47 lines
1.6 KiB
PHP
47 lines
1.6 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use App\Models\DirectoryUser;
|
|
use App\Models\Tenant;
|
|
use App\Services\Auth\EntraTokenValidator;
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\Log;
|
|
use RuntimeException;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
/** Authentifie les appels de l'add-in (Bearer = jeton Entra obtenu par NAA). */
|
|
class AuthenticateEntraToken
|
|
{
|
|
public function __construct(private readonly EntraTokenValidator $validator) {}
|
|
|
|
public function handle(Request $request, Closure $next): Response
|
|
{
|
|
$token = $request->bearerToken();
|
|
if (! $token) {
|
|
return response()->json(['error' => 'unauthenticated'], 401);
|
|
}
|
|
|
|
try {
|
|
$claims = $this->validator->validate($token);
|
|
} catch (RuntimeException $e) {
|
|
Log::notice('Jeton add-in refusé', ['reason' => $e->getMessage(), 'ip' => $request->ip()]);
|
|
|
|
return response()->json(['error' => 'invalid_token'], 401);
|
|
}
|
|
|
|
$tenant = Tenant::where('entra_tenant_id', $claims['tid'])->first();
|
|
$user = DirectoryUser::where('tenant_id', $tenant->id)->where('entra_oid', $claims['oid'])->first();
|
|
if (! $user || ! $user->account_enabled) {
|
|
// Agent pas encore synchronisé (compte créé depuis moins de 15 min) ou désactivé.
|
|
return response()->json(['error' => 'unknown_user'], 404);
|
|
}
|
|
|
|
$request->attributes->set('entra_claims', $claims);
|
|
$request->attributes->set('directory_user', $user);
|
|
|
|
return $next($request);
|
|
}
|
|
}
|