feat(moderation): implement resource moderation queue and author deletions

GEMINI.md

@@ -1,8 +1,9 @@
 # Project Guidelines & Automated Checks
 
-## Formatting and Linting
+## Formatting, Linting & Builds
 - **Strict Trigger**: Do NOT run formatting, linting, or fix commands (`npm run format`, `composer lint`, `npm run lint`) during intermediate edits or regular conversational turns.
-- Only run the automated check commands when:
+- **Build Command**: Do NOT run `npm run build` during intermediate edits or conversational turns unless explicitly instructed by the user or strictly necessary for final pre-push verification.
+- Only run automated check commands when:
   1. The user explicitly instructs to `"push"` or `"commit"`.
   2. The user explicitly asks to check or fix formatting/linting issues.
 

app/Console/Commands/DeleteUnusedImages.php

@@ -7,6 +7,7 @@
 use App\Models\ForumPost;
 use App\Models\Notice;
 use App\Models\Resource;
+use App\Models\ResourceChangeRequest;
 use App\Models\SupportTicket;
 use App\Models\User;
 use Illuminate\Console\Command;
@@ -46,9 +47,19 @@ public function handle(): void
         );
 
         // Resource files (notes, images, videos — all stored under resources/)
+        // Also protects pending change requests awaiting moderation review
+        $activeResourceFiles = Resource::whereNotNull('file_path')->pluck('file_path')->toArray();
+        $pendingChangeRequestFiles = ResourceChangeRequest::where('status', 'pending')
+            ->whereNotNull('payload')
+            ->get()
+            ->pluck('payload.file_path')
+            ->filter()
+            ->values()
+            ->toArray();
+
         $this->cleanDirectory(
             'resources',
-            Resource::whereNotNull('file_path')->pluck('file_path')->toArray()
+            array_values(array_unique(array_merge($activeResourceFiles, $pendingChangeRequestFiles)))
         );
 
         // Forum post images

app/Http/Controllers/Admin/NodeController.php

@@ -6,6 +6,7 @@
 use App\Http\Requests\Node\StoreNodeRequest;
 use App\Http\Requests\Node\UpdateNodeRequest;
 use App\Models\Node;
+use App\Models\ResourceChangeRequest;
 use App\Models\Subject;
 use Illuminate\Http\Request;
 use Illuminate\Support\Str;
@@ -25,7 +26,7 @@ public function show(Subject $subject, $path = null)
                 'subject' => $subject,
                 'nodes' => $nodes,
                 'resources' => [],
-
+                'breadcrumb' => [],
             ]);
         }
 
@@ -42,13 +43,26 @@ public function show(Subject $subject, $path = null)
 
         foreach (array_slice($slugs, 1) as $slug) {
             $node = $node->children()->where('slug', $slug)->first();
+            if (! $node) {
+                abort(404);
+            }
         }
 
+        $pendingCreates = ResourceChangeRequest::where('node_id', $node->id)
+            ->where('action_type', 'create')
+            ->where('status', 'pending')
+            ->with('user:id,name,username')
+            ->get();
+
         return Inertia::render('admin/Node', [
             'subject' => $subject,
             'nodes' => $node->children,
-            'resources' => $node->resources ?? [],
-            'parent' => $node ? $node->append('is_effectively_frozen') : null,
+            'resources' => $node->resources()->with([
+                'pendingChangeRequest' => fn ($q) => $q->select('id', 'resource_id', 'action_type', 'status'),
+            ])->get(),
+            'pending_creates' => $pendingCreates,
+            'parent' => $node->append('is_effectively_frozen'),
+            'breadcrumb' => $node->breadcrumb(),
         ]);
     }
 

app/Http/Controllers/Admin/ResourceController.php

@@ -9,78 +9,120 @@
 use App\Http\Requests\Resource\UpdateResourceRequest;
 use App\Models\Node;
 use App\Models\Resource;
+use App\Models\ResourceChangeRequest;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Http;
-use Illuminate\Support\Facades\Storage;
+use Illuminate\Validation\ValidationException;
 
 class ResourceController extends Controller
 {
+    /**
+     * Determine maximum allowed pending submissions for the user.
+     * Verified users: 100, Unverified users: 30.
+     */
+    protected function getMaxPendingSubmissions(): int
+    {
+        return Auth::user()?->is_verified ? 100 : 30;
+    }
+
+    /**
+     * Check if user would exceed their pending change requests quota.
+     * Throws standard ValidationException so it returns as a typed error in Inertia errors.
+     */
+    protected function ensureUnderPendingLimit(int $incomingCount = 1): void
+    {
+        $userId = Auth::id();
+        $maxLimit = $this->getMaxPendingSubmissions();
+
+        $currentPending = ResourceChangeRequest::where('user_id', $userId)
+            ->where('status', 'pending')
+            ->count();
+
+        if (($currentPending + $incomingCount) > $maxLimit) {
+            throw ValidationException::withMessages([
+                'pending_limit' => "আপনি সর্বোচ্চ {$maxLimit}টি কন্টেন্ট আপলোড করার অনুরোধ করতে পারেন। আপনার আপলোডকৃত {$currentPending}টি কন্টেন্ট বর্তমানে পর্যালোচনাধীন রয়েছে, তাই অনুগ্রহ করে অপেক্ষা করুন।",
+            ]);
+        }
+    }
+
     public function store(StoreResourceRequest $request)
     {
+        $this->ensureUnderPendingLimit(1);
+
         $validated = $request->validated();
-        $validated['user_id'] = Auth::id();
 
         if ($request->hasFile('file')) {
-            $path = $request->file('file')->store("resources/{$validated['resource_type']}s");
-            $validated['file_path'] = $path;
+            $validated['file_path'] = $request->file('file')->store("resources/{$validated['resource_type']}s");
         }
 
-        Resource::create($validated);
+        ResourceChangeRequest::recordCreate(
+            Auth::id(),
+            (int) $validated['node_id'],
+            $validated
+        );
 
-        return back()->with('success', 'Resource created successfully.');
+        return back()->with('success', 'Resource submitted for moderation.');
     }
 
     public function update(UpdateResourceRequest $request, Resource $resource)
     {
-        $validated = $request->validated();
-
-        if ($request->hasFile('file')) {
+        if ($resource->pendingChangeRequest()->exists()) {
+            return back()->with('error', 'This resource already has a pending change request under review.');
+        }
 
-            if ($resource->file_path) {
-                Storage::delete($resource->file_path);
-            }
+        $this->ensureUnderPendingLimit(1);
 
-            $path = $request->file('file')
-                ->store("resources/{$validated['resource_type']}s");
+        $validated = $request->validated();
 
-            $validated['file_path'] = $path;
+        if ($request->hasFile('file')) {
+            $validated['file_path'] = $request->file('file')->store("resources/{$validated['resource_type']}s");
         }
 
-        $resource->update($validated);
+        ResourceChangeRequest::recordUpdate(
+            Auth::id(),
+            $resource,
+            $validated
+        );
 
-        return back()->with('success', 'Resource updated successfully.');
+        return back()->with('success', 'Resource update submitted for moderation.');
     }
 
     public function destroy(Resource $resource)
     {
-        if ($resource->file_path) {
-            Storage::delete($resource->file_path);
+        if ($resource->pendingChangeRequest()->exists()) {
+            return back()->with('error', 'This resource already has a pending change request under review.');
         }
 
-        $resource->delete();
+        $this->ensureUnderPendingLimit(1);
 
-        return redirect()->back()->with('success', 'Resource deleted successfully.');
+        ResourceChangeRequest::recordDelete(Auth::id(), $resource);
+
+        return redirect()->back()->with('success', 'Resource deletion request submitted for moderation.');
     }
 
     public function storeBulkImages(BulkImageStoreRequest $request)
     {
         $validated = $request->validated();
+        $filesCount = count($request->file('files') ?? []);
 
-        DB::transaction(function () use ($request, $validated) {
-            foreach ($request->file('files') as $index => $file) {
+        $this->ensureUnderPendingLimit($filesCount);
 
-                $validated['title'] = $validated['custom_titles'][$index];
-                $validated['file_path'] = $file->store('resources/images');
-                $validated['user_id'] = Auth::id();
-                $validated['resource_type'] = 'image';
+        $userId = Auth::id();
+        $nodeId = (int) $validated['node_id'];
 
-                Resource::create($validated);
+        DB::transaction(function () use ($request, $validated, $userId, $nodeId) {
+            foreach ($request->file('files') as $index => $file) {
+                ResourceChangeRequest::recordCreate($userId, $nodeId, [
+                    'title' => $validated['custom_titles'][$index],
+                    'resource_type' => 'image',
+                    'file_path' => $file->store('resources/images'),
+                ]);
             }
         });
 
-        return back()->with('success', 'Images uploaded successfully.');
+        return back()->with('success', 'Images submitted for moderation.');
     }
 
     public function storeBulkVideos(BulkVideoStoreRequest $request)
@@ -149,22 +191,24 @@ public function storeBulkVideos(BulkVideoStoreRequest $request)
         }
 
         $userId = Auth::id();
+        $nodeId = (int) $validated['node_id'];
+        $videosCount = count($videos);
+
+        $this->ensureUnderPendingLimit($videosCount);
 
-        DB::transaction(function () use ($videos, $validated, $userId) {
+        DB::transaction(function () use ($videos, $userId, $nodeId) {
             foreach ($videos as $video) {
                 $finalUrl = "https://www.youtube.com/watch?v={$video['video_id']}";
 
-                Resource::create([
-                    'user_id' => $userId,
-                    'node_id' => $validated['node_id'],
+                ResourceChangeRequest::recordCreate($userId, $nodeId, [
                     'title' => $video['title'],
                     'resource_type' => 'video',
                     'external_url' => $finalUrl,
                 ]);
             }
         });
 
-        return back()->with('success', 'YouTube playlist imported successfully.');
+        return back()->with('success', 'YouTube playlist imported and submitted for moderation.');
     }
 
     public function bulkRename(Request $request, Node $node)