80 lines
4.6 KiB
PHP
80 lines
4.6 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers\Api\V1;
|
|
|
|
use App\Http\Controllers\Controller;
|
|
use App\Jobs\ScanDocumentForMalware;
|
|
use App\Services\SimulationFormDrafts;
|
|
use Illuminate\Http\JsonResponse;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Illuminate\Support\Facades\Storage;
|
|
use Illuminate\Support\Str;
|
|
use stdClass;
|
|
use Symfony\Component\HttpFoundation\BinaryFileResponse;
|
|
|
|
class SimulationOfferDocumentController extends Controller
|
|
{
|
|
public function store(Request $request, string $id, SimulationFormDrafts $drafts): JsonResponse
|
|
{
|
|
abort_unless(Str::isUuid($id), 404);
|
|
$drafts->find($id, $request);
|
|
// Same private document infrastructure and technical file limit as investment attachments.
|
|
$request->validate(['file' => ['required', 'file', 'mimetypes:application/pdf,text/plain,image/png,image/jpeg', 'max:10240']]);
|
|
$file = $request->file('file');
|
|
$hash = hash_file('sha256', $file->getRealPath());
|
|
abort_unless(is_string($hash), 422, 'Não foi possível verificar o conteúdo do anexo.');
|
|
$existing = DB::table('documents')->where('source_system', 'simulation-fiscal-offer')->where('external_id', $id)->where('sha256', $hash)->whereNull('deleted_at')->first();
|
|
if ($existing) {
|
|
return response()->json(['data' => $this->metadata($id, $existing)], 200)->header('Cache-Control', 'private, no-store');
|
|
}
|
|
$documentId = (string) Str::uuid();
|
|
$key = $file->storeAs('simulation-offers/'.$id, $documentId, 'local');
|
|
abort_unless(is_string($key), 500);
|
|
try {
|
|
DB::table('documents')->insert(['id' => $documentId, 'source_system' => 'simulation-fiscal-offer', 'external_id' => $id,
|
|
'file_name' => basename($file->getClientOriginalName()), 'media_type' => $file->getMimeType(), 'storage_key' => $key,
|
|
'sha256' => $hash, 'size_bytes' => $file->getSize(), 'uploaded_by' => $request->user()->id,
|
|
'status' => 'quarantined', 'data_classification' => 'confidential']);
|
|
} catch (\Throwable $e) {
|
|
Storage::disk('local')->delete($key);
|
|
throw $e;
|
|
}
|
|
ScanDocumentForMalware::dispatch($documentId)->afterCommit();
|
|
|
|
return response()->json(['data' => $this->metadata($id, DB::table('documents')->where('id', $documentId)->first())], 201)->header('Cache-Control', 'private, no-store');
|
|
}
|
|
|
|
public function index(Request $request, string $id, SimulationFormDrafts $drafts): JsonResponse
|
|
{
|
|
abort_unless(Str::isUuid($id), 404);
|
|
$drafts->find($id, $request);
|
|
$documents = DB::table('documents')->where('source_system', 'simulation-fiscal-offer')->where('external_id', $id)->whereNull('deleted_at')->get();
|
|
|
|
return response()->json(['data' => $documents->map(fn ($doc) => $this->metadata($id, $doc))])->header('Cache-Control', 'private, no-store');
|
|
}
|
|
|
|
public function download(Request $request, string $id, string $document, SimulationFormDrafts $drafts): BinaryFileResponse
|
|
{
|
|
abort_unless(Str::isUuid($id) && Str::isUuid($document), 404);
|
|
$drafts->find($id, $request);
|
|
$doc = DB::table('documents')->where('id', $document)->where('source_system', 'simulation-fiscal-offer')->where('external_id', $id)->whereNull('deleted_at')->first();
|
|
abort_unless($doc !== null, 404);
|
|
abort_unless($doc->status === 'active' && $doc->malware_scan_status === 'clean' && hash_equals(trim($doc->sha256), (string) $doc->malware_scanned_sha256), 409, 'Anexo conservado; descarga disponível após análise antimalware concluída.');
|
|
$root = realpath(Storage::disk('local')->path('simulation-offers/'.$id));
|
|
$path = realpath(Storage::disk('local')->path($doc->storage_key));
|
|
abort_unless($root && $path && str_starts_with(strtolower($path), strtolower($root.DIRECTORY_SEPARATOR)) && is_file($path), 404);
|
|
$hash = hash_file('sha256', $path);
|
|
abort_unless(is_string($hash) && hash_equals(trim($doc->sha256), $hash), 409, 'Conteúdo do anexo diverge do hash registado.');
|
|
|
|
return response()->download($path, basename($doc->file_name), ['Cache-Control' => 'private, no-store', 'X-Content-Type-Options' => 'nosniff']);
|
|
}
|
|
|
|
/** @return array{id: string, draftId: string, name: string, sha256: string, scan: string, url: string} */
|
|
private function metadata(string $id, stdClass $doc): array
|
|
{
|
|
return ['id' => $doc->id, 'draftId' => $id, 'name' => $doc->file_name, 'sha256' => trim($doc->sha256),
|
|
'scan' => $doc->malware_scan_status, 'url' => '/api/v1/simulation-drafts/'.$id.'/offer-documents/'.$doc->id];
|
|
}
|
|
}
|