Initial commit: CABM-IT (ItGlue-style MSP documentation platform)

Laravel 13 + Livewire/Volt app for managing client organizations,
documents, passwords, flexible assets, virtual machines, contacts,
domains, todos, shortcuts, and role-based user administration.

app/Http/Controllers/Controller.php

@@ -0,0 +1,8 @@
+<?php
+
+namespace App\Http\Controllers;
+
+abstract class Controller
+{
+    //
+}

app/Http/Controllers/DocumentDownloadController.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\Document;
+use App\Models\Organization;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Storage;
+use Symfony\Component\HttpFoundation\StreamedResponse;
+
+class DocumentDownloadController extends Controller
+{
+    public function __invoke(Request $request, Organization $organization, Document $document): StreamedResponse
+    {
+        abort_unless($document->organization_id === $organization->id, 404);
+        abort_unless($document->isUpload() && $document->file_path, 404);
+
+        if ($request->boolean('inline')) {
+            return Storage::response($document->file_path, $document->name);
+        }
+
+        return Storage::download($document->file_path, $document->name);
+    }
+}

app/Http/Controllers/OnlyOfficeController.php

@@ -0,0 +1,72 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\Document;
+use Firebase\JWT\JWT;
+use Firebase\JWT\Key;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Str;
+use Symfony\Component\HttpFoundation\Response as SymfonyResponse;
+use Symfony\Component\HttpFoundation\StreamedResponse;
+
+class OnlyOfficeController extends Controller
+{
+    public function download(Request $request, Document $document): StreamedResponse
+    {
+        // Relative signature: the download URL is built with a host the document
+        // server can reach (host.docker.internal, ...), which may differ from
+        // the host the browser/this server sees — only path+query are signed.
+        abort_unless($request->hasValidRelativeSignature(), 403);
+        abort_unless($document->isOffice() && $document->file_path, 404);
+
+        return Storage::response($document->file_path);
+    }
+
+    public function callback(Request $request, Document $document): JsonResponse
+    {
+        abort_unless($document->isOffice(), 404);
+
+        $payload = $this->verifiedPayload($request);
+
+        // OnlyOffice callback statuses: 2 = ready to save, 6 = force-saved while editing.
+        if (in_array($payload['status'] ?? null, [2, 6], true) && filled($payload['url'] ?? null)) {
+            $response = Http::get($payload['url']);
+            abort_unless($response->successful(), 502);
+
+            Storage::put($document->file_path, $response->body());
+
+            $document->increment('current_version');
+            $document->update(['office_key' => Str::random(20)]);
+
+            $document->versions()->create([
+                'version' => $document->current_version,
+                'created_by' => $payload['users'][0] ?? null,
+            ]);
+        }
+
+        return response()->json(['error' => 0]);
+    }
+
+    protected function verifiedPayload(Request $request): array
+    {
+        $secret = config('onlyoffice.jwt_secret');
+
+        if (blank($secret)) {
+            return $request->all();
+        }
+
+        $token = $request->bearerToken()
+            ?? $request->input('token')
+            ?? str($request->header('Authorization', ''))->after('Bearer ')->toString();
+
+        abort_if(blank($token), SymfonyResponse::HTTP_UNAUTHORIZED);
+
+        $decoded = JWT::decode($token, new Key($secret, 'HS256'));
+
+        return (array) ($decoded->payload ?? $decoded);
+    }
+}

app/Http/Middleware/CheckOrganizationIpAccess.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\IpUtils;
+use Symfony\Component\HttpFoundation\Response;
+
+class CheckOrganizationIpAccess
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  Closure(Request): (Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        $organization = $request->route('organization');
+
+        if (! $organization || empty($organization->allowed_ip_ranges)) {
+            return $next($request);
+        }
+
+        if (IpUtils::checkIp($request->ip(), $organization->allowed_ip_ranges)) {
+            return $next($request);
+        }
+
+        abort(403, 'Your IP address is not permitted to access this organization.');
+    }
+}