# WhatsApp Auth Swap Design

## Objective
Replace the `users.phone` column with the `whatsapp_number` stored on the related `customers` / `owners` profile so that customers and owners can register and log in using their WhatsApp number. Email remains required when WhatsApp is absent, and WhatsApp remains required when email is absent (XOR).

## Scope
- Remove `phone` from `users`.
- Make `users.email` nullable.
- Make `customers.whatsapp_number` and `owners.whatsapp_number` nullable. Unique validation is enforced at the Form Request level for registration.
- Update all authentication endpoints (login, register, verify, resend OTP, forgot/reset password) to use `whatsapp_number` instead of `phone`.
- Update admin/employee creation to no longer require or store `phone`.
- Update profile update, user resources, factories, console commands, rate limiter, and tests.
- Update on-arrival/pending-customer flows to identify customers by `whatsapp_number` instead of `phone`.

## Design Decisions

### 1. Database
- Single migration drops the `phone` column (and its index) from `users` and makes `email` nullable.
- Separate migrations make `whatsapp_number` nullable and unique on `customers` and `owners`.
- Nullable unique columns are used so that email-only or WhatsApp-only accounts are allowed.

### 2. Login
- Login accepts `email` OR `whatsapp_number`.
- When `whatsapp_number` is provided, lookup is performed through `customer` or `owner` relation:
  ```php
  User::whereHas('customer', fn ($q) => $q->where('whatsapp_number', $value))
      ->orWhereHas('owner', fn ($q) => $q->where('whatsapp_number', $value))
      ->first();
  ```

### 3. Registration (Customer / Owner)
- Validation: `email` required_without `whatsapp_number`; `whatsapp_number` required_without `email`.
- If `whatsapp_number` is provided, create the profile record with it and send OTP to it; account starts unverified.
- If only `email` is provided, create the profile record with a null WhatsApp number and mark the user as verified (no WhatsApp OTP channel exists for email-only accounts).

### 4. Admins / Employees
- These roles have no customer/owner profile and therefore no `whatsapp_number` storage.
- Remove `phone` from creation/validation; they authenticate with email only.

### 5. OTP / Reset Password
- `verify-account`, `resend-otp`, `forgot-password`, `reset-password` use `whatsapp_number` to locate the user via the customer/owner relation.
- `AuthService::findUserByContact` is updated to search by email, customer WhatsApp, or owner WhatsApp.
- `AuthService::contactKeyForUser` returns the profile WhatsApp number.

### 6. Profile & Resources
- `UserResource` / `AdminUserResource` expose `whatsapp_number` from `user->profile` instead of `phone`.
- Profile update removes `phone`; `whatsapp_number` updates the related customer/owner record.

### 7. Pending / On-Arrival Customers
- Keep the `phone` column on `pending_customers` as supplementary contact data but switch lookup/identification to `whatsapp_number` to align with the new contact identifier.

### 8. Rate Limiter
- The auth-verify-otp rate limiter key switches from `phone` to `whatsapp_number`.

### 9. Tests
- Update all factories and tests to stop passing `phone`; use `whatsapp_number` where a contact number is needed.
- Email-only tests are added/adjusted for the XOR requirement.

## Files to Change
- `database/migrations/*` (new migrations + existing index migration compatibility)
- `app/Models/User.php`
- `app/Http/Controllers/Api/AuthController.php`
- `app/Services/AuthService.php`
- `app/Http/Requests/Auth/*`
- `app/Http/Controllers/Api/ProfileController.php`
- `app/Http/Requests/Customer/UpdateProfileRequest.php`
- `app/Http/Controllers/Api/Owner/EmployeeController.php`
- `app/Http/Requests/Owner/StoreEmployeeRequest.php`
- `app/Http/Requests/Owner/UpdateEmployeeRequest.php`
- `app/Http/Controllers/Api/Admin/AdminController.php`
- `app/Http/Requests/Auth/RegisterAdminRequest.php`
- `app/Http/Controllers/Api/PendingCustomerController.php`
- `app/Http/Controllers/ReservationController.php`
- `app/Http/Resources/UserResource.php`
- `app/Http/Resources/Admin/AdminUserResource.php`
- `app/Providers/AppServiceProvider.php`
- `app/Console/Commands/CreateSuperAdmin.php`
- `database/factories/UserFactory.php`
- `tests/Feature/Auth/*`
- `tests/Feature/Validation/FormRequestsTest.php`
- `tests/Feature/Console/CreateSuperAdminCommandTest.php`
- `tests/Feature/Admin/AdminCreationTest.php`
- `tests/Feature/Owner/EmployeeStoreTest.php`
- `tests/Feature/Owner/EmployeeUpdateTest.php`

## Approval
Approved by user directive (auto-permission mode). Proceeding to implementation plan.