42 lines
2.2 KiB
PHP
42 lines
2.2 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use App\Services\PortalProfileAccess;
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
class ProtectPrivilegedIdentity
|
|
{
|
|
public function handle(Request $request, Closure $next): Response
|
|
{
|
|
$actor = $request->user();
|
|
$access = app(PortalProfileAccess::class);
|
|
if (! $actor || ! $access->available()) {
|
|
return $next($request);
|
|
}
|
|
if (! in_array($request->method(), ['GET', 'HEAD', 'OPTIONS'], true) && $access->has($actor, 'auditor')
|
|
&& $request->is('management/*', 'api/v1/investment/admin/*', 'api/v2/investment/admin/*')) {
|
|
$access->audit($actor, 'auditor_administrative_write_denied', ['method' => $request->method(), 'path' => $request->path()]);
|
|
abort(403, 'Auditor só permite leitura administrativa, mesmo com outro papel ou permissão legada.');
|
|
}
|
|
$mandatoryMfa = $access->superuser($actor) || $access->has($actor, 'validator') || $access->has($actor, 'publisher');
|
|
$denied = $request->isMethod('DELETE') && $request->is('user/two-factor-authentication') && $mandatoryMfa;
|
|
$denied = $denied || ($access->superuser($actor) && $request->is('settings/profile') && $request->isMethod('PATCH')
|
|
&& $request->has('email') && $request->input('email') !== $actor->email);
|
|
if ($request->isMethod('DELETE') && $request->is('settings/profile')) {
|
|
$denied = $denied || $access->superuser($actor)
|
|
|| DB::table('portal_role_assignments')->where('user_id', $actor->id)->orWhere('approved_by', $actor->id)->exists()
|
|
|| DB::table('portal_profile_requests')->where('user_id', $actor->id)->orWhere('decided_by', $actor->id)->exists();
|
|
}
|
|
if ($denied) {
|
|
$access->audit($actor, 'privileged_identity_change_denied', ['method' => $request->method(), 'path' => $request->path()]);
|
|
abort(403, 'Esta alteração removeria MFA obrigatório, um titular ou histórico de autorização. Use revogação ou substituição controlada; não desative MFA para recuperar acesso.');
|
|
}
|
|
|
|
return $next($request);
|
|
}
|
|
}
|