bert.hausmans
52f6380ac0
Token generation: - Replace Str::ulid() with bin2hex(random_bytes(32)) for 256-bit entropy - Store SHA-256 hash in database, never plaintext tokens - Hash input before lookup on all token endpoints Invitation tokens: - InvitationService: generate crypto random, store hash, pass plain token transiently for email URL via UserInvitation::$plainToken - InvitationController show/accept: hash input before DB lookup - AcceptInvitationRequest: hash token before invitation lookup - Migration: widen user_invitations.token and artists.portal_token from char(26) to char(64) for SHA-256 hex digests Portal token auth: - PortalTokenController: remove Schema::hasTable() runtime checks, hash token before lookup, return shaped response via PortalEventResource instead of raw model data - Create PortalEventResource (name, dates, status only — no internals) - Handle missing production_requests table gracefully via try/catch Portal token middleware: - Implement full token validation: extract from Bearer header or ?token= query param, hash, look up in artists/production_requests, verify event exists and is not draft/closed, set portal context on request - Return generic 401 on any failure (no information leakage) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
84 lines
1.8 KiB
PHP
84 lines
1.8 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Models;
|
|
|
|
use Illuminate\Database\Eloquent\Builder;
|
|
use Illuminate\Database\Eloquent\Concerns\HasUlids;
|
|
use Illuminate\Database\Eloquent\Factories\HasFactory;
|
|
use Illuminate\Database\Eloquent\Model;
|
|
use Illuminate\Database\Eloquent\Relations\BelongsTo;
|
|
|
|
final class UserInvitation extends Model
|
|
{
|
|
use HasFactory;
|
|
use HasUlids;
|
|
|
|
/**
|
|
* Plain-text token, set transiently after creation for use in emails.
|
|
* Never persisted — the DB stores only the SHA-256 hash.
|
|
*/
|
|
public ?string $plainToken = null;
|
|
|
|
protected $fillable = [
|
|
'email',
|
|
'event_id',
|
|
];
|
|
|
|
protected function casts(): array
|
|
{
|
|
return [
|
|
'expires_at' => 'datetime',
|
|
];
|
|
}
|
|
|
|
public function invitedBy(): BelongsTo
|
|
{
|
|
return $this->belongsTo(User::class, 'invited_by_user_id');
|
|
}
|
|
|
|
public function organisation(): BelongsTo
|
|
{
|
|
return $this->belongsTo(Organisation::class);
|
|
}
|
|
|
|
public function event(): BelongsTo
|
|
{
|
|
return $this->belongsTo(Event::class);
|
|
}
|
|
|
|
public function isExpired(): bool
|
|
{
|
|
return $this->expires_at->isPast();
|
|
}
|
|
|
|
public function isPending(): bool
|
|
{
|
|
return $this->status === 'pending';
|
|
}
|
|
|
|
public function markAsAccepted(): void
|
|
{
|
|
$this->status = 'accepted';
|
|
$this->save();
|
|
}
|
|
|
|
public function markAsExpired(): void
|
|
{
|
|
$this->status = 'expired';
|
|
$this->save();
|
|
}
|
|
|
|
public function scopePending(Builder $query): Builder
|
|
{
|
|
return $query->where('status', 'pending');
|
|
}
|
|
|
|
public function scopeExpired(Builder $query): Builder
|
|
{
|
|
return $query->where('status', 'expired')
|
|
->orWhere(fn (Builder $q) => $q->where('status', 'pending')->where('expires_at', '<', now()));
|
|
}
|
|
}
|