commit12

2026-11-02 08:06:45 +02:00
parent e4f520092e
commit 2a4169162b
108 changed files with 3793 additions and 88 deletions
@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Shared\Context;
+
+use Illuminate\Http\Request;
+
+final class RequireModuleContext
+{
+    public function check(Request $request, CompanyContext $context): void
+    {
+        $owner = ModuleNavigation::owner($request->path());
+        if ($owner === null) return;
+        $selected = $request->session()->get('company_context', []);
+        $active = $selected['module_id'] ?? null;
+        abort_unless($active, 409, 'Seleccione explicitamente um módulo antes de abrir este percurso.');
+        $available = array_column(app(ModuleNavigation::class)->available($context), 'id');
+        abort_unless(in_array($active, $available, true), 403, 'O acesso ao módulo foi revogado ou a configuração mudou.');
+        $shared = $request->is('api/a/*','api/b1/*','api/document-preview/draft/*','api/document-preview/history/*','api/document-preparation/*');
+        abort_unless($active === $owner || $shared, 409, 'Este percurso pertence a outro módulo. Mude de módulo antes de o abrir.');
+        $request->attributes->set('sgf_module',$active);
+        // Reads also carry the generation: stale tabs and late requests cannot mix contexts.
+        // Standalone HTML pages use the current session; their APIs must carry the token.
+        if ($request->is('api/*') && !$request->is('api/service-invoices/*/pdf')) {
+            abort_unless(hash_equals($selected['token'] ?? '', (string)$request->header('X-SGF-Context')), 409, 'O contexto mudou. Reabra este percurso.');
+        }
+    }
+}