45

backend/app/Http/Middleware/AuthenticateEntraToken.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Models\DirectoryUser;
+use App\Models\Tenant;
+use App\Services\Auth\EntraTokenValidator;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Log;
+use RuntimeException;
+use Symfony\Component\HttpFoundation\Response;
+
+/** Authentifie les appels de l'add-in (Bearer = jeton Entra obtenu par NAA). */
+class AuthenticateEntraToken
+{
+    public function __construct(private readonly EntraTokenValidator $validator) {}
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        $token = $request->bearerToken();
+        if (! $token) {
+            return response()->json(['error' => 'unauthenticated'], 401);
+        }
+
+        try {
+            $claims = $this->validator->validate($token);
+        } catch (RuntimeException $e) {
+            Log::notice('Jeton add-in refusé', ['reason' => $e->getMessage(), 'ip' => $request->ip()]);
+
+            return response()->json(['error' => 'invalid_token'], 401);
+        }
+
+        $tenant = Tenant::where('entra_tenant_id', $claims['tid'])->first();
+        $user = DirectoryUser::where('tenant_id', $tenant->id)->where('entra_oid', $claims['oid'])->first();
+        if (! $user || ! $user->account_enabled) {
+            // Agent pas encore synchronisé (compte créé depuis moins de 15 min) ou désactivé.
+            return response()->json(['error' => 'unknown_user'], 404);
+        }
+
+        $request->attributes->set('entra_claims', $claims);
+        $request->attributes->set('directory_user', $user);
+
+        return $next($request);
+    }
+}