Reconciliar fontes instaladas 423bd512d8c5 com main

2026-10-20 14:45:19 +02:00
parent 507387502c
commit 9ab721c97f
108 changed files with 2766 additions and 494 deletions
@@ -23,8 +23,9 @@ class InterestRequestController extends Controller
 {
    public function store(StoreInterestRequestRequest $request, InterestSubmission $submission): JsonResponse
    {
-        $validated = $request->validated();
+        $validated = [...$request->validated(), '_actor_id' => $request->user()->id];
        $key = $request->header('Idempotency-Key');
+        abort_unless(is_string($key), 422, 'Identificador do envio em falta.');
        Validator::make(['idempotency_key' => $key], ['idempotency_key' => [$key === null ? 'nullable' : 'required', 'uuid']])->validate();

        try {
@@ -53,7 +54,7 @@ class InterestRequestController extends Controller
                    'phone' => $validated['phone'] ?? null,
                    'investor_type' => $validated['investorType'],
                    'country' => $validated['country'],
-                    'metadata' => ['declared_origin_country_code' => $validated['declared_origin_country_code'] ?? null],
+                    'metadata' => ['portal_user_id' => $request->user()->id, 'declared_origin_country_code' => $validated['declared_origin_country_code'] ?? null],
                    'sector_interest' => $validated['sectorInterest'],
                    'opportunity_reference' => $validated['opportunityReference'] ?? null,
                    'investment_range' => $validated['investmentRange'] ?? null,
@@ -77,6 +78,19 @@ class InterestRequestController extends Controller
                    }
                }

+                $row = \App\Models\InvestmentSubmission::create([
+                    'user_id' => $request->user()->id, 'opportunity_id' => $opportunity?->id,
+                    'interest_request_id' => $interest->id, 'status' => 'submitted', 'version' => 1,
+                    'payload' => ['simple_participation' => true, 'opportunity_title' => $opportunity?->title ?? $business?->title, 'opportunity_reference' => $opportunity?->reference, 'phone' => $validated['phone'] ?? null, 'declared_origin_country_code' => $validated['declared_origin_country_code'] ?? null, 'full_name' => $validated['fullName'], 'email' => $validated['email'],
+                        'objective' => $validated['message'], 'sector' => $validated['sectorInterest'],
+                        'country' => $validated['country'], 'existing_business_id' => $business?->id,
+                        'modality' => $validated['modality'] ?? null],
+                ]);
+                \Illuminate\Support\Facades\DB::table('investment_submission_events')->insert([
+                    'submission_id' => $row->id, 'actor_id' => $request->user()->id,
+                    'action' => 'submitted', 'version' => 1, 'created_at' => now(),
+                ]);
+                $interest->forceFill(['metadata' => [...$interest->metadata, 'submission_id' => $row->id]])->save();
                return $interest;
            });

@@ -85,7 +99,8 @@ class InterestRequestController extends Controller
                'message' => 'Manifestação de interesse registada com sucesso.',
                'data' => [
                    'reference' => $interestRequest->reference,
-                    'status' => 'received',
+                    'status' => $interestRequest->status,
+                    'tracking_url' => '/investidor/manifestacoes',
                ],
            ], 201);
        } catch (IdempotencyConflict) {
@@ -11,8 +11,8 @@ class DocumentMalwareController extends Controller
 {
    public function retry(Request $request, string $id): RedirectResponse
    {
-        DB::transaction(function () use ($id): void {
-            $document = DB::table('documents')->where('id', $id)->lockForUpdate()->first();
+        DB::transaction(function () use ($id, $request): void {
+            $document = app(\App\Services\DocumentManagementAccess::class)->documents($request->user())->where('id', $id)->lockForUpdate()->first();
            abort_unless($document && $document->status !== 'deleted' && $document->deleted_at === null, 404);
            abort_unless(in_array($document->malware_scan_status, ['pending', 'inconclusive', 'failed'], true), 422,
                'Só é possível repetir uma análise pendente, inconclusiva ou falhada. Para substituir um ficheiro, carregue uma nova versão.');
@@ -78,6 +78,7 @@ class EditorialArticleController extends Controller
    public function edit(int $id)
    {
        $this->installed();
+        app(\App\Services\DocumentManagementAccess::class)->assertEditableResource(request()->user(), $id);
        $r = DB::table('portal_resources')->find($id);
        abort_unless($r, 404);
        $content = $r->editorial_content ? json_decode($r->editorial_content, true) : null;
@@ -108,6 +109,7 @@ class EditorialArticleController extends Controller
        DB::transaction(function () use ($request, $id, $data) {
            $r = DB::table('portal_resources')->where('id', $id)->lockForUpdate()->first();
            abort_unless($r, 404);
+            app(\App\Services\DocumentManagementAccess::class)->assertEditableResource($request->user(), $id);
            abort_unless((int) $r->metadata_version === (int) $data['metadata_version'], 409, 'O artigo foi alterado noutra sessão. Recarregue antes de editar.');
            if (! empty($data['image_resource_id'])) {
                abort_unless($this->publicResources()->where('r.id', $data['image_resource_id'])->whereIn('d.media_type', ['image/png', 'image/jpeg', 'image/webp'])->exists(), 422, 'Escolha uma imagem pública disponível na biblioteca.');
@@ -67,7 +67,7 @@ class ExistingBusinessController extends Controller
        $business = app(BusinessRepository::class)->find($id);
        Gate::authorize('view', $business);
        app(CompatibilityShadow::class)->schedule($id);
-        $props = ['countries' => app(CountryCatalogue::class)->all(), 'sectors' => Sector::choices()->orderBy('name')->get(['id', 'name', 'slug']), 'formSchema' => BusinessFormSchema::fields(), 'record' => $this->record($business), 'canEdit' => $request->user()->can('update', $business),
+        $props = ['countries' => app(CountryCatalogue::class)->all(), 'sectors' => Sector::choices()->orderBy('name')->get(['id', 'name', 'slug']), 'formSchema' => BusinessFormSchema::fields(), 'modalityFormType' => \App\Services\ExistingBusinessProfileCategory::formType($business->modality), 'record' => $this->record($business), 'canEdit' => $request->user()->can('update', $business),
            'owner' => $request->user()->can('owns', $business), 'canReview' => $request->user()->can('review', $business),
            'canTriage' => $request->user()->can('triage', $business),
            'canApproveLevelOne' => $request->user()->can('approveLevelOne', $business),
@@ -31,7 +31,14 @@ class InvestmentSubmissionController extends Controller
 {
    public function index(Request $request): Response|JsonResponse
    {
-        $submissions = InvestmentSubmission::where('user_id', $request->user()->id)->latest()->paginate(20)->through(function ($row) {
+        $query = InvestmentSubmission::where('user_id', $request->user()->id);
+        if (! $request->user()->hasVerifiedEmail()) {
+            // The existing payload is encrypted; scope after decryption, never infer ownership from email.
+            $simpleIds = InvestmentSubmission::where('user_id', $request->user()->id)->where('status', 'submitted')->get(['id', 'payload'])
+                ->filter(fn ($row) => ($row->payload['simple_participation'] ?? false) === true)->modelKeys();
+            $query->whereIn('id', $simpleIds);
+        }
+        $submissions = $query->latest()->paginate(20)->through(function ($row) {
            $interest = $row->interest_request_id ? InterestRequest::find($row->interest_request_id) : null;

            return ['id' => $row->id, 'status' => $row->status, 'version' => $row->version, 'created_at' => $row->created_at,
@@ -118,29 +125,32 @@ class InvestmentSubmissionController extends Controller
        $target = $row->opportunity_id ? Opportunity::published()->find($row->opportunity_id) : null;
        $dossier = $row->dossier_id ? InvestmentPortfolioController::visible()->find($row->dossier_id) : null;
        $zoneOrigin = DB::table('investment_submission_zones')->where('submission_id', $id)->first(['zone_id', 'zone_version', 'intent']);
-        $boundCase = DB::table('desk_cases')->where('submission_id', $id)->where('user_id', $request->user()->id)->whereNotNull('journey_id')->first();
-        $contextChoices = (int) $row->user_id === (int) $request->user()->id && $row->status === 'draft' && ! $boundCase
+        $contextAvailable = app(VirtualDesk::class)->installed();
+        $boundCase = $contextAvailable ? DB::table('desk_cases')->where('submission_id', $id)->where('user_id', $request->user()->id)->whereNotNull('journey_id')->first() : null;
+        $contextChoices = $contextAvailable && (int) $row->user_id === (int) $request->user()->id && $row->status === 'draft' && ! $boundCase
            ? DB::table('desk_cases')->where('user_id', $request->user()->id)->whereNotNull('journey_id')->whereNull('closed_at')->whereNull('submission_id')->orderBy('title')->get(['id', 'title', 'version']) : [];
-        $data = ['contextDossierId' => $boundCase?->id, 'contextChoices' => $contextChoices, 'boundContextRevision' => app(InvestorContextConsumers::class)->submissionRevision($id), 'countries' => app(CountryCatalogue::class)->all(), 'submission' => $row->only(['id', 'payload', 'version', 'status', 'opportunity_id', 'dossier_id']), 'zone_origin' => $zoneOrigin,
-            'target' => ($target ? $target->title : null) ?? ($dossier ? $dossier->title : null), 'references' => [
+        $data = ['contextDossierId' => $boundCase?->id, 'contextChoices' => $contextChoices, 'boundContextRevision' => $contextAvailable ? app(InvestorContextConsumers::class)->submissionRevision($id) : 0, 'countries' => app(CountryCatalogue::class)->all(), 'submission' => $row->only(['id', 'payload', 'version', 'status', 'opportunity_id', 'dossier_id']), 'zone_origin' => $zoneOrigin,
+            'target' => ($target ? $target->title : null) ?? ($dossier ? $dossier->title : null) ?? ($row->payload['opportunity_title'] ?? null), 'references' => [
                ...$catalogue->references(), 'options' => DB::table('investment_reference_options')->orderBy('label')->get()],
            'needs' => InvestmentSpecificNeed::where('submission_id', $id)->get(),
            'attachments' => DB::table('investment_submission_attachments as a')->join('documents as d', 'd.id', '=', 'a.document_id')
                ->where('a.submission_id', $id)->whereNull('d.deleted_at')->get(['a.id', 'd.file_name']),
-            'events' => DB::table('investment_submission_events')->where('submission_id', $id)->orderBy('id')->get(['action', 'version', 'created_at']),
+            'events' => DB::table('investment_submission_events')->where('submission_id', $id)->orderBy('id')->get(['action', 'version', 'created_at'])
+                ->concat($interest ? DB::table('business_workflow_transitions')->where('interest_request_id', $interest->id)->orderBy('created_at')->get(['to_status', 'created_at'])->map(fn ($event) => ['action' => $event->to_status, 'version' => $row->version, 'created_at' => $event->created_at]) : [])->sortBy('created_at')->values(),
            'revisions' => DB::table('investment_submission_revisions')->where('submission_id', $id)->orderByDesc('version')->get(['version', 'created_at']),
            'messages' => DB::table('investment_messages')->where('submission_id', $id)->orderBy('created_at')->get(['id', 'sender_role', 'body', 'created_at'])->map(function ($message) {
                $message->body = Crypt::decryptString($message->body);

                return $message;
            }),
-            'receipt' => $interest?->only(['reference', 'status']), 'management' => (int) $row->user_id !== $request->user()->id];
+            'receipt' => $interest?->only(['reference', 'status', 'next_action', 'next_action_due_at']), 'management' => (int) $row->user_id !== $request->user()->id];

        return $request->expectsJson() ? response()->json($data) : Inertia::render('investment/submission', $data);
    }

    public function bindContext(Request $request, string $id): JsonResponse
    {
+        abort_unless(app(VirtualDesk::class)->installed(), 422, 'O vínculo ao percurso do investimento não está disponível neste destino. A manifestação e a sua origem permanecem guardadas.');
        abort_if(array_diff(array_keys($request->all()), ['case_id', 'case_version', 'version', '_token']), 422, 'Parâmetros de associação inválidos.');
        $data = $request->validate(['case_id' => 'required|uuid', 'case_version' => 'required|integer|min:1', 'version' => 'required|integer|min:1']);
        $result = DB::transaction(function () use ($request, $id, $data) {
@@ -395,7 +405,7 @@ class InvestmentSubmissionController extends Controller

    private function event(InvestmentSubmission $row, Request $request, string $action): void
    {
-        $boundCase = DB::table('desk_cases')->where('submission_id', $row->id)->where('user_id', $request->user()->id)->whereNotNull('journey_id')->first();
+        $boundCase = app(VirtualDesk::class)->installed() ? DB::table('desk_cases')->where('submission_id', $row->id)->where('user_id', $request->user()->id)->whereNotNull('journey_id')->first() : null;
        $binding = null;
        if ($boundCase) {
            $binding = app(InvestorContextConsumers::class)->submissionRevision($row->id);
@@ -98,7 +98,7 @@ class InvestmentZoneController extends Controller
        abort_if((! empty($filters['development_status']) || ! empty($filters['availability_status'])) && ! Schema::hasColumn('investment_zones', 'source_evidence'), 503,
            'Os filtros de desenvolvimento e disponibilidade estarão disponíveis após a migração do catálogo de zonas.');
        $path = app(InvestmentGeography::class)->selection($filters);
-        $publicColumns = ['version_no', 'id', 'code', 'name', 'name_en', 'category', 'physical_category', 'legal_regime', 'operational_status', 'development_status', 'availability_status', 'area_value', 'area_unit', 'area_components', 'source_evidence', 'activities', 'resources', 'aliases', 'data_as_of', 'sources_consulted_at', 'province', 'district', 'description', 'description_en', 'validation_status', 'updated_at'];
+        $publicColumns = ['primary_territory_id', 'version_no', 'id', 'code', 'name', 'name_en', 'category', 'physical_category', 'legal_regime', 'operational_status', 'development_status', 'availability_status', 'area_value', 'area_unit', 'area_components', 'source_evidence', 'activities', 'resources', 'aliases', 'data_as_of', 'sources_consulted_at', 'province', 'district', 'description', 'description_en', 'validation_status', 'updated_at'];
        if(app(\App\Services\InvestmentZoneOperationalDetails::class)->installed()){$publicColumns[]='operational_details';}
        $publicColumns = array_values(array_filter($publicColumns, fn ($column) => Schema::hasColumn('investment_zones', $column)));
        $rows = $zones->search($filters, $management)->orderBy('name')->orderBy('id')
@@ -113,6 +113,8 @@ class InvestmentZoneController extends Controller
                ->when(! $management, fn ($q) => $q->where('zl.validation_status', 'validated')->where('g.data_classification', 'public'))
                ->orderBy('g.location_type')->orderBy('g.name')->get(['g.id', 'g.name', 'g.location_type', 'zl.scope_type']));

+            if (! $management) { $zone->makeHidden('primary_territory_id'); }
+
            return $management ? $zone : [...app(InvestmentZoneOperationalProfile::class)->publicDetails($zone->toArray()),'operational_details_public'=>app(\App\Services\InvestmentZoneOperationalDetails::class)->publicData($zone)];
        });
        $props = ['detailsInstallation'=>$management ? app(\App\Services\InvestmentZoneOperationalDetailsInstallation::class)->preview($request->user()) : null, 'installation' => $management ? app(InvestmentZoneProfileInstallation::class)->preview($request->user()) : null, 'records' => $rows, 'filters' => $filters, 'management' => $management, 'territorySelection' => $path,
@@ -98,7 +98,13 @@ class OpportunityResourceController extends Controller
            }
        }

-        return Inertia::render('management/opportunity-resources', ['opportunity' => $opportunity, 'etag' => app(OpportunityManagement::class)->etag($opportunity), 'resources' => $resources, 'existingLocations' => DB::table('opportunity_locations as l')->join('geo_locations as g', 'g.id', '=', 'l.geo_location_id')->where('opportunity_id', $id)->get(['g.id', 'g.name', 'g.location_type']), 'assessment' => $this->assessment($resources)]);
+        return Inertia::render('management/opportunity-resources', ['opportunity' => $opportunity, 'etag' => app(OpportunityManagement::class)->etag($opportunity), 'resources' => $resources, 'librarySources' => !app(\App\Services\PortalProfileAccess::class)->canEdit(request()->user(), $opportunity) ? [] : app(\App\Services\OpportunityLibrarySupport::class)->choices(request()->user()), 'existingLocations' => DB::table('opportunity_locations as l')->join('geo_locations as g', 'g.id', '=', 'l.geo_location_id')->where('opportunity_id', $id)->get(['g.id', 'g.name', 'g.location_type']), 'locationReference' => app(\App\Services\OpportunityTerritorialPresentation::class)->describe($opportunity, $resources['locations']), 'assessment' => $this->assessment($resources)]);
+    }
+
+    public function reuseLibrary(Request $request, int $id): JsonResponse
+    {
+        $row = app(\App\Services\OpportunityLibrarySupport::class)->attach($request->user(), Opportunity::findOrFail($id), $request->all());
+        return response()->json(['id' => $row->id, 'message' => 'Original associado como suporte privado, sem copiar ficheiros ou publicar.']);
    }

    public function save(Request $request, int $id, string $kind, OpportunityResources $service, ?string $resourceId = null): JsonResponse
@@ -144,11 +150,15 @@ class OpportunityResourceController extends Controller
    {
        abort_unless(in_array($kind, ['documents', 'images'], true), 404);
        $opportunity = Opportunity::findOrFail($id);
+        app(\App\Services\PortalProfileAccess::class)->authorize(request()->user(), 'view', $opportunity);
        abort_if($opportunity->status === 'archived', 404);
        $record = DB::table($service->table($kind).' as r')->join('documents as d', 'd.id', '=', 'r.document_id')->where('r.id', $resourceId)->where('r.opportunity_id', $id)->whereNull('r.deleted_at')->whereNull('d.deleted_at')->first(['d.*']);
        abort_unless($record !== null, 404, 'Recurso indisponível ou excluído logicamente.');
        abort_unless($record->status === 'active' && $record->malware_scan_status === 'clean' && hash_equals(trim($record->sha256), (string) $record->malware_scanned_sha256), 423, 'Scan pendente, inconclusivo ou inseguro. O ficheiro permanece em quarentena.');

+        $support = DB::table($service->table($kind))->where('id', $resourceId)->first();
+        app(\App\Services\OpportunityLibrarySupport::class)->assertAvailable($support, $record);
+        if (request()->filled('source_sha256')) abort_unless(hash_equals(trim($record->sha256), (string)request('source_sha256')), 409, 'O original já não corresponde à versão consultada.');
        return app(VerifiedDocumentBinary::class)->respond($record);
    }

@@ -53,6 +53,36 @@ class PortalManagementController extends Controller
        return Inertia::render('management/history', ['events' => $events]);
    }

+    private function interestAssignmentEtag(InterestRequest $interest): string
+    {
+        return hash('sha256',json_encode([$interest->id,$interest->status,$interest->assigned_to,$interest->updated_at?->format('Y-m-d H:i:s.u')],JSON_THROW_ON_ERROR));
+    }
+
+    public function interestAssignments(Request $request): Response|JsonResponse
+    {
+        abort_unless(app(\App\Services\ScopedPortalAdministration::class)->administrative($request->user()),403);
+        $rows=InterestRequest::whereNotIn('status',['cancelled','closed','refused','converted'])->orderBy('id')->get(['id','reference','status','assigned_to','updated_at'])
+            ->map(fn($row)=>['id'=>$row->id,'protocol'=>$row->reference,'status'=>$row->status,'analyst_id'=>$row->assigned_to,'version'=>0,'etag'=>$this->interestAssignmentEtag($row),'due_at'=>null]);
+        $data=['kind'=>'interest','requests'=>$rows,'analysts'=>$this->interestAssignees()->get(['id','name'])];
+        return $request->expectsJson()?response()->json($data):Inertia::render('management/desk-assignments',$data);
+    }
+
+    public function assignInterest(Request $request, InterestRequest $interest): RedirectResponse|JsonResponse
+    {
+        abort_unless(app(\App\Services\ScopedPortalAdministration::class)->administrative($request->user()),403);
+        $data=$request->validate(['etag'=>'required|string|size:64','analyst_id'=>['required','integer',Rule::in($this->interestAssignees()->pluck('id'))],'reason'=>'required|string|min:10|max:2000'],['reason.required'=>'Explique o motivo da atribuição.','reason.min'=>'Explique o motivo da atribuição com pelo menos 10 caracteres.','analyst_id.required'=>'Seleccione o responsável.','analyst_id.in'=>'Seleccione um responsável autorizado.']);
+        DB::transaction(function()use($request,$interest,$data){
+            $row=InterestRequest::whereKey($interest->id)->lockForUpdate()->firstOrFail();
+            if (!hash_equals($this->interestAssignmentEtag($row),$data['etag'])) throw ValidationException::withMessages(['etag'=>'A atribuição mudou. Recupere a lista actual e tente novamente.']);
+            if (in_array($row->status,['cancelled','closed','refused','converted'],true)) throw ValidationException::withMessages(['status'=>'Este pedido já não permite uma nova atribuição. Recupere a lista actual.']);
+            $owner=(int)($row->metadata['portal_user_id']??0);
+            abort_if($owner===(int)$data['analyst_id'] || InvestmentSubmission::where('interest_request_id',$row->id)->where('user_id',$data['analyst_id'])->exists(),422,'O interessado não pode acompanhar o seu próprio pedido como equipa.');
+            PortalAudit::save($row,['assigned_to'=>(int)$data['analyst_id']],$request->user()->id);
+            app(\App\Services\PortalProfileAccess::class)->audit($request->user(),'interest_assigned',['interest_id'=>$row->id,'assigned_to'=>(int)$data['analyst_id'],'reason'=>$data['reason']]);
+        });
+        return $request->expectsJson()?response()->json(['ok'=>true]):back()->with('success','Responsável atribuído.');
+    }
+
    public function interests(Request $request): Response
    {
        $filters = $request->validate([
@@ -65,6 +95,7 @@ class PortalManagementController extends Controller
        $query = InterestRequest::query()->with('assignee:id,name')->select([
            'id', 'reference', 'full_name', 'email', 'country', 'metadata', 'sector_interest', 'existing_business_id', 'modality', 'status', 'assigned_to', 'next_action', 'next_action_due_at', 'created_at',
        ]);
+        app(\App\Services\ScopedPortalAdministration::class)->interestQuery($query, $request->user());
        if ($country = $filters['country'] ?? null) {
            $values = app(CountryCatalogue::class)->filterValues($country);
            $query->whereIn(DB::raw('LOWER(BTRIM(country))'), $values);
@@ -111,6 +142,7 @@ class PortalManagementController extends Controller

    public function interest(InterestRequest $interest): Response
    {
+        abort_unless(app(\App\Services\ScopedPortalAdministration::class)->interest(request()->user(), $interest),403);
        $history = DB::table('business_workflow_transitions')->where('interest_request_id', $interest->id)
            ->orderByDesc('created_at')->limit(50)->get(['from_status', 'to_status', 'actor_id', 'reason', 'created_at'])
            ->map(function ($row) {
@@ -138,12 +170,18 @@ class PortalManagementController extends Controller

    public function review(Request $request, InterestRequest $interest, InterestWorkflow $workflow): RedirectResponse|JsonResponse
    {
+        abort_unless(app(\App\Services\ScopedPortalAdministration::class)->interest(request()->user(), $interest),403);
        $validated = $request->validate([
            'status' => ['required', Rule::in(self::STATES)],
            'note' => ['nullable', 'string', 'min:10', 'max:2000'],
            'next_action' => ['nullable', 'required_with:next_action_due_at', 'string', 'max:180'],
            'next_action_due_at' => ['nullable', 'required_with:next_action', 'date', 'after_or_equal:today'],
            'assigned_to' => ['nullable', 'integer', Rule::in($this->interestAssignees()->pluck('id'))],
+        ], [
+            'next_action_due_at.required_with' => 'Indique o prazo da próxima acção.',
+            'next_action_due_at.date' => 'Indique uma data válida para a próxima acção.',
+            'next_action_due_at.after_or_equal' => 'O prazo da próxima acção deve ser hoje ou uma data futura.',
+            'next_action.required_with' => 'Descreva a próxima acção correspondente ao prazo indicado.',
        ]);
        $before = $interest->status;
        $updated = $workflow->transition($request->user(), $interest, $validated['status'], $validated['note'] ?? null,
@@ -160,6 +198,7 @@ class PortalManagementController extends Controller

    public function withdrawProponentSharingConsent(Request $request, InterestRequest $interest): RedirectResponse|JsonResponse
    {
+        abort_unless(app(\App\Services\ScopedPortalAdministration::class)->interest(request()->user(), $interest),403);
        $data = $request->validate(['reason' => ['required', 'string', 'min:10', 'max:2000']]);
        $this->withdrawConsent($request, $interest, $data['reason'], 'share_contact_with_proponent');

@@ -169,6 +208,7 @@ class PortalManagementController extends Controller

    public function withdrawContactConsent(Request $request, InterestRequest $interest): RedirectResponse|JsonResponse
    {
+        abort_unless(app(\App\Services\ScopedPortalAdministration::class)->interest(request()->user(), $interest),403);
        $data = $request->validate(['reason' => ['required', 'string', 'min:10', 'max:2000']]);
        $this->withdrawConsent($request, $interest, $data['reason'], 'respond_to_interest');

@@ -217,7 +257,9 @@ class PortalManagementController extends Controller
            ['triagers', 'reviewers', 'approvers_l1', 'approvers_l2', 'publishers'],
        )));

-        return User::query()->whereNotNull('email_verified_at')->whereIn(DB::raw('lower(email)'), $emails)->orderBy('name');
+        return User::query()->whereNotNull('email_verified_at')->where(function ($q) use ($emails) {
+            $q->whereIn(DB::raw('lower(email)'), $emails)->orWhereIn('id', DB::table('portal_superuser_pair')->select('first_user_id'))->orWhereIn('id', DB::table('portal_superuser_pair')->select('second_user_id'));
+        })->orderBy('name');
    }

    public function catalog(Request $request, string $resource): Response
@@ -286,17 +286,47 @@ class PortalServicesController extends Controller
        return app(VerifiedDocumentBinary::class)->respond($document, true);
    }

-    public function downloadForManager(string $id): BinaryFileResponse|\Illuminate\Http\Response
+    public function downloadForManager(Request $request, string $id): BinaryFileResponse|\Illuminate\Http\Response
    {
-        $document = DB::table('documents')->where('id', $id)->whereNull('deleted_at')->first();
+        $document = app(\App\Services\DocumentManagementAccess::class)->documents($request->user())->where('id', $id)->first();
        abort_unless($document && $document->status === 'active' && $document->malware_scan_status === 'clean'
            && hash_equals(trim($document->sha256), trim((string) $document->malware_scanned_sha256)), 404);

        return app(VerifiedDocumentBinary::class)->respond($document);
    }

-    public function manage(MalwareScanner $scanner): Response
+    public function manage(Request $request, MalwareScanner $scanner): Response
    {
+        $access = app(\App\Services\DocumentManagementAccess::class);
+        if (! $access->full($request->user())) {
+            $documents = $access->documents($request->user())->where('status', '!=', 'deleted');
+            $health = $scanner->health();
+            $health['signatures_at'] = $health['signatures_at']?->format(DATE_ATOM);
+
+            $editorial = $access->editorial($request->user());
+            $resources = $editorial ? $access->editorialResources($request->user())->orderByDesc('r.updated_at')
+                ->get(['r.*', 'd.file_name', 'd.media_type', 'd.size_bytes', 'd.issuer', 'd.status as file_status', 'd.data_classification', 'd.version_no as file_version', 'd.rights_status as file_rights_status', 'd.malware_scan_status', 'd.malware_failure_reason']) : collect();
+            $links = DB::table('portal_resource_links')->whereIn('resource_id', $resources->pluck('id'))->orderBy('id')->get()->groupBy('resource_id');
+            $revisions = DB::table('portal_resource_revisions')->whereIn('resource_id', $resources->pluck('id'))->orderByDesc('revision_no')->get(['resource_id', 'revision_no', 'change_type', 'actor_user_id', 'created_at'])->groupBy('resource_id');
+            $resources->each(function ($resource) use ($links, $revisions) {
+                $resource->links = $links->get($resource->id, collect())->values();
+                $resource->revisions = $revisions->get($resource->id, collect())->values();
+            });
+            return Inertia::render('portal/manage', [
+                'documentAccessOnly' => ! $editorial, 'editorialScopeOnly' => $editorial, 'resources' => $resources, 'partnerships' => [], 'territories' => [],
+                'requirementCatalogue' => [], 'requirementAssociationsEnabled' => false,
+                'disclosureAuthorization' => null, 'incompleteCount' => $resources->filter(fn ($r) => ! $r->description || ! $r->issuer || ! $r->source_url || $r->source_confirmation === 'unconfirmed' || $r->legal_status === 'unknown' || $r->rights_status === 'unconfirmed')->count(), 'possibleDuplicates' => $resources->whereNotNull('duplicate_of_resource_id')->count(),
+                'documents' => (clone $documents)->latest()->limit(250)->get([
+                    'id', 'file_name', 'media_type', 'size_bytes', 'issuer', 'issued_on', 'valid_until',
+                    'uploaded_by', 'created_at', 'status', 'data_classification', 'version_no', 'sha256',
+                    'rights_status', 'malware_scan_status', 'malware_scanned_at', 'malware_failure_reason',
+                    'malware_engine_version', 'malware_signatures_at', 'malware_scan_attempts',
+                ]),
+                'malwareCounts' => (clone $documents)->select('malware_scan_status', DB::raw('count(*) as total'))
+                    ->groupBy('malware_scan_status')->pluck('total', 'malware_scan_status'),
+                'malwareHealth' => $health,
+            ]);
+        }
        $disclosureAuthorization = DB::table('audit_events')->where('source_system', 'user-instruction')
            ->where('external_id', 'document-repository-disclosure-authorization-2026-10-06-v1')
            ->where('action', 'public_disclosure_authorized')->first(['external_id', 'occurred_at', 'after_data']);
@@ -378,6 +408,7 @@ class PortalServicesController extends Controller
        $id = DB::transaction(function () use ($data, $request): int {
            $document = DB::table('documents')->where('id', $data['document_id'])->where('status', '!=', 'deleted')->whereNull('deleted_at')->lockForUpdate()->first();
            abort_unless($document !== null, 422, 'Seleccione um documento existente e não eliminado.');
+            abort_unless(app(\App\Services\DocumentManagementAccess::class)->documents($request->user())->where('id', $document->id)->exists(), 403);
            $identity = $this->identityKey($data);
            if ($identity) {
                DB::select('SELECT pg_advisory_xact_lock(hashtext(?))', ['portal-resource-identity:'.$identity]);
@@ -406,9 +437,11 @@ class PortalServicesController extends Controller
        DB::transaction(function () use ($data, $request, $id, $expectedVersion): void {
            $resource = DB::table('portal_resources')->where('id', $id)->lockForUpdate()->first();
            abort_unless($resource !== null, 404);
+            app(\App\Services\DocumentManagementAccess::class)->assertEditableResource($request->user(), $id);
            abort_if((int) $resource->metadata_version !== $expectedVersion, 409, 'O documento foi alterado por outra sessão. Recarregue a revisão antes de editar.');
            $document = DB::table('documents')->where('id', $data['document_id'])->where('status', '!=', 'deleted')->whereNull('deleted_at')->lockForUpdate()->first();
            abort_unless($document !== null, 422, 'Seleccione um documento existente e não eliminado.');
+            abort_unless(app(\App\Services\DocumentManagementAccess::class)->documents($request->user())->where('id', $document->id)->exists(), 403);
            $identity = $this->identityKey($data);
            if ($identity) {
                DB::select('SELECT pg_advisory_xact_lock(hashtext(?))', ['portal-resource-identity:'.$identity]);
@@ -437,6 +470,11 @@ class PortalServicesController extends Controller

    public function moderate(Request $request, string $type, int $id): RedirectResponse
    {
+        $access = app(\App\Services\DocumentManagementAccess::class);
+        if (! $access->full($request->user())) {
+            abort_unless($type === 'resources', 403);
+            $access->assertEditableResource($request->user(), $id);
+        }
        if ($type === 'partnerships' && Schema::hasColumn('portal_partnerships', 'partnership_type')) {
            return redirect('/parcerias/'.$id)->with('success', 'Reveja a proposta e registe uma decisão fundamentada na ficha da Bolsa.');
        }
@@ -444,6 +482,7 @@ class PortalServicesController extends Controller
        $table = $type === 'resources' ? 'portal_resources' : 'portal_partnerships';
        DB::transaction(function () use ($request, $data, $table, $type, $id) {
            abort_unless(DB::table($table)->where('id', $id)->lockForUpdate()->first() !== null, 404);
+            if ($type === 'resources') app(\App\Services\DocumentManagementAccess::class)->assertEditableResource($request->user(), $id);
            if ($type === 'resources' && $data['published']) {
                $resource = DB::table('portal_resources as r')->join('documents as d', 'd.id', '=', 'r.document_id')
                    ->where('r.id', $id)->first(['r.document_type', 'r.legislation', 'r.source_confirmation', 'r.legal_status', 'r.rights_status',
@@ -148,7 +148,7 @@ class VirtualDeskController extends Controller
        $data = ['boundContextRevision' => app(InvestorContextConsumers::class)->requestRevision($row), 'countries' => app(CountryCatalogue::class)->all(), 'toolPrefill' => $desk->requestToolPrefill($request->user(), $row), 'request' => [...(array) $row, 'payload' => $payload, 'submitted_snapshot' => $desk->decode($row->submitted_snapshot), 'editable_fields' => json_decode($row->editable_fields ?? '[]', true)],
            'case' => ['id' => $case->id, 'title' => $case->title], 'caseVersion' => $case->version, 'definition' => $definition, 'territoryPaths' => $territoryPaths,
            'serviceSource' => json_decode(DB::table('desk_service_versions')->where('id', $row->service_version_id)->value('source'), true),
-            'owner' => $desk->owns($request->user(), $case), 'manager' => $request->user()->can('manage-portal'), 'analyst' => (int) $row->analyst_id === $request->user()->id,
+            'owner' => $desk->owns($request->user(), $case), 'manager' => app(\App\Services\ScopedPortalAdministration::class)->deskDecision($request->user(),$row), 'analyst' => (int) $row->analyst_id === $request->user()->id,
            'fieldsEditable' => in_array($row->status, ['draft', 'returned'], true), 'states' => config('virtual-desk.request_states'), 'transitions' => config('virtual-desk.transitions.'.$row->status, []),
            'findings' => $desk->findings($payload), 'ai' => config('virtual-desk.ai'), 'documents' => $this->documents($case->id, $request->user())->filter(fn ($d) => ! $d->request_id || $d->request_id === $id)->values(),
            'messages' => DB::table('desk_messages as m')->join('users as u', 'u.id', '=', 'm.actor_id')->where('request_id', $id)->orderBy('m.created_at')->get(['m.id', 'm.actor_id', 'm.body', 'm.created_at', 'u.name'])->map(fn ($m) => [...(array) $m, 'body' => Crypt::decryptString($m->body),
@@ -176,14 +176,26 @@ class VirtualDeskController extends Controller
        return $request->expectsJson() ? response()->json(['version' => $row->version, 'status' => $row->status]) : back()->with('success', 'Decisão interna registada.');
    }

+    public function assignments(Request $request): JsonResponse|Response
+    {
+        abort_unless(app(\App\Services\ScopedPortalAdministration::class)->administrative($request->user()),403);
+        // Triage projection deliberately excludes payloads, documents, investor identity and case titles.
+        $data=['requests'=>DB::table('desk_requests')->whereNotIn('status',['draft','cancelled','closed'])->orderBy('created_at')->get(['id','protocol','status','version','analyst_id','due_at']),
+            'analysts'=>User::whereNotNull('email_verified_at')->orderBy('name')->get(['id','name'])];
+        return $request->expectsJson()?response()->json($data):Inertia::render('management/desk-assignments',$data);
+    }
+
    public function assign(Request $request, string $id, VirtualDesk $desk): JsonResponse|RedirectResponse
    {
-        abort_unless($request->user()->can('manage-portal'), 403);
-        $data = $request->validate(['version' => 'required|integer', 'analyst_id' => 'required|integer|exists:users,id', 'reason' => 'required|string|min:3|max:3000', 'due_at' => 'nullable|date']);
+        abort_unless(app(\App\Services\ScopedPortalAdministration::class)->administrative($request->user()), 403);
+        $data = $request->validate(['version' => 'required|integer', 'analyst_id' => 'required|integer|exists:users,id', 'reason' => 'required|string|min:3|max:3000', 'due_at' => 'nullable|date'], ['reason.required'=>'Explique o motivo da atribuição.','reason.min'=>'Explique o motivo da atribuição com pelo menos 3 caracteres.','analyst_id.required'=>'Seleccione o responsável.','analyst_id.exists'=>'Seleccione um responsável com conta disponível.']);
        DB::transaction(function () use ($request, $id, $desk, $data) {
-            $row = $desk->request($request->user(), $id, false, true);
-            $case = $desk->case($request->user(), $row->case_id);
-            abort_unless((int) $row->version === (int) $data['version'] && ! in_array($row->status, ['draft', 'cancelled', 'closed'], true), 409);
+            $row = DB::table('desk_requests')->where('id',$id)->lockForUpdate()->first();
+            abort_unless($row,404);
+            $case = DB::table('desk_cases')->where('id',$row->case_id)->first();
+            abort_unless($case,404);
+            if ((int)$row->version !== (int)$data['version']) throw \Illuminate\Validation\ValidationException::withMessages(['version'=>'Este pedido foi actualizado. Recupere a lista e tente novamente.']);
+            if (in_array($row->status,['draft','cancelled','closed'],true)) throw \Illuminate\Validation\ValidationException::withMessages(['status'=>'Este pedido já não permite uma nova atribuição. Recupere a lista actual.']);
            $analyst = User::where('id', $data['analyst_id'])->firstOrFail();
            abort_unless($analyst->hasVerifiedEmail(), 422, 'O responsável deve ter conta verificada.');
            abort_if($desk->owns($analyst, $case, false), 422, 'O proponente não pode ser o analista.');
@@ -217,13 +229,18 @@ class VirtualDeskController extends Controller
        return $request->expectsJson() ? response()->json(['ok' => true]) : back()->with('success', 'Mensagem privada guardada.');
    }

-    public function receipt(Request $request, string $id, VirtualDesk $desk): StreamedResponse
+    public function receipt(Request $request, string $id, VirtualDesk $desk): StreamedResponse|\Illuminate\Http\Response
    {
        $row = $desk->request($request->user(), $id);
        abort_unless($row->protocol && $row->submitted_snapshot, 404);
        $snapshot = $desk->decode($row->submitted_snapshot);
+        $format = $request->validate(['format' => 'nullable|in:html'])['format'] ?? null;
        $this->auditRead($request, 'desk_requests', $id, 'receipt_downloaded');

+        if ($format === 'html') {
+            return response()->view('desk.receipt', ['record' => $row, 'snapshot' => $snapshot, 'definition' => $desk->definition($row)], 200, ['Cache-Control' => 'private, no-store', 'X-Content-Type-Options' => 'nosniff']);
+        }
+
        return response()->streamDownload(function () use ($row, $snapshot) {
            echo 'Balcão Virtual — recibo de submissão interna'.PHP_EOL.$row->protocol.PHP_EOL.'Data: '.$row->submitted_at.PHP_EOL.'Versão: '.$row->version.PHP_EOL;
            echo json_encode($snapshot, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_THROW_ON_ERROR);