177 lines
13 KiB
PHP
177 lines
13 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers;
|
|
|
|
use App\Services\Ai\InvestorGuidanceEvidence;
|
|
use App\Services\DeskPaymentEvidence;
|
|
use App\Services\VerifiedDocumentBinary;
|
|
use App\Services\VirtualDesk;
|
|
use Illuminate\Http\JsonResponse;
|
|
use Illuminate\Http\RedirectResponse;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Illuminate\Support\Str;
|
|
use Illuminate\Validation\Rule;
|
|
use Symfony\Component\HttpKernel\Exception\HttpExceptionInterface;
|
|
|
|
/** Manual operations use the same requests, documents and encrypted audit history. */
|
|
class VirtualDeskOperationsController extends Controller
|
|
{
|
|
private function result(Request $request): JsonResponse|RedirectResponse
|
|
{
|
|
return $request->expectsJson() ? response()->json(['ok' => true]) : back()->with('success', 'Registo interno guardado; não constitui confirmação de uma instituição externa.');
|
|
}
|
|
|
|
private function reviewer(Request $request, VirtualDesk $desk, \stdClass $case, ?\stdClass $row): void
|
|
{
|
|
abort_unless(! $desk->owns($request->user(), $case, false) && ($request->user()->can('manage-portal') || ($row && (int) $row->analyst_id === $request->user()->id)), 403);
|
|
}
|
|
|
|
private function cleanDocument(string $caseId, string $documentId, ?string $requestId, ?string $linkId = null): \stdClass
|
|
{
|
|
$doc = DB::table('desk_documents as l')->join('documents as d', 'd.id', '=', 'l.document_id')
|
|
->where('l.case_id', $caseId)->where('d.id', $documentId)->whereNull('d.deleted_at')
|
|
->when($linkId, fn ($q) => $q->where('l.id', $linkId))
|
|
->where(fn ($q) => $q->whereNull('l.request_id')->when($requestId, fn ($p) => $p->orWhere('l.request_id', $requestId)))
|
|
->first(['d.*', 'l.id as link_id']);
|
|
abort_unless($doc !== null && $doc->status === 'active' && $doc->malware_scan_status === 'clean' && trim($doc->sha256) === $doc->malware_scanned_sha256, 422, 'Documento indisponível para conferência: verifique autorização, integridade e análise antimalware.');
|
|
try {
|
|
app(VerifiedDocumentBinary::class)->respond($doc);
|
|
} catch (HttpExceptionInterface) {
|
|
abort(422, 'O original, a sua autorização ou integridade não pôde ser confirmado.');
|
|
}
|
|
|
|
return $doc;
|
|
}
|
|
|
|
public function documentReview(Request $request, string $id, string $document, VirtualDesk $desk): JsonResponse|RedirectResponse
|
|
{
|
|
$data = $request->validate(['version' => 'required|integer|min:1', 'request_id' => 'nullable|uuid', 'outcome' => 'required|in:internal_verified,internal_issue,contradiction_identified', 'what_checked' => 'required|string|min:3|max:3000', 'evidence' => 'required|string|min:3|max:5000', 'supports' => 'nullable|array|max:4', 'supports.*' => ['string', Rule::in(InvestorGuidanceEvidence::FIELDS)]]);
|
|
DB::transaction(function () use ($request, $id, $document, $desk, $data) {
|
|
$desk->case($request->user(), $id);
|
|
$link = DB::table('desk_documents')->where('case_id', $id)->where('id', $document)->first();
|
|
abort_unless($link !== null, 404);
|
|
$requestId = $link->request_id ?: ($data['request_id'] ?? null);
|
|
$row = $requestId ? $desk->request($request->user(), $requestId, false, true) : null;
|
|
$case = $desk->case($request->user(), $id, false, true);
|
|
abort_unless(! $case->closed_at && (int) $case->version === (int) $data['version'], 409);
|
|
abort_if($row && $row->case_id !== $id, 422);
|
|
$this->reviewer($request, $desk, $case, $row);
|
|
$doc = $this->cleanDocument($id, $link->document_id, $requestId, $link->id);
|
|
DB::table('desk_cases')->where('id', $id)->update(['version' => $case->version + 1, 'updated_at' => now()]);
|
|
$desk->event(DB::table('desk_cases')->where('id', $id)->firstOrFail(), $request->user(), 'document_reviewed', [
|
|
...$data, 'document_id' => $doc->id, 'link_id' => $link->id, 'sha256' => trim($doc->sha256), 'document_version' => (int) $doc->version_no, 'reviewer_id' => $request->user()->id,
|
|
'scope' => 'internal_documentary_check_not_official_approval_registration_or_license',
|
|
], $row);
|
|
});
|
|
|
|
return $this->result($request);
|
|
}
|
|
|
|
public function payment(Request $request, string $id, VirtualDesk $desk): JsonResponse|RedirectResponse
|
|
{
|
|
$data = $request->validate(['reference' => 'required|string|max:255', 'amount' => ['required', 'regex:/^\d{1,12}(\.\d{1,2})?$/', 'numeric', 'gt:0'], 'currency' => 'required|in:MZN,USD,EUR', 'source_reference' => 'required|string|min:3|max:3000', 'document_id' => 'nullable|uuid', 'document_link_id' => 'nullable|uuid', 'consent' => 'accepted']);
|
|
DB::transaction(function () use ($request, $id, $desk, $data) {
|
|
$row = $desk->request($request->user(), $id, true, true);
|
|
$case = $desk->case($request->user(), $row->case_id, true, true);
|
|
abort_if($case->closed_at || in_array($row->status, ['closed', 'cancelled'], true), 409);
|
|
$evidence = app(DeskPaymentEvidence::class)->snapshot($case->id, $id, $data);
|
|
// References are supplied by the investor; no bank reference or fee is generated.
|
|
DB::select('SELECT pg_advisory_xact_lock(hashtext(?))', ['virtual-desk-payment:'.$data['reference']]);
|
|
$existing = DB::table('desk_payments')->where('reference', $data['reference'])->first();
|
|
if ($existing) {
|
|
$parts = explode('.', (string) $data['amount']);
|
|
$amount = (ltrim($parts[0], '0') ?: '0').'.'.str_pad($parts[1] ?? '', 2, '0');
|
|
$saved = app(DeskPaymentEvidence::class)->forRequest($id)[$existing->id] ?? null;
|
|
abort_unless($existing->request_id === $id && (string) $existing->amount === $amount && $existing->currency === $data['currency'] && $existing->source_reference === $data['source_reference'] && $existing->document_id === ($evidence['document_id'] ?? null)
|
|
&& (! ($data['document_link_id'] ?? null) || ($saved['link_id'] ?? null) === $data['document_link_id']), 409);
|
|
|
|
return;
|
|
}
|
|
$payment = (string) Str::uuid();
|
|
DB::table('desk_payments')->insert(['id' => $payment, 'request_id' => $id, 'reference' => $data['reference'], 'amount' => $data['amount'], 'currency' => $data['currency'], 'source_reference' => $data['source_reference'], 'document_id' => $evidence['document_id'] ?? null, 'status' => 'pending', 'created_at' => now(), 'updated_at' => now()]);
|
|
$desk->event($case, $request->user(), 'payment_declared', ['payment_id' => $payment, 'payment_version' => 1, 'document_evidence' => $evidence, 'consent' => true, 'scope' => 'manual_declaration_no_bank_confirmation'], $row);
|
|
});
|
|
|
|
return $this->result($request);
|
|
}
|
|
|
|
public function paymentDocument(Request $request, string $id, string $payment, VirtualDesk $desk): JsonResponse|RedirectResponse
|
|
{
|
|
$data = $request->validate(['version' => 'required|integer|min:1', 'document_link_id' => 'required|uuid', 'reason' => 'required|string|min:3|max:3000', 'consent' => 'accepted', 'client_key' => 'required|uuid']);
|
|
$data['version'] = (int) $data['version'];
|
|
$data['consent'] = true;
|
|
DB::transaction(function () use ($request, $id, $payment, $desk, $data) {
|
|
$row = $desk->request($request->user(), $id, true, true);
|
|
$case = $desk->case($request->user(), $row->case_id, true, true);
|
|
abort_if($case->closed_at || in_array($row->status, ['closed', 'cancelled'], true), 409);
|
|
$record = DB::table('desk_payments')->where('id', $payment)->where('request_id', $id)->lockForUpdate()->first();
|
|
abort_unless($record !== null, 404);
|
|
foreach (DB::table('desk_events')->where('request_id', $id)->where('actor_id', $request->user()->id)->where('action', 'payment_document_linked')->get(['payload']) as $event) {
|
|
$saved = $desk->decode($event->payload);
|
|
if (($saved['client_key'] ?? null) === $data['client_key']) {
|
|
abort_unless(($saved['payment_id'] ?? null) === $payment && ($saved['operation'] ?? null) === $data, 409, 'A operação já foi utilizada com outros dados. Inicie uma nova associação.');
|
|
|
|
return;
|
|
}
|
|
}
|
|
abort_unless((int) $record->version === (int) $data['version'] && in_array($record->status, ['pending', 'internal_issue'], true), 409, 'O registo mudou ou já está conferido. Actualize antes de associar outro comprovativo.');
|
|
$evidence = app(DeskPaymentEvidence::class)->snapshot($case->id, $id, $data);
|
|
abort_unless($evidence !== null, 422);
|
|
$previous = app(DeskPaymentEvidence::class)->forRequest($id)[$payment] ?? null;
|
|
DB::table('desk_payments')->where('id', $payment)->update(['document_id' => $evidence['document_id'], 'status' => 'pending', 'reason' => null, 'verified_by' => null, 'version' => $record->version + 1, 'updated_at' => now()]);
|
|
$desk->event($case, $request->user(), 'payment_document_linked', ['payment_id' => $payment, 'payment_version' => $record->version + 1, 'previous_document_id' => $record->document_id, 'previous_document_evidence' => $previous,
|
|
'document_evidence' => $evidence, 'client_key' => $data['client_key'], 'operation' => $data, 'reason' => $data['reason'], 'consent' => true, 'scope' => 'documentary_correction_no_amount_change_or_payment_confirmation'], $row);
|
|
});
|
|
|
|
return $this->result($request);
|
|
}
|
|
|
|
public function paymentReview(Request $request, string $id, string $payment, VirtualDesk $desk): JsonResponse|RedirectResponse
|
|
{
|
|
$data = $request->validate(['version' => 'required|integer|min:1', 'status' => 'required|in:internal_verified,internal_issue', 'reason' => 'required|string|min:3|max:3000', 'evidence' => 'required|string|min:3|max:5000']);
|
|
DB::transaction(function () use ($request, $id, $payment, $desk, $data) {
|
|
$row = $desk->request($request->user(), $id, false, true);
|
|
$case = $desk->case($request->user(), $row->case_id, false, true);
|
|
$this->reviewer($request, $desk, $case, $row);
|
|
abort_if($case->closed_at || in_array($row->status, ['closed', 'cancelled'], true), 409);
|
|
$record = DB::table('desk_payments')->where('request_id', $id)->where('id', $payment)->lockForUpdate()->first();
|
|
abort_unless($record !== null, 404);
|
|
abort_unless((int) $record->version === (int) $data['version'], 409);
|
|
$evidence = app(DeskPaymentEvidence::class)->forRequest($id)[$payment] ?? null;
|
|
$doc = null;
|
|
if ($data['status'] === 'internal_verified') {
|
|
abort_unless($record->document_id, 422, 'A conferência exige um comprovativo autorizado.');
|
|
$doc = $this->cleanDocument($case->id, $record->document_id, $id, $evidence['link_id'] ?? null);
|
|
abort_if($evidence && ($evidence['document_id'] !== $doc->id || $evidence['document_version'] !== (int) $doc->version_no || ! hash_equals($evidence['sha256'], trim($doc->sha256))), 422, 'O original já não corresponde ao comprovativo associado. Registe a correcção antes de conferir.');
|
|
}
|
|
DB::table('desk_payments')->where('id', $payment)->update(['status' => $data['status'], 'reason' => $data['reason'], 'verified_by' => $request->user()->id, 'version' => $record->version + 1, 'updated_at' => now()]);
|
|
$desk->event($case, $request->user(), 'payment_reviewed', [...$data, 'payment_id' => $payment, 'payment_version' => $record->version + 1, 'document_id' => $record->document_id, 'document_evidence' => $evidence, 'sha256' => $doc ? trim($doc->sha256) : null, 'reviewer_id' => $request->user()->id, 'scope' => 'internal_proof_check_no_bank_confirmation'], $row);
|
|
});
|
|
|
|
return $this->result($request);
|
|
}
|
|
|
|
public function communication(Request $request, string $id, VirtualDesk $desk): JsonResponse|RedirectResponse
|
|
{
|
|
$data = $request->validate(['channel' => 'required|in:phone,email,sms,whatsapp,in_person', 'direction' => 'required|in:received,sent', 'occurred_at' => 'required|date|before_or_equal:now', 'summary' => 'required|string|min:3|max:5000', 'evidence' => 'required|string|min:3|max:3000', 'client_key' => 'required|uuid']);
|
|
DB::transaction(function () use ($request, $id, $desk, $data) {
|
|
$row = $desk->request($request->user(), $id, false, true);
|
|
$case = $desk->case($request->user(), $row->case_id, false, true);
|
|
abort_unless($desk->owns($request->user(), $case) || $request->user()->can('manage-portal') || (int) $row->analyst_id === $request->user()->id, 403);
|
|
abort_if($case->closed_at || in_array($row->status, ['closed', 'cancelled'], true), 409);
|
|
foreach (DB::table('desk_events')->where('request_id', $id)->where('actor_id', $request->user()->id)->where('action', 'manual_communication_recorded')->get(['payload']) as $event) {
|
|
$saved = $desk->decode($event->payload);
|
|
if (($saved['client_key'] ?? null) === $data['client_key']) {
|
|
abort_unless(array_intersect_key($saved, $data) === $data, 409);
|
|
|
|
return;
|
|
}
|
|
}
|
|
$desk->event($case, $request->user(), 'manual_communication_recorded', [...$data, 'scope' => 'manual_record_not_portal_delivery_confirmation'], $row);
|
|
});
|
|
|
|
return $this->result($request);
|
|
}
|
|
}
|