Login Loop

app/Http/Controllers/PlatformAuthController.php

@@ -4,6 +4,7 @@ namespace App\Http\Controllers;
 
 use App\Enums\InstallationStatus;
 use App\Models\ApplicationInstallation;
+use App\Models\User;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
@@ -31,12 +32,34 @@ class PlatformAuthController extends Controller
             'password' => ['required', 'string'],
         ]);
 
-        if (! Auth::attempt($credentials, $request->boolean('remember')) || ! $request->user()?->isSuperAdmin) {
+        if (! Auth::attempt($credentials, $request->boolean('remember'))) {
             Auth::logout();
 
             return back()->withErrors(['email' => 'Those platform administrator details do not match our records.'])->onlyInput('email');
         }
 
+        $user = $request->user();
+        if (! $user?->isSuperAdmin) {
+            $installation = ApplicationInstallation::query()
+                ->where('status', InstallationStatus::Installed)
+                ->first();
+
+            $canUpgradeLegacyAdmin = ! User::query()->where('isSuperAdmin', true)->exists()
+                && $installation?->initialAdminUserId === $user?->id;
+
+            if (! $canUpgradeLegacyAdmin) {
+                Auth::logout();
+
+                return back()->withErrors(['email' => 'Those platform administrator details do not match our records.'])->onlyInput('email');
+            }
+
+            // Existing installations created before platform administration
+            // was separated may have only an initial business owner. Promote
+            // that exact recorded account once so the migration is usable.
+            $user->forceFill(['isSuperAdmin' => true])->save();
+            Auth::setUser($user->fresh());
+        }
+
         $request->session()->regenerate();
 
         return redirect()->intended(route('manager.dashboard'));