45

backend/app/Http/Middleware/AuthenticateEntraToken.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Models\DirectoryUser;
+use App\Models\Tenant;
+use App\Services\Auth\EntraTokenValidator;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Log;
+use RuntimeException;
+use Symfony\Component\HttpFoundation\Response;
+
+/** Authentifie les appels de l'add-in (Bearer = jeton Entra obtenu par NAA). */
+class AuthenticateEntraToken
+{
+    public function __construct(private readonly EntraTokenValidator $validator) {}
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        $token = $request->bearerToken();
+        if (! $token) {
+            return response()->json(['error' => 'unauthenticated'], 401);
+        }
+
+        try {
+            $claims = $this->validator->validate($token);
+        } catch (RuntimeException $e) {
+            Log::notice('Jeton add-in refusé', ['reason' => $e->getMessage(), 'ip' => $request->ip()]);
+
+            return response()->json(['error' => 'invalid_token'], 401);
+        }
+
+        $tenant = Tenant::where('entra_tenant_id', $claims['tid'])->first();
+        $user = DirectoryUser::where('tenant_id', $tenant->id)->where('entra_oid', $claims['oid'])->first();
+        if (! $user || ! $user->account_enabled) {
+            // Agent pas encore synchronisé (compte créé depuis moins de 15 min) ou désactivé.
+            return response()->json(['error' => 'unknown_user'], 404);
+        }
+
+        $request->attributes->set('entra_claims', $claims);
+        $request->attributes->set('directory_user', $user);
+
+        return $next($request);
+    }
+}

backend/app/Http/Middleware/EnsureRole.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/** Usage : ->middleware('role:admin') ; rangs : editor < admin < superadmin. */
+class EnsureRole
+{
+    public function handle(Request $request, Closure $next, string $minimum = 'editor'): Response
+    {
+        $user = $request->user();
+        abort_unless($user && $user->hasRole($minimum), 403, 'Accès réservé.');
+
+        return $next($request);
+    }
+}

backend/app/Http/Middleware/RestrictAdminNetwork.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\IpUtils;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Limite /admin aux réseaux internes (SIGNATURE_ADMIN_ALLOWED_CIDRS), en plus du SSO.
+ * Derrière Nginx, configurer TrustProxies pour que $request->ip() soit l'IP réelle.
+ */
+class RestrictAdminNetwork
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $cidrs = config('signature.admin_allowed_cidrs');
+        if ($cidrs && ! IpUtils::checkIp($request->ip(), $cidrs)) {
+            abort(403, 'Back-office accessible uniquement depuis le réseau CABM.');
+        }
+
+        return $next($request);
+    }
+}