✨ Implement leadership-based permissions for Meetup management

- 🔒 Restrict event creation, editing, and deletion to Meetup leaders (`is_leader`) and creators for consistency across APIs, frontend, and MCP.
- ➕ Add new APIs for leader delegation: assign/remove Meetup leaders via `meetup_user.is_leader`.
- 🛠️ Replace loose member checks with specific leadership checks in policies, controllers, and views.
- 🧪 Add exhaustive tests to ensure only eligible leaders execute critical actions (e.g., event creation/edit, Meetup updates).
- 🔄 Refactor pivot relationships and models (`leadByMe`, `isLeader`) for explicit leadership handling.
- ✨ Introduce artisan command `meetups:promote-existing-leaders` to transition legacy data.

app/Http/Controllers/Api/MeetupLeaderController.php

@@ -0,0 +1,98 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Api\StoreMeetupLeaderRequest;
+use App\Models\Meetup;
+use App\Models\User;
+use App\Support\NostrLogin;
+use Dedoc\Scramble\Attributes\Group;
+use Dedoc\Scramble\Attributes\Response;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Support\Facades\Gate;
+use Symfony\Component\HttpFoundation\Response as HttpResponse;
+
+/**
+ * Leader-Delegation für Meetups: ein bestehender Leader (bzw. Ersteller/
+ * Super-Admin) verwaltet die Leader eines Meetups (meetup_user.is_leader).
+ * Leader dürfen die Stammdaten bearbeiten — siehe MeetupPolicy::update().
+ */
+#[Group(name: 'Meetups', weight: 3)]
+class MeetupLeaderController extends Controller
+{
+    /**
+     * Leader auflisten
+     *
+     * Liefert alle Leader eines Meetups (id, name, nostr, avatar, is_creator).
+     * Nur für Leader des Meetups sichtbar.
+     */
+    #[Response(status: 403, description: 'Nur ein Leader darf die Leader-Liste sehen.')]
+    public function index(Meetup $meetup): JsonResponse
+    {
+        Gate::authorize('manageLeaders', $meetup);
+
+        return response()->json(['data' => $this->leaders($meetup)]);
+    }
+
+    /**
+     * Leader einsetzen
+     *
+     * Setzt den Nutzer mit dem angegebenen npub als Leader ein. Existiert noch
+     * kein Account für den npub, wird er angelegt (greift, sobald die Person sich
+     * erstmals einloggt). Idempotent: ein bereits gesetzter Leader bleibt Leader.
+     */
+    #[Response(status: 403, description: 'Nur ein Leader darf weitere Leader einsetzen.')]
+    #[Response(status: 422, description: 'Ungültiger npub.')]
+    public function store(StoreMeetupLeaderRequest $request, Meetup $meetup): JsonResponse
+    {
+        $user = NostrLogin::findOrCreateUser($request->string('npub')->toString());
+
+        $meetup->users()->syncWithoutDetaching([
+            $user->getKey() => ['is_leader' => true],
+        ]);
+
+        return response()->json(['data' => $this->leaders($meetup)], HttpResponse::HTTP_CREATED);
+    }
+
+    /**
+     * Leader entziehen
+     *
+     * Entzieht dem Nutzer die Leader-Rolle für dieses Meetup (Demote: bleibt
+     * Mitglied in „Meine Meetups", darf aber nicht mehr bearbeiten). Der
+     * Ersteller des Meetups kann nie entzogen werden.
+     */
+    #[Response(status: 403, description: 'Nur ein Leader darf entziehen; der Ersteller ist geschützt.')]
+    public function destroy(Meetup $meetup, User $user): JsonResponse
+    {
+        Gate::authorize('manageLeaders', $meetup);
+
+        abort_if($user->getKey() === $meetup->created_by, HttpResponse::HTTP_FORBIDDEN, __('Der Ersteller des Meetups kann nicht entzogen werden.'));
+
+        $meetup->users()->updateExistingPivot($user->getKey(), ['is_leader' => false]);
+
+        return response()->json(['data' => $this->leaders($meetup)]);
+    }
+
+    /**
+     * Leader-Liste als flaches Array (Ersteller zuerst).
+     *
+     * @return array<int, array<string, mixed>>
+     */
+    private function leaders(Meetup $meetup): array
+    {
+        return $meetup->users()
+            ->wherePivot('is_leader', true)
+            ->get()
+            ->map(fn (User $user): array => [
+                'id' => $user->getKey(),
+                'name' => $user->name,
+                'nostr' => $user->nostr,
+                'avatar' => $user->profile_photo_url,
+                'is_creator' => $user->getKey() === $meetup->created_by,
+            ])
+            ->sortByDesc('is_creator')
+            ->values()
+            ->all();
+    }
+}

app/Http/Controllers/Api/UserController.php

@@ -51,7 +51,9 @@ class UserController extends Controller
             'email' => $user->email,
             'nostr' => $user->nostr,
             'is_lecturer' => (bool) $user->is_lecturer,
-            'is_leader' => (bool) $user->is_leader,
+            // Leader-Rolle ist pro Meetup (meetup_user.is_leader); global = ist
+            // der Nutzer Leader IRGENDEINES Meetups. Treibt das Rollen-Badge.
+            'is_leader' => $user->meetups()->wherePivot('is_leader', true)->exists(),
             'avatar' => $user->profile_photo_url,
         ];
     }

app/Http/Requests/Api/StoreMeetupEventRequest.php

@@ -3,15 +3,23 @@
 namespace App\Http\Requests\Api;
 
 use App\Enums\RecurrenceType;
-use App\Models\MeetupEvent;
+use App\Models\Meetup;
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Validation\Rule;
 
 class StoreMeetupEventRequest extends FormRequest
 {
+    /**
+     * Termine darf nur anlegen, wer das zugehörige Meetup bearbeiten darf
+     * (Ersteller/Leader/Super-Admin) — dieselbe Berechtigung wie die
+     * Stammdaten. Existenz/Pflicht von meetup_id prüft rules() (422); ist ein
+     * gültiges Meetup angegeben, muss der Nutzer dafür berechtigt sein.
+     */
     public function authorize(): bool
     {
-        return $this->user()->can('create', MeetupEvent::class);
+        $meetup = Meetup::find($this->input('meetup_id'));
+
+        return $meetup === null || $this->user()->can('update', $meetup);
     }
 
     /**

app/Http/Requests/Api/StoreMeetupLeaderRequest.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Http\Requests\Api;
+
+use Closure;
+use Illuminate\Foundation\Http\FormRequest;
+use swentel\nostr\Key\Key as NostrKey;
+
+/**
+ * Setzt einen weiteren Leader für ein Meetup per Nostr-npub ein. Nur ein
+ * bestehender Leader (bzw. Ersteller/Super-Admin) darf das (manageLeaders).
+ * Der npub muss ein gültiger bech32-kodierter öffentlicher Schlüssel sein.
+ */
+class StoreMeetupLeaderRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return $this->user()->can('manageLeaders', $this->route('meetup'));
+    }
+
+    /**
+     * @return array<string, array<int, mixed>>
+     */
+    public function rules(): array
+    {
+        return [
+            'npub' => [
+                'required',
+                'string',
+                'starts_with:npub1',
+                function (string $attribute, mixed $value, Closure $fail): void {
+                    try {
+                        (new NostrKey)->convertToHex((string) $value);
+                    } catch (\Throwable) {
+                        $fail(__('Das ist kein gültiger npub.'));
+                    }
+                },
+            ],
+        ];
+    }
+}

app/Http/Requests/Api/UpdateMeetupEventRequest.php

@@ -3,14 +3,27 @@
 namespace App\Http\Requests\Api;
 
 use App\Enums\RecurrenceType;
+use App\Models\Meetup;
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Validation\Rule;
 
 class UpdateMeetupEventRequest extends FormRequest
 {
+    /**
+     * Bearbeiten darf der Ersteller des Termins oder ein Leader des Meetups
+     * (siehe MeetupEventPolicy::update). Ein Verschieben in ein anderes Meetup
+     * (geändertes meetup_id) ist nur erlaubt, wenn der Nutzer auch dieses
+     * Ziel-Meetup führt.
+     */
     public function authorize(): bool
     {
-        return $this->user()->can('update', $this->route('meetupEvent'));
+        if (! $this->user()->can('update', $this->route('meetupEvent'))) {
+            return false;
+        }
+
+        $target = $this->filled('meetup_id') ? Meetup::find($this->input('meetup_id')) : null;
+
+        return $target === null || $this->user()->can('update', $target);
     }
 
     /**

app/Http/Resources/MeetupResource.php

@@ -32,6 +32,10 @@ class MeetupResource extends JsonResource
             'community' => $this->community,
             'visible_on_map' => $this->visible_on_map,
             'is_active' => $this->is_active,
+            // Nur gesetzt, wenn die meetup_user-Pivot geladen ist (z. B. via
+            // /api/my-meetups). Sagt der App, ob der Token-Inhaber Leader dieses
+            // Meetups ist (darf bearbeiten + Leader verwalten).
+            'is_leader' => $this->whenPivotLoaded('meetup_user', fn (): bool => (bool) $this->pivot->is_leader),
             'logo' => $this->getFirstMediaUrl('logo', 'thumb'),
             'last_event_at' => $this->last_event_at,
             'created_by' => $this->created_by,