Migrate HickLab3D dashboard and add production auto deployment

app/Http/Controllers/UserController.php

@@ -0,0 +1,69 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\User;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Validation\Rule;
+use Illuminate\View\View;
+
+class UserController extends Controller
+{
+    public function index(Request $request): View
+    {
+        $this->authorizeAdmin($request);
+
+        return view('users.index', ['users' => User::orderBy('username')->paginate(20)]);
+    }
+
+    public function store(Request $request): RedirectResponse
+    {
+        $this->authorizeAdmin($request);
+        $data = $request->validate([
+            'username' => ['required', 'string', 'max:255', 'unique:users,username'],
+            'email' => ['required', 'email', 'max:255', 'unique:users,email'],
+            'role' => ['required', Rule::in(['admin', 'user'])],
+            'password' => ['required', 'string', 'min:12'],
+            'alertEmails' => ['sometimes', 'boolean'],
+        ]);
+        User::create($data);
+
+        return back()->with('status', 'User created.');
+    }
+
+    public function update(Request $request, User $user): RedirectResponse
+    {
+        $this->authorizeAdmin($request);
+        $data = $request->validate([
+            'email' => ['sometimes', 'email', Rule::unique('users', 'email')->ignore($user->id)],
+            'role' => ['sometimes', Rule::in(['admin', 'user'])],
+            'disabled' => ['sometimes', 'boolean'],
+            'alertEmails' => ['sometimes', 'boolean'],
+            'password' => ['nullable', 'string', 'min:12'],
+        ]);
+        if (empty($data['password'])) {
+            unset($data['password']);
+        }
+        if ($user->id === $request->user()->id && (($data['disabled'] ?? false) || ($data['role'] ?? 'admin') !== 'admin')) {
+            return back()->withErrors(['user' => 'You cannot disable or demote your own admin account.']);
+        }
+        $user->update($data);
+
+        return back()->with('status', 'User updated.');
+    }
+
+    public function destroy(Request $request, User $user): RedirectResponse
+    {
+        $this->authorizeAdmin($request);
+        abort_if($user->id === $request->user()->id, 422, 'You cannot delete your own account.');
+        $user->delete();
+
+        return back()->with('status', 'User deleted.');
+    }
+
+    private function authorizeAdmin(Request $request): void
+    {
+        abort_unless($request->user()->role === 'admin', 403);
+    }
+}