feat: autorisations

app/Http/Controllers/DeviceTokenController.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Http\Requests\DeviceTokenRequest;
+use App\Models\DeviceToken;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+
+class DeviceTokenController extends Controller
+{
+    public function store(DeviceTokenRequest $request): JsonResponse
+    {
+        $data = $request->validated();
+
+        $deviceToken = DeviceToken::updateOrCreate(
+            ['expo_push_token' => $data['expo_push_token']],
+            [
+                'platform' => $data['platform'] ?? null,
+                'user_id' => $request->user()->getKey(),
+            ],
+        );
+
+        return response()->json([
+            'message' => $deviceToken->wasRecentlyCreated
+                ? 'Token appareil enregistré.'
+                : 'Token appareil mis à jour.',
+            'deviceToken' => [
+                'id' => $deviceToken->id,
+                'expoPushToken' => $deviceToken->expo_push_token,
+                'platform' => $deviceToken->platform,
+            ],
+        ], $deviceToken->wasRecentlyCreated ? 201 : 200);
+    }
+
+    public function destroy(Request $request): Response
+    {
+        $data = $request->validate([
+            'expo_push_token' => ['required', 'string', 'max:255'],
+        ]);
+
+        DeviceToken::query()
+            ->where('user_id', $request->user()->getKey())
+            ->where('expo_push_token', $data['expo_push_token'])
+            ->delete();
+
+        return response()->noContent();
+    }
+}

app/Http/Requests/DeviceTokenRequest.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class DeviceTokenRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'expo_push_token' => ['required', 'string', 'max:255'],
+            'platform' => ['nullable', 'string', 'in:ios,android,web'],
+        ];
+    }
+}

app/Models/DeviceToken.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class DeviceToken extends Model
+{
+    protected $fillable = [
+        'user_id',
+        'expo_push_token',
+        'platform',
+    ];
+
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+}

app/Models/User.php

@@ -7,6 +7,7 @@ use Filament\Models\Contracts\FilamentUser;
 use Filament\Panel;
 use Illuminate\Database\Eloquent\Concerns\HasUlids;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
 use Laravel\Sanctum\HasApiTokens;
@@ -53,6 +54,11 @@ class User extends Authenticatable implements FilamentUser
     }
 
 
+    public function deviceTokens(): HasMany
+    {
+        return $this->hasMany(DeviceToken::class);
+    }
+
     public function isAdmin()
     {
         return true;

database/migrations/0001_01_01_000000_create_users_table.php

@@ -19,7 +19,6 @@ return new class extends Migration
             $table->string('password');
             $table->text('bio')->nullable();
             $table->string('avatar_url', 2048)->nullable();
-
             $table->rememberToken();
             $table->timestamps();
         });

database/migrations/2026_05_16_122204_create_device_tokens_table.php

@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('device_tokens', function (Blueprint $table) {
+            $table->id();
+            $table->foreignUlid('user_id')->constrained()->cascadeOnDelete();
+            $table->string('expo_push_token');
+            $table->string('platform')->nullable();
+            $table->timestampsTz();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::dropIfExists('device_tokens');
+    }
+};

routes/api.php

@@ -1,6 +1,7 @@
 <?php
 
 use App\Http\Controllers\AuthController;
+use App\Http\Controllers\DeviceTokenController;
 use App\Http\Controllers\MealPostController;
 use Illuminate\Support\Facades\Route;
 
@@ -15,4 +16,9 @@ Route::prefix('auth')->group(function (): void {
 
 });
 
+Route::middleware('auth:sanctum')->group(function (): void {
+    Route::post('device-tokens', [DeviceTokenController::class, 'store']);
+    Route::delete('device-tokens', [DeviceTokenController::class, 'destroy']);
+});
+
 Route::middleware('auth:sanctum')->apiResource('meal-posts', MealPostController::class);