varias alteracoes

app/Http/Controllers/InvestmentSubmissionController.php

@@ -2,6 +2,7 @@
 
 namespace App\Http\Controllers;
 
+use App\Jobs\ScanDocumentForMalware;
 use App\Models\InterestRequest;
 use App\Models\InvestmentSpecificNeed;
 use App\Models\InvestmentSubmission;
@@ -293,7 +294,8 @@ class InvestmentSubmissionController extends Controller
                 abort_unless($key !== false, 500);
                 DB::table('documents')->insert(['id' => $documentId, 'source_system' => 'investor-submission', 'file_name' => basename($file->getClientOriginalName()),
                     'media_type' => $file->getMimeType(), 'storage_key' => $key, 'sha256' => hash_file('sha256', Storage::disk('local')->path($key)),
-                    'status' => 'active', 'data_classification' => 'confidential']);
+                    'size_bytes' => $file->getSize(), 'uploaded_by' => $request->user()->id,
+                    'status' => 'quarantined', 'data_classification' => 'confidential']);
                 DB::table('investment_submission_attachments')->insert(['id' => (string) Str::uuid(), 'submission_id' => $id, 'document_id' => $documentId, 'created_at' => now(), 'updated_at' => now()]);
                 $row->increment('version');
                 $this->event($row, $request, 'attachment_added');
@@ -307,6 +309,8 @@ class InvestmentSubmissionController extends Controller
             throw $e;
         }
 
+        ScanDocumentForMalware::dispatch($documentId)->afterCommit();
+
         return $request->expectsJson() ? response()->json(['version' => $version]) : back()->with('success', 'Anexo privado guardado.');
     }
 
@@ -314,13 +318,16 @@ class InvestmentSubmissionController extends Controller
     {
         $this->owned($request, $id);
         $doc = DB::table('investment_submission_attachments as a')->join('documents as d', 'd.id', '=', 'a.document_id')
-            ->where('a.id', $attachment)->where('a.submission_id', $id)->where('d.status', 'active')->whereNull('d.deleted_at')->first(['d.file_name', 'd.storage_key', 'd.sha256']);
+            ->where('a.id', $attachment)->where('a.submission_id', $id)->where('d.status', 'active')->whereNull('d.deleted_at')
+            ->where('d.malware_scan_status', 'clean')->whereColumn('d.malware_scanned_sha256', 'd.sha256')
+            ->first(['d.file_name', 'd.storage_key', 'd.sha256', 'd.malware_scanned_sha256']);
         abort_unless($doc !== null, 404);
         $root = realpath(Storage::disk('local')->path('investment-submissions/'.$id));
         $path = realpath(Storage::disk('local')->path($doc->storage_key));
         abort_unless($root && $path && str_starts_with(strtolower($path), strtolower($root.DIRECTORY_SEPARATOR)) && is_file($path), 404);
         $hash = hash_file('sha256', $path);
-        abort_unless(is_string($hash) && hash_equals($doc->sha256, $hash), 404);
+        abort_unless(is_string($hash) && hash_equals($doc->sha256, $hash)
+            && hash_equals($doc->sha256, (string) $doc->malware_scanned_sha256), 404);
 
         return response()->download($path, basename($doc->file_name), ['Cache-Control' => 'private, no-store', 'X-Content-Type-Options' => 'nosniff']);
     }