38 lines
2.0 KiB
PHP
38 lines
2.0 KiB
PHP
<?php
|
|
namespace App\Http\Middleware;
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
/** Environment reservation is not a portal identity or a business permission. */
|
|
class EnsureHomologationAccess
|
|
{
|
|
public function handle(Request $request, Closure $next): Response
|
|
{
|
|
if (!config('portal.homologation_only', false)) return $next($request);
|
|
$mode=config('portal.homologation_access_mode', 'reviewers');
|
|
if ($mode==='perimeter') {
|
|
// Set only by the trusted server after its environment-access check.
|
|
// A client HTTP_INVESTMOZ_* header is deliberately not accepted.
|
|
abort_unless($request->server('INVESTMOZ_HOMOLOGATION_ACCESS')==='granted',403,
|
|
'Este ambiente de homologação tem acesso reservado à Tempo.');
|
|
$response=$next($request);
|
|
$response->headers->set('Cache-Control','private, no-store');
|
|
$response->headers->set('X-Robots-Tag','noindex, nofollow, noarchive');
|
|
return $response;
|
|
}
|
|
abort_unless($mode==='reviewers',503,'A reserva da homologação não está configurada.');
|
|
// Compatibility until an independent perimeter is explicitly configured.
|
|
if ($request->is('login','logout','register','forgot-password','reset-password','reset-password/*',
|
|
'email/verify','email/verify/*','email/verification-notification','two-factor-challenge',
|
|
'user/confirm-password','user/confirmed-password-status','user/two-factor-*',
|
|
'settings/security','settings/password','user/password','passkeys/*','user/passkeys/*','up')) return $next($request);
|
|
$actor=$request->user();
|
|
if (!$actor) return $request->expectsJson()
|
|
? response()->json(['message'=>'Entre na conta autorizada para homologação.'],401)
|
|
: redirect()->guest(route('login'));
|
|
abort_unless($actor->hasVerifiedEmail() && in_array(strtolower(trim($actor->email)),config('portal.homologation_reviewers',[]),true),403,
|
|
'Esta homologação está reservada às contas indicadas pela Tempo.');
|
|
$response=$next($request);$response->headers->set('Cache-Control','private, no-store');return $response;
|
|
}
|
|
}
|