51 lines
2.4 KiB
PHP
51 lines
2.4 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
/** Environment reservation is not a portal identity or a business permission. */
|
|
class EnsureHomologationAccess
|
|
{
|
|
public function handle(Request $request, Closure $next): Response
|
|
{
|
|
if (! config('portal.homologation_only', false)) {
|
|
return $next($request);
|
|
}
|
|
$mode = config('portal.homologation_access_mode', 'reviewers');
|
|
if ($mode === 'perimeter') {
|
|
// Set only by the trusted server after its environment-access check.
|
|
// A client HTTP_INVESTMOZ_* header is deliberately not accepted.
|
|
abort_unless($request->server('INVESTMOZ_HOMOLOGATION_ACCESS') === 'granted', 403,
|
|
'Este ambiente de homologação tem acesso reservado à Tempo.');
|
|
$response = $next($request);
|
|
$response->headers->set('Cache-Control', 'private, no-store');
|
|
$response->headers->set('X-Robots-Tag', 'noindex, nofollow, noarchive');
|
|
|
|
return $response;
|
|
}
|
|
abort_unless($mode === 'reviewers', 503, 'A reserva da homologação não está configurada.');
|
|
// Compatibility until an independent perimeter is explicitly configured.
|
|
if ($request->is('login', 'logout', 'register', 'forgot-password', 'reset-password', 'reset-password/*',
|
|
'email/verify', 'email/verify/*', 'email/verification-notification', 'two-factor-challenge',
|
|
'user/confirm-password', 'user/confirmed-password-status', 'user/two-factor-*',
|
|
'settings/security', 'settings/password', 'user/password', 'passkeys/*', 'user/passkeys/*', 'up')) {
|
|
return $next($request);
|
|
}
|
|
$actor = $request->user();
|
|
if (! $actor) {
|
|
return $request->expectsJson()
|
|
? response()->json(['message' => 'Entre na conta autorizada para homologação.'], 401)
|
|
: redirect()->guest(route('login'));
|
|
}
|
|
abort_unless($actor->hasVerifiedEmail() && in_array(strtolower(trim($actor->email)), config('portal.homologation_reviewers', []), true), 403,
|
|
'Esta homologação está reservada às contas indicadas pela Tempo.');
|
|
$response = $next($request);
|
|
$response->headers->set('Cache-Control', 'private, no-store');
|
|
|
|
return $response;
|
|
}
|
|
}
|