41 lines
2.5 KiB
PHP
41 lines
2.5 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use App\Services\PortalProfileAccess;
|
|
use App\Services\ScopedPortalAdministration;
|
|
use App\Services\SimulationTaxGovernanceAccess;
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
final class EnsureScopedPortalAdministration
|
|
{
|
|
public function handle(Request $request, Closure $next): Response
|
|
{
|
|
$actor = $request->user();
|
|
abort_unless($actor, 403);
|
|
$scope = app(ScopedPortalAdministration::class);
|
|
$path = $request->path();
|
|
$interests = $request->is('management/interests', 'management/interests/*', 'api/v1/investment/admin/interests/*');
|
|
// Fiscal maintenance reuses authorised administration; unrelated gates remain unchanged.
|
|
$catalogue = $request->is('management/territory-geometry-import', 'management/territory-geometry-import/*',
|
|
'management/economic-references/lot-01', 'management/economic-references/lot-01/*',
|
|
'management/education', 'management/education/*', 'management/investment/references', 'management/investment/references/*', 'api/v1/investment/admin/references', 'api/v1/investment/admin/references/*',
|
|
'management/investment/zones', 'management/investment/zones/*', 'api/v2/investment/admin/zones', 'api/v2/investment/admin/zones/*',
|
|
'management/balcao/atribuicoes', 'management/balcao/atribuicoes/*', 'management/balcao/servicos',
|
|
'management/balcao/fontes') || ($request->isMethod('GET') && $path === 'management/balcao-install');
|
|
$fiscal = $request->is('api/v2/investment/admin/tax-rules', 'api/v2/investment/admin/tax-rules/*',
|
|
'api/v2/investment/admin/tax-rule-sources', 'management/investment/tax-rules/*');
|
|
$allowed = ($fiscal && SimulationTaxGovernanceAccess::maintainer($actor)) || ($interests ? $scope->interestOperator($actor) : ($catalogue && $scope->administrative($actor)));
|
|
abort_unless($allowed || ($actor->can('manage-portal') && ! app(PortalProfileAccess::class)->has($actor, 'auditor')), 403, 'Acesso reservado ao âmbito já designado.');
|
|
$response = $next($request);
|
|
if (! $request->isMethod('GET') && $response->getStatusCode() < 400) {
|
|
app(PortalProfileAccess::class)->audit($actor, 'scoped_administration', [
|
|
'method' => $request->method(), 'route' => $request->route()?->uri(), 'scope' => $fiscal ? 'fiscal-maintenance' : ($interests ? 'assigned-interest' : 'catalogue-administration')]);
|
|
}
|
|
|
|
return $response;
|
|
}
|
|
}
|