Files
crewli/api/app/Models/Person.php
bert.hausmans 1028498705 security: round 1 — quick wins (rate limiting, headers, mass assignment, logging)
- Add throttle middleware to login (5/min), portal/token-auth (10/min),
  volunteer-register (5/min), and invitation routes (10/min)
- Set Sanctum token expiration to 7 days
- Remove billing_status from UpdateOrganisationRequest (super_admin only)
- Revoke all Sanctum tokens on password reset
- Strengthen password rules: min 8 chars, mixed case, numbers
- Create SecurityHeaders middleware (X-Content-Type-Options, X-Frame-Options,
  HSTS, Referrer-Policy, Permissions-Policy)
- Fix open redirect on all 3 login pages (validate ?to= starts with /)
- Set APP_DEBUG=false in .env.example
- Log failed login attempts with email, IP, user-agent
- Log authorization failures (403) with user, IP, path, method
- Harden mass assignment: remove user_id from Person, audit fields from
  ShiftAssignment, system fields from UserInvitation $fillable
- Replace real DB records with factory make() in mail preview routes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-14 01:34:51 +02:00

133 lines
3.2 KiB
PHP

<?php
declare(strict_types=1);
namespace App\Models;
use App\Enums\IdentityMatchStatus;
use Illuminate\Database\Eloquent\Builder;
use Illuminate\Database\Eloquent\Concerns\HasUlids;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Model;
use Illuminate\Database\Eloquent\Relations\BelongsTo;
use Illuminate\Database\Eloquent\Relations\BelongsToMany;
use Illuminate\Database\Eloquent\Relations\HasMany;
use Illuminate\Database\Eloquent\Relations\HasOne;
use Illuminate\Database\Eloquent\SoftDeletes;
final class Person extends Model
{
use HasFactory;
use HasUlids;
use SoftDeletes;
protected $table = 'persons';
protected $fillable = [
'event_id',
'crowd_type_id',
'company_id',
'first_name',
'last_name',
'date_of_birth',
'email',
'phone',
'status',
'is_blacklisted',
'admin_notes',
'remarks',
'custom_fields',
];
public function getFullNameAttribute(): string
{
return trim("{$this->first_name} {$this->last_name}");
}
public function getNameAttribute(): string
{
return $this->full_name;
}
protected function casts(): array
{
return [
'date_of_birth' => 'date',
'is_blacklisted' => 'boolean',
'custom_fields' => 'array',
];
}
public function event(): BelongsTo
{
return $this->belongsTo(Event::class);
}
public function crowdType(): BelongsTo
{
return $this->belongsTo(CrowdType::class);
}
public function company(): BelongsTo
{
return $this->belongsTo(Company::class);
}
public function user(): BelongsTo
{
return $this->belongsTo(User::class);
}
public function crowdLists(): BelongsToMany
{
return $this->belongsToMany(CrowdList::class, 'crowd_list_persons')
->withPivot('added_at', 'added_by_user_id');
}
public function shiftAssignments(): HasMany
{
return $this->hasMany(ShiftAssignment::class);
}
public function volunteerAvailabilities(): HasMany
{
return $this->hasMany(VolunteerAvailability::class);
}
public function fieldValues(): HasMany
{
return $this->hasMany(PersonFieldValue::class);
}
public function sectionPreferences(): HasMany
{
return $this->hasMany(PersonSectionPreference::class);
}
public function identityMatches(): HasMany
{
return $this->hasMany(PersonIdentityMatch::class);
}
public function pendingIdentityMatch(): HasOne
{
return $this->hasOne(PersonIdentityMatch::class)
->where('status', IdentityMatchStatus::PENDING);
}
public function scopeApproved(Builder $query): Builder
{
return $query->where('status', 'approved');
}
public function scopePending(Builder $query): Builder
{
return $query->where('status', 'pending');
}
public function scopeForCrowdType(Builder $query, string $type): Builder
{
return $query->whereHas('crowdType', fn (Builder $q) => $q->where('system_type', $type));
}
}