRole::Compliance);
+    }
+
+    /**
+     * Quem gerencia usuários: edita identidade/perfil/endereço e soft-deleta.
+     */
+    public function canManageUsers(): bool
+    {
+        return $this->isSuperAdmin() || $this->isStaff() || $this->isCompliance();
+    }
+
+    /**
+     * Hard delete é exclusivo de Compliance (e super admin, que sobrepõe tudo).
+     */
+    public function canHardDeleteUsers(): bool
+    {
+        return $this->isSuperAdmin() || $this->isCompliance();
+    }
+
+    /**
+     * Recruiter/SquadCaptain veem a ficha do usuário, mas não a seção de Moderação.
+     */
+    public function canViewModeration(): bool
+    {
+        return $this->isSuperAdmin() || $this->isStaff() || $this->isCompliance();
+    }
+
     /**
      * @return MorphMany<ExternalIdentity, $this>
      */
@@ -95,6 +135,36 @@ public function profile(): HasOne
         return $this->hasOne(Profile::class);
     }
 
+    /**
+     * @return HasManyThrough<ProfileSkill, Profile, $this>
+     */
+    public function profileSkills(): HasManyThrough
+    {
+        return $this->hasManyThrough(
+            ProfileSkill::class,
+            Profile::class,
+            'user_id',
+            'profile_id',
+            'id',
+            'id',
+        );
+    }
+
+    /**
+     * @return HasManyThrough<WorkExperience, Profile, $this>
+     */
+    public function workExperiences(): HasManyThrough
+    {
+        return $this->hasManyThrough(
+            WorkExperience::class,
+            Profile::class,
+            'user_id',
+            'profile_id',
+            'id',
+            'id',
+        );
+    }
+
     public function getFilamentName(): string
     {
         return $this->username;
@@ -108,7 +178,13 @@ public function registerMediaCollections(): void
     public function canAccessPanel(Panel $panel): bool
     {
         return match ($panel->getId()) {
-            'admin' => app()->isProduction() ? $this->isSuperAdmin() : true,
+            'admin' => app()->isProduction() ? $this->hasAnyRole([
+                UserRole::SuperAdmin,
+                UserRole::Staff,
+                UserRole::Compliance,
+                UserRole::Recruiter,
+                UserRole::SquadCaptain,
+            ]) : true,
             default => true
         };
     }

app-modules/identity/src/User/Observers/UserObserver.php

@@ -21,7 +21,7 @@ public function created(User $user): void
         $this->ensureProfileExists($user);
     }
 
-    public function deleted(User $user): void
+    public function forceDeleted(User $user): void
     {
         $user->address()->delete();
     }