# Employee WhatsApp Login — Phase 1 Design

**Goal:** Make WhatsApp number the employee's primary identity and login credential. Email becomes optional for employees.

**Out of scope for Phase 1:** OTP on first login, forced password-change screen, and `must_change_password` flag. These are planned for Phase 2.

---

## Current State

- `users` table: `email` is nullable; `whatsapp_number` is nullable and **not unique**.
- `AuthController::login` already supports login by `email` or `whatsapp_number` + password.
- `EmployeeController::store` already writes `whatsapp_number` if present and sets `is_verified => false`, but `StoreEmployeeRequest` does not allow `whatsapp_number` and requires `email`.
- `EmployeeController::update` only writes `name` and `email` to the user record.
- Employee list search only matches `name` or `email`.

## Proposed Changes (Phase 1)

### 1. Database

Create a migration that adds a unique index on `users.whatsapp_number` so it can safely be used as a login identifier.

```php
Schema::table('users', function (Blueprint $table) {
    $table->unique('whatsapp_number');
});
```

### 2. Employee creation

Update `StoreEmployeeRequest`:

```php
'name' => ['required', 'string', 'max:255'],
'email' => ['nullable', 'string', 'email', 'max:255', 'unique:users,email'],
'whatsapp_number' => ['required', 'string', 'max:255', new WhatsAppNumber, 'unique:users,whatsapp_number'],
'password' => ['required', 'string', Password::default()],
```

`EmployeeController::store` already consumes these keys; no logic change needed beyond the request rules.

### 3. Employee update

Update `UpdateEmployeeRequest`:

```php
'name' => ['sometimes', 'string', 'max:255'],
'email' => ['nullable', 'string', 'email', 'max:255', Rule::unique('users', 'email')->ignore($employeeUserId)],
'whatsapp_number' => ['sometimes', 'string', 'max:255', new WhatsAppNumber, Rule::unique('users', 'whatsapp_number')->ignore($employeeUserId)],
```

Update `EmployeeController::update` to include `whatsapp_number` in the user data whitelist:

```php
$userData = array_intersect_key($data, array_flip(['name', 'email', 'whatsapp_number']));
```

### 4. Employee list search

`EmployeeController::index` should also search by `whatsapp_number`:

```php
->when($request->filled('q'), fn ($q) => $q->whereHas('user', fn ($u) => $u
    ->where('name', 'like', "%$search%")
    ->orWhere('email', 'like', "%$search%")
    ->orWhere('whatsapp_number', 'like', "%$search%")))
```

## Data Flow

1. Owner creates employee with `name`, `whatsapp_number`, `password`, and optional `email`.
2. Employee logs in with `whatsapp_number` + password via existing `/api/login`.
3. Owner can update the employee's `whatsapp_number` (and optional `email`) later.

## Error Handling

- Duplicate `whatsapp_number`: 422 with standard Laravel unique validation message.
- Missing `whatsapp_number`: 422 required validation.
- Invalid `whatsapp_number`: 422 via existing `WhatsAppNumber` rule.

## Testing

- Update `tests/Feature/Owner/EmployeeManagementTest.php` (or create if missing):
  - Create employee with WhatsApp only (no email).
  - Reject creation without WhatsApp.
  - Reject duplicate WhatsApp.
  - Update employee WhatsApp number.
  - Search employees by WhatsApp number.
- Ensure existing employee tests still pass.

## Phase 2 Preview (not implemented now)

- `must_change_password` column on `users`.
- Employee first login sends OTP via `OtpService` + `WhatsAppService`.
- `verifyAccount` flow for employees.
- Frontend forced password-change screen after OTP verification.