oportunidades 7

app/Http/Controllers/PortalServicesController.php

@@ -236,13 +236,22 @@ class PortalServicesController extends Controller
             abort_unless(DB::table('portal_partnerships')->where('id', $data['partnership_id'])->where('status', 'published')->exists(), 422);
         }
         $data['portal_user_id'] = $request->user()?->id;
+        // Preserve the actual entry form, not only the shared POST endpoint. Never accept an external or administrative referrer as the entry page.
+        $entry = parse_url($request->headers->get('referer', ''));
+        $sourcePage = '/apoio';
+        if (is_array($entry) && strtolower($entry['scheme'] ?? '') === $request->getScheme()
+            && strtolower($entry['host'] ?? '') === strtolower($request->getHost())
+            && (int) ($entry['port'] ?? (($entry['scheme'] ?? '') === 'https' ? 443 : 80)) === $request->getPort()
+            && in_array($entry['path'] ?? '', ['/apoio', '/formularios/investidor', '/formularios/empresa', '/parcerias', '/parcerias/painel'], true)) {
+            $sourcePage = $entry['path'];
+        }
         try {
             $interest = $submission->receive($data, $data['submission_key'], fn () => InterestRequest::create([
                 'reference' => 'AP-'.now()->year.'-'.Str::ulid(), 'full_name' => $data['fullName'], 'email' => $data['email'],
                 'phone' => $data['phone'] ?? null, 'country' => $data['country'],
                 'investor_type' => $data['kind'] === 'company' ? 'empresa' : 'individual',
                 'sector_interest' => $data['sectorInterest'], 'message' => $data['message'],
-                'privacy_consent' => true, 'consented_at' => now(), 'status' => 'received', 'source_page' => '/apoio',
+                'privacy_consent' => true, 'consented_at' => now(), 'status' => 'received', 'source_page' => $sourcePage,
                 'metadata' => ['kind' => $data['kind'], 'company' => $data['company'] ?? null,
                     'portal_user_id' => $data['portal_user_id'], 'partnership_id' => $data['partnership_id'] ?? null,
                     'declared_origin_country_code' => $data['declared_origin_country_code'] ?? null],
@@ -637,7 +646,7 @@ class PortalServicesController extends Controller
             'document_id' => ['required', 'uuid'], 'title' => ['required', 'string', 'max:200'],
             'description' => ['nullable', 'string', 'max:4000'], 'category' => ['required', 'string', 'max:80'],
             // QA legacy originals may have no theme (e.g. a shared image). Do not invent a sector to disclose an authorized original.
-            'topic' => [app(\App\Services\LegacyContent::class)->available() ? 'nullable' : 'required', 'string', 'max:80'],
+            'topic' => [app(LegacyContent::class)->available() ? 'nullable' : 'required', 'string', 'max:80'],
             'document_type' => ['required', 'in:legislation,procedure,official_form,digital_adaptation,guidance_template,guide,study,reference_data,unknown'],
             'issuer' => ['nullable', 'string', 'max:180'], 'document_number' => ['nullable', 'string', 'max:120'],
             'document_date' => ['nullable', 'date_format:Y-m-d'], 'source_url' => ['nullable', 'url:https', 'max:2000'],