Corrige autorizacao transaccional e valida modulos implementados

app/Services/CurrentActor.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Services;
+
+use App\Enums\PurchasingRole;
+use App\Models\User;
+use Illuminate\Support\Facades\DB;
+
+class CurrentActor
+{
+    /** Call after the company lock, inside the business transaction.
+     * @param  list<PurchasingRole>|null  $roles
+     */
+    public function lock(User $actor, ?array $roles = null): User
+    {
+        abort_unless(auth()->id() === $actor->id && $actor->tenant_id !== null, 403);
+        if (DB::connection()->transactionLevel() === 0) {
+            throw new \LogicException('Revalidar o operador dentro da transacção.');
+        }
+        $user = User::query()->where('tenant_id', $actor->tenant_id)->lockForUpdate()->findOrFail($actor->id);
+        abort_unless($roles === null || in_array($user->purchasing_role, $roles, true), 403);
+
+        return $user;
+    }
+}