Review, publish, preview and undo changes through the API

Revisions now call publishing only what publishes: a project's status is
whether the work is active, and a service is published by its flag.

The fake identity server answers by token, so a test can sign in a second
person.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Support/AdminContent.php

@@ -0,0 +1,132 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Support;
+
+use App\Models\Call;
+use App\Models\Category;
+use App\Models\Client;
+use App\Models\Member;
+use App\Models\Page;
+use App\Models\Project;
+use App\Models\Service;
+use App\Models\Talk;
+use App\Models\Technology;
+use App\Models\Testimonial;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\SoftDeletes;
+
+/**
+ * The content the admin API addresses by name — `pages`, `projects` — and
+ * what each one supports beyond plain editing: a history, a review, a preview.
+ *
+ * One table rather than a flag on every model, so the routes, the
+ * specification and the controllers that serve those extras all read the same
+ * answer.
+ */
+final class AdminContent
+{
+    /**
+     * API name => [model, route parameter].
+     *
+     * @var array<string, array{0: class-string<Model>, 1: string}>
+     */
+    public const WITH_HISTORY = [
+        'pages' => [Page::class, 'page'],
+        'categories' => [Category::class, 'category'],
+        'projects' => [Project::class, 'project'],
+        'members' => [Member::class, 'member'],
+        'services' => [Service::class, 'service'],
+        'clients' => [Client::class, 'client'],
+        'testimonials' => [Testimonial::class, 'testimonial'],
+        'talks' => [Talk::class, 'talk'],
+        'technologies' => [Technology::class, 'technology'],
+        'calls' => [Call::class, 'call'],
+    ];
+
+    /**
+     * What goes through a review before it reaches the site, and the fields
+     * that put each one there — the ones `{resource}.publish` guards.
+     *
+     * @var array<string, array<int, string>>
+     */
+    public const REVIEWABLE = [
+        'pages' => ['status', 'published_at', 'unpublish_at'],
+        'projects' => ['published_at', 'unpublish_at'],
+        'services' => ['is_published', 'published_at', 'unpublish_at'],
+    ];
+
+    /**
+     * What has an address on the public site to preview, by the type name
+     * `SiteUrls` knows it as.
+     *
+     * @var array<string, string>
+     */
+    public const PREVIEWABLE = [
+        'pages' => 'page',
+        'projects' => 'project',
+        'services' => 'service',
+        'calls' => 'call',
+    ];
+
+    /**
+     * @return class-string<Model>
+     */
+    public static function model(string $resource): string
+    {
+        return self::WITH_HISTORY[$resource][0] ?? abort(404);
+    }
+
+    public static function parameter(string $resource): string
+    {
+        return self::WITH_HISTORY[$resource][1] ?? abort(404);
+    }
+
+    /**
+     * The record a route names, binned ones included: their history is still
+     * worth reading, and restoring them is what the bin is for.
+     */
+    public static function find(string $resource, mixed $id): Model
+    {
+        return self::findOf(self::model($resource), $id);
+    }
+
+    /**
+     * @param  class-string<Model>  $model
+     */
+    public static function findOf(string $model, mixed $id): Model
+    {
+        $query = $model::query();
+
+        if (in_array(SoftDeletes::class, class_uses_recursive($model), true)) {
+            $query->withTrashed();
+        }
+
+        return $query->findOrFail($id);
+    }
+
+    /**
+     * The API name of a record, for a review queue that mixes several kinds.
+     */
+    public static function nameOf(Model $record): ?string
+    {
+        foreach (self::WITH_HISTORY as $resource => [$model]) {
+            if ($record instanceof $model) {
+                return $resource;
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * The fields only `{resource}.publish` may write, for this record.
+     *
+     * @return array<int, string>
+     */
+    public static function publicationFields(Model $record): array
+    {
+        return self::REVIEWABLE[self::nameOf($record)] ?? [];
+    }
+}

app/Support/Publisher.php

@@ -0,0 +1,53 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Support;
+
+use App\Enums\PageStatus;
+use App\Models\Page;
+use App\Models\Project;
+use App\Models\Service;
+use Carbon\CarbonInterface;
+use Illuminate\Database\Eloquent\Model;
+use InvalidArgumentException;
+
+/**
+ * Putting a record on the site, or taking it off, whichever fields that means
+ * for its kind: a page has a status, a project only a date, a service a flag
+ * and a date.
+ */
+final class Publisher
+{
+    /**
+     * Live now, or from `$at` when it is in the future. Whatever review it was
+     * waiting for is answered either way: scheduling is the decision.
+     */
+    public static function publish(Model $record, ?CarbonInterface $at = null): void
+    {
+        $at ??= now();
+
+        $record->forceFill(match (true) {
+            $record instanceof Page => ['status' => PageStatus::Published, 'published_at' => $at],
+            $record instanceof Project => ['published_at' => $at],
+            $record instanceof Service => ['is_published' => true, 'published_at' => $at],
+            default => throw new InvalidArgumentException($record::class.' is not published this way.'),
+        })->save();
+
+        // Publishing now closes the review by itself (HasReviews); a date in
+        // the future does not, so it is closed here.
+        if ($record->isAwaitingReview()) {
+            $record->closeReview();
+        }
+    }
+
+    public static function unpublish(Model $record): void
+    {
+        $record->forceFill(match (true) {
+            $record instanceof Page => ['status' => PageStatus::Draft],
+            $record instanceof Project => ['published_at' => null],
+            $record instanceof Service => ['is_published' => false],
+            default => throw new InvalidArgumentException($record::class.' is not published this way.'),
+        })->save();
+    }
+}