oportunidades 5

app/Http/Middleware/ProtectPrivilegedIdentity.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Services\PortalProfileAccess;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Symfony\Component\HttpFoundation\Response;
+
+class ProtectPrivilegedIdentity
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $actor = $request->user();
+        $access = app(PortalProfileAccess::class);
+        if (! $actor || ! $access->available()) {
+            return $next($request);
+        }
+        if (! in_array($request->method(), ['GET', 'HEAD', 'OPTIONS'], true) && $access->has($actor, 'auditor')
+            && $request->is('management/*', 'api/v1/investment/admin/*', 'api/v2/investment/admin/*')) {
+            $access->audit($actor, 'auditor_administrative_write_denied', ['method' => $request->method(), 'path' => $request->path()]);
+            abort(403, 'Auditor só permite leitura administrativa, mesmo com outro papel ou permissão legada.');
+        }
+        $mandatoryMfa = $access->superuser($actor) || $access->has($actor, 'validator') || $access->has($actor, 'publisher');
+        $denied = $request->isMethod('DELETE') && $request->is('user/two-factor-authentication') && $mandatoryMfa;
+        $denied = $denied || ($access->superuser($actor) && $request->is('settings/profile') && $request->isMethod('PATCH')
+            && $request->has('email') && $request->input('email') !== $actor->email);
+        if ($request->isMethod('DELETE') && $request->is('settings/profile')) {
+            $denied = $denied || $access->superuser($actor)
+                || DB::table('portal_role_assignments')->where('user_id', $actor->id)->orWhere('approved_by', $actor->id)->exists()
+                || DB::table('portal_profile_requests')->where('user_id', $actor->id)->orWhere('decided_by', $actor->id)->exists();
+        }
+        if ($denied) {
+            $access->audit($actor, 'privileged_identity_change_denied', ['method' => $request->method(), 'path' => $request->path()]);
+            abort(403, 'Esta alteração removeria MFA obrigatório, um titular ou histórico de autorização. Use revogação ou substituição controlada; não desative MFA para recuperar acesso.');
+        }
+
+        return $next($request);
+    }
+}