bert.hausmans
52f6380ac0
Token generation: - Replace Str::ulid() with bin2hex(random_bytes(32)) for 256-bit entropy - Store SHA-256 hash in database, never plaintext tokens - Hash input before lookup on all token endpoints Invitation tokens: - InvitationService: generate crypto random, store hash, pass plain token transiently for email URL via UserInvitation::$plainToken - InvitationController show/accept: hash input before DB lookup - AcceptInvitationRequest: hash token before invitation lookup - Migration: widen user_invitations.token and artists.portal_token from char(26) to char(64) for SHA-256 hex digests Portal token auth: - PortalTokenController: remove Schema::hasTable() runtime checks, hash token before lookup, return shaped response via PortalEventResource instead of raw model data - Create PortalEventResource (name, dates, status only — no internals) - Handle missing production_requests table gracefully via try/catch Portal token middleware: - Implement full token validation: extract from Bearer header or ?token= query param, hash, look up in artists/production_requests, verify event exists and is not draft/closed, set portal context on request - Return generic 401 on any failure (no information leakage) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
49 lines
1.7 KiB
PHP
49 lines
1.7 KiB
PHP
<?php
|
|
|
|
use App\Mail\InvitationMail;
|
|
use App\Mail\RegistrationApprovedMail;
|
|
use App\Mail\RegistrationConfirmationMail;
|
|
use App\Mail\RegistrationRejectedMail;
|
|
use App\Models\Event;
|
|
use App\Models\Organisation;
|
|
use App\Models\Person;
|
|
use App\Models\User;
|
|
use App\Models\UserInvitation;
|
|
use Illuminate\Support\Facades\Route;
|
|
|
|
if (app()->environment('local', 'staging')) {
|
|
Route::get('/mail-preview/{type}', function (string $type) {
|
|
$supportedTypes = [
|
|
'registration-confirmation',
|
|
'registration-approved',
|
|
'registration-rejected',
|
|
'invitation',
|
|
];
|
|
|
|
if (! in_array($type, $supportedTypes)) {
|
|
abort(404, "Unknown mail type '{$type}'. Supported types: " . implode(', ', $supportedTypes));
|
|
}
|
|
|
|
if ($type === 'invitation') {
|
|
$organisation = Organisation::factory()->make();
|
|
$invitation = UserInvitation::factory()->make();
|
|
$invitation->setRelation('organisation', $organisation);
|
|
$invitation->setRelation('invitedBy', User::factory()->make());
|
|
$invitation->plainToken ??= 'preview-token';
|
|
$invitation->role ??= 'org_member';
|
|
$invitation->expires_at ??= now()->addDays(7);
|
|
|
|
return new InvitationMail($invitation);
|
|
}
|
|
|
|
$event = Event::factory()->make();
|
|
$person = Person::factory()->make();
|
|
|
|
return match ($type) {
|
|
'registration-confirmation' => new RegistrationConfirmationMail($person, $event),
|
|
'registration-approved' => new RegistrationApprovedMail($person, $event),
|
|
'registration-rejected' => new RegistrationRejectedMail($person, $event, 'Helaas geen plek meer.'),
|
|
};
|
|
});
|
|
}
|