Kế hoạch triển khai
Construction PM

services:
  laravel.test:           # App Laravel chính
    build:
      context: ./vendor/laravel/sail/runtimes/8.4
    ports: ["80:80", "443:443"]
    environment:
      WWWUSER: 1000
    volumes: ['.:${SAIL_APPLICATION_VOLUME}']
    depends_on: [mysql, redis, mailpit]
    networks: [sail]

  mysql:
    image: mysql/mysql-server:8.0
    environment:
      MYSQL_ROOT_PASSWORD: '${DB_PASSWORD}'
      MYSQL_DATABASE: '${DB_DATABASE}'
      MYSQL_USER: '${DB_USERNAME}'
      MYSQL_PASSWORD: '${DB_PASSWORD}'
    volumes: ['sail-mysql:/var/lib/mysql']
    ports: ["3306:3306"]
    networks: [sail]

  redis:
    image: redis:alpine
    ports: ["6379:6379"]
    networks: [sail]

  mailpit:              # Bắt email khi dev — không gửi thật
    image: axllent/mailpit
    ports: ["8025:8025", "1025:1025"]
    networks: [sail]

networks:
  sail: {driver: bridge}
volumes:
  sail-mysql: {driver: local}

# App
APP_NAME="Construction PM"
APP_URL=http://localhost

# Database
DB_CONNECTION=mysql
DB_HOST=mysql          # tên service trong docker-compose
DB_PORT=3306
DB_DATABASE=construction_pm
DB_USERNAME=sail
DB_PASSWORD=password

# Redis
REDIS_HOST=redis
REDIS_PORT=6379

# Queue — dùng Redis thay vì sync
QUEUE_CONNECTION=redis

# AWS S3 — Primary Storage
AWS_ACCESS_KEY_ID=your_key
AWS_SECRET_ACCESS_KEY=your_secret
AWS_DEFAULT_REGION=ap-southeast-1   # Singapore
AWS_BUCKET=construction-pm-files
AWS_URL=                             # để trống — dùng Presigned URL

# Microsoft Graph API — SharePoint Backup
MICROSOFT_TENANT_ID=your_tenant_id
MICROSOFT_CLIENT_ID=your_client_id
MICROSOFT_CLIENT_SECRET=your_secret
SHAREPOINT_SITE_ID=your_site_id
SHAREPOINT_DRIVE_ID=your_drive_id

# Mail (dev dùng mailpit, prod dùng SES)
MAIL_MAILER=smtp
MAIL_HOST=mailpit
MAIL_PORT=1025

# 1. Frontend stack (Vue 3 + Inertia)
./vendor/bin/sail composer require inertiajs/inertia-laravel
npm install @inertiajs/vue3 vue@3

# 2. RBAC — phân quyền
./vendor/bin/sail composer require spatie/laravel-permission

# 3. Audit log
./vendor/bin/sail composer require spatie/laravel-activitylog

# 4. AWS S3
./vendor/bin/sail composer require league/flysystem-aws-s3-v3

# 5. Microsoft Graph API
./vendor/bin/sail composer require microsoft/microsoft-graph

# 6. Excel import/export
./vendor/bin/sail composer require maatwebsite/excel

# 7. PDF generation (approval stamp)
./vendor/bin/sail composer require barryvdh/laravel-dompdf

# 8. Queue dashboard
./vendor/bin/sail composer require laravel/horizon

# 9. Publish configs
./vendor/bin/sail artisan vendor:publish --provider="Spatie\Permission\PermissionServiceProvider"
./vendor/bin/sail artisan vendor:publish --provider="Laravel\Horizon\HorizonServiceProvider"
./vendor/bin/sail artisan migrate    # Tạo bảng permissions, jobs, etc.

# 10. Frontend deps
npm install fabric uppy @uppy/core @uppy/dashboard @uppy/aws-s3-multipart
npm install pdfjs-dist @thatopen/components
npm run dev    # Vite hot reload

app/
├── Http/Controllers/
│   ├── FileController.php        # Upload, download, delete
│   ├── FolderController.php      # CRUD folder
│   ├── ApprovalController.php    # Submit, approve, reject
│   └── AnnotationController.php  # Save/load annotations
├── Services/
│   ├── StorageManager.php        # Điều phối S3 + SharePoint
│   ├── Drivers/
│   │   ├── S3Driver.php          # Upload, Presigned URL, delete
│   │   └── SharePointDriver.php  # Graph API: upload, create folder
│   ├── VersioningService.php     # Logic v1 → v2 → v3
│   └── ApprovalService.php       # Workflow state machine
├── Jobs/
│   ├── SharePointUploadJob.php   # Async backup lên SharePoint
│   ├── FlattenPdfJob.php         # Flatten annotations → PDF mới
│   └── SendApprovalEmailJob.php  # Gửi email notification
├── Models/
│   ├── Organization.php
│   ├── Project.php
│   ├── Folder.php
│   ├── File.php
│   ├── FileVersion.php
│   ├── Annotation.php
│   ├── Submission.php
│   └── ApprovalStep.php
└── Policies/
    ├── FolderPolicy.php          # Ai được xem/sửa folder nào
    └── FilePolicy.php            # Ai được download/delete file

// Roles hệ thống
$roles = [
    'super_admin',   // Admin tổng — toàn quyền
    'org_admin',     // Admin tổ chức — quản lý member của org mình
    'project_manager', // Quản lý dự án — approve, quản lý folder
    'member',        // Thành viên — upload, download theo quyền folder
    'viewer',        // Chỉ xem — không upload, không download (chỉ preview)
];

// Permissions — kết hợp với FolderPolicy để check per-folder
$permissions = [
    // File permissions
    'file.upload',      'file.download',   'file.delete',
    'file.view',        'file.annotate',   'file.version.view',
    // Folder permissions
    'folder.create',    'folder.rename',   'folder.delete',
    // Approval permissions
    'approval.submit',  'approval.review', 'approval.approve',
    // Admin permissions
    'user.manage',      'org.manage',      'project.manage',
    'permission.manage', 'setting.manage',
];

class StorageManager
{
    public function store(UploadedFile $file, $folder, $metadata): FileModel
    {
        // 1. Generate UUID key — không dùng tên file gốc
        $uuid   = Str::uuid();
        $s3Key  = "projects/{$folder->project_id}/{$folder->path}/{$uuid}.{$ext}";

        // 2. Upload S3 — SYNCHRONOUS (user chờ kết quả này)
        Storage::disk('s3')->put($s3Key, fopen($file, 'r'), 'private');

        // 3. Lưu metadata vào DB
        $fileRecord = FileModel::create([
            'folder_id'       => $folder->id,
            's3_key'          => $s3Key,
            'original_name'   => $file->getClientOriginalName(),
            'size_bytes'      => $file->getSize(),
            'current_version' => 1,
        ]);

        // 4. Dispatch job SharePoint — ASYNCHRONOUS (user không chờ)
        SharePointUploadJob::dispatch($fileRecord->id, $s3Key)
            ->onQueue('sharepoint')
            ->delay(now()->addSeconds(5));

        return $fileRecord;
    }

    public function temporaryUrl(FileModel $file, $minutes = 15): string
    {
        // LUÔN dùng temporaryUrl — không bao giờ expose S3 URL trực tiếp
        return Storage::disk('s3')
            ->temporaryUrl($file->s3_key, now()->addMinutes($minutes));
    }
}

<!-- Layout chính DMS -->
<template>
  <div class="dms-layout">

    <!-- Panel trái: Folder Tree -->
    <aside class="folder-tree">
      <FolderTree
        :folders="projectFolders"
        :active-id="activeFolderId"
        @select="onFolderSelect"
        @context-menu="showContextMenu"   <!-- right-click -->
      />
    </aside>

    <!-- Panel giữa: File list -->
    <main class="file-panel">
      <Breadcrumb :path="currentPath" />
      <FileToolbar @upload="openUploader" @view-toggle="toggleView" />
      <FileGrid v-if="viewMode==='grid'" :files="files" @click="openFile" />
      <FileTable v-else :files="files" @click="openFile" />
    </main>

    <!-- Panel phải: File Viewer + Sidebar -->
    <FileViewer
      v-if="selectedFile"
      :file="selectedFile"
      :presigned-url="presignedUrl"
    />
  </div>
</template>

// Khi approval hoàn tất → dispatch job này
class FlattenPdfJob implements ShouldQueue
{
    public function handle(): void
    {
        // 1. Download PDF gốc từ S3 về temp
        $pdfBytes = Storage::disk('s3')->get($this->file->s3_key);

        // 2. Gọi Node.js microservice để flatten với pdf-lib
        //    (pdf-lib là JS lib — gọi qua HTTP hoặc exec node script)
        $response = Http::post('http://pdf-service:3001/flatten', [
            'pdfBase64'   => base64_encode($pdfBytes),
            'annotations' => $this->annotations, // fabric_json array
            'approvalStamp' => [
                'text'     => "APPROVED",
                'approver' => $this->approver->name,
                'date'     => now()->format('d/m/Y H:i'),
            ],
        ]);

        // 3. Upload PDF mới lên S3 → tạo version mới
        $newS3Key = str_replace('.pdf', '_v'.$newVersion.'.pdf', $this->file->s3_key);
        Storage::disk('s3')->put($newS3Key, base64_decode($response['pdfBase64']));

        // 4. Mark annotations as flattened, file version mới
        Annotation::whereFileId($this->file->id)->update(['is_flattened' => true]);
        // dispatch SharePointUploadJob cho bản approved mới
    }
}