bert.hausmans
52f6380ac0
Token generation: - Replace Str::ulid() with bin2hex(random_bytes(32)) for 256-bit entropy - Store SHA-256 hash in database, never plaintext tokens - Hash input before lookup on all token endpoints Invitation tokens: - InvitationService: generate crypto random, store hash, pass plain token transiently for email URL via UserInvitation::$plainToken - InvitationController show/accept: hash input before DB lookup - AcceptInvitationRequest: hash token before invitation lookup - Migration: widen user_invitations.token and artists.portal_token from char(26) to char(64) for SHA-256 hex digests Portal token auth: - PortalTokenController: remove Schema::hasTable() runtime checks, hash token before lookup, return shaped response via PortalEventResource instead of raw model data - Create PortalEventResource (name, dates, status only — no internals) - Handle missing production_requests table gracefully via try/catch Portal token middleware: - Implement full token validation: extract from Bearer header or ?token= query param, hash, look up in artists/production_requests, verify event exists and is not draft/closed, set portal context on request - Return generic 401 on any failure (no information leakage) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
40 lines
1.2 KiB
PHP
40 lines
1.2 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Database\Factories;
|
|
|
|
use App\Models\Organisation;
|
|
use App\Models\User;
|
|
use App\Models\UserInvitation;
|
|
use Illuminate\Database\Eloquent\Factories\Factory;
|
|
|
|
/** @extends Factory<UserInvitation> */
|
|
final class UserInvitationFactory extends Factory
|
|
{
|
|
/** @return array<string, mixed> */
|
|
public function definition(): array
|
|
{
|
|
return [
|
|
'email' => fake()->unique()->safeEmail(),
|
|
'event_id' => null,
|
|
];
|
|
}
|
|
|
|
public function configure(): static
|
|
{
|
|
return $this->afterMaking(function (UserInvitation $invitation): void {
|
|
$invitation->invited_by_user_id ??= User::factory()->create()->id;
|
|
$invitation->organisation_id ??= Organisation::factory()->create()->id;
|
|
$invitation->role ??= 'org_member';
|
|
if ($invitation->token === null) {
|
|
$plainToken = bin2hex(random_bytes(32));
|
|
$invitation->token = hash('sha256', $plainToken);
|
|
$invitation->plainToken = $plainToken;
|
|
}
|
|
$invitation->status ??= 'pending';
|
|
$invitation->expires_at ??= now()->addDays(7);
|
|
});
|
|
}
|
|
}
|