first commit

app/Http/Controllers/CommentController.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\Submission;
+use App\Models\SubmissionComment;
+use Illuminate\Http\Request;
+
+class CommentController extends Controller
+{
+    public function store(Request $request, Submission $submission)
+    {
+        $this->authorize('comment', $submission);
+
+        $data = $request->validate([
+            'body' => ['required', 'string', 'max:2000'],
+            'is_internal' => ['nullable', 'boolean'],
+        ], [], ['body' => 'mesej']);
+
+        // Hanya kakitangan JPP boleh hantar komen dalaman.
+        $isInternal = $request->boolean('is_internal') && auth()->user()->can('serahan.lihat_semua');
+
+        $submission->comments()->create([
+            'user_id' => auth()->id(),
+            'body' => $data['body'],
+            'is_internal' => $isInternal,
+        ]);
+
+        return back()->with('success', 'Mesej dihantar.')->withFragment('komen');
+    }
+
+    /** Soft delete — hanya pentadbir (kebenaran komen.padam), dengan rekod audit. */
+    public function destroy(SubmissionComment $comment)
+    {
+        abort_unless(auth()->user()->can('komen.padam'), 403);
+
+        $comment->update(['deleted_by' => auth()->id()]);
+        $comment->delete();
+
+        activity('komen')->performedOn($comment->submission)->causedBy(auth()->user())
+            ->withProperties(['comment_id' => $comment->id])->log('Komen dipadam (soft delete)');
+
+        return back()->with('success', 'Mesej dipadam (rekod audit disimpan).');
+    }
+}