bert.hausmans
2e94a107e4
The dual-cookie machinery (crewli_app_token + crewli_portal_token, Origin-based resolution) was load-bearing only when the second SPA existed. apps/portal/ was deleted in WS-3 PR-B1; the resolver code has been carrying dead branches since then. Collapse to one cookie. Cookie name retained as crewli_app_token — no session breakage on deploy. crewli_portal_token is fully purged from the server-side. CookieBearerToken middleware: - COOKIE_NAMES array → single COOKIE_NAME constant - resolveCookieName method (Origin/Referer parsing, host+port matching against frontend_app_url/frontend_portal_url) → removed - Body collapses to: skip if Authorization header present; else read crewli_app_token cookie and inject Bearer header SetAuthCookie trait: - COOKIE_MAP / resolveCookieName / originMatches → removed - makeAuthCookie / forgetAuthCookie now take only $token; the cookie name is the trait's private constant Five callers updated to drop the resolveCookieName($request) line and the cookie-name argument: LoginController (3 sites), MfaVerifyController (1 site), AuthRefreshController (1 site), LogoutController (1 site), InvitationController (1 site — caller list in the prompt missed this one but the same pattern applies). frontend_portal_url config key retained (per Phase A directive Q1): EmailChangeController, PasswordResetController, PersonController are non-auth consumers that build per-app URL maps for outbound emails. The map structure is now functionally redundant (production resolves all FRONTEND_* env vars to the same host) but stays structurally intact. Refactor tracked as TECH-FRONTEND-URL-CONSOLIDATE in the upcoming docs commit. HttpOnlyCookieAuthTest: - Removed 4 dual-cookie tests (login_sets_portal_cookie_for_portal_origin, app_cookie_does_not_authenticate_portal_requests, portal_cookie_does_not_authenticate_app_requests, correct_cookie_authenticates_with_matching_origin) - Renamed login_sets_app_cookie_for_unknown_origin → login_sets_app_cookie_regardless_of_origin; expanded to four Origin variants (none, app, unknown, foreign) — pins the new origin-agnostic contract - Removed Origin headers from request calls in remaining tests (now meaningless) Backend test count: 1491 → 1487 (-4 deleted, dual-cookie tests encoding the obsolete contract). Pint clean. Larastan clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
100 lines
3.0 KiB
PHP
100 lines
3.0 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Controllers\Api\V1;
|
|
|
|
use App\Http\Controllers\Api\V1\Traits\SetAuthCookie;
|
|
use App\Http\Controllers\Controller;
|
|
use App\Http\Requests\Api\V1\AcceptInvitationRequest;
|
|
use App\Http\Requests\Api\V1\StoreInvitationRequest;
|
|
use App\Http\Resources\Api\V1\InvitationResource;
|
|
use App\Models\Organisation;
|
|
use App\Models\UserInvitation;
|
|
use App\Services\InvitationService;
|
|
use Illuminate\Http\JsonResponse;
|
|
use Illuminate\Support\Facades\Gate;
|
|
|
|
final class InvitationController extends Controller
|
|
{
|
|
use SetAuthCookie;
|
|
|
|
public function __construct(
|
|
private readonly InvitationService $invitationService,
|
|
) {}
|
|
|
|
public function invite(StoreInvitationRequest $request, Organisation $organisation): JsonResponse
|
|
{
|
|
Gate::authorize('invite', $organisation);
|
|
|
|
$invitation = $this->invitationService->invite(
|
|
$organisation,
|
|
$request->validated('email'),
|
|
$request->validated('role'),
|
|
$request->user(),
|
|
);
|
|
|
|
return $this->created(
|
|
new InvitationResource($invitation->load(['organisation', 'invitedBy'])),
|
|
'Uitnodiging verstuurd',
|
|
);
|
|
}
|
|
|
|
public function show(string $token): JsonResponse
|
|
{
|
|
$hashedToken = hash('sha256', $token);
|
|
|
|
$invitation = UserInvitation::where('token', $hashedToken)
|
|
->with(['organisation', 'invitedBy'])
|
|
->first();
|
|
|
|
if (! $invitation) {
|
|
return $this->notFound('Uitnodiging niet gevonden');
|
|
}
|
|
|
|
return $this->success(new InvitationResource($invitation));
|
|
}
|
|
|
|
public function accept(AcceptInvitationRequest $request, string $token): JsonResponse
|
|
{
|
|
$hashedToken = hash('sha256', $token);
|
|
$invitation = UserInvitation::where('token', $hashedToken)->firstOrFail();
|
|
|
|
$user = $this->invitationService->accept(
|
|
$invitation,
|
|
$request->validated('password'),
|
|
);
|
|
|
|
$sanctumToken = $user->createToken('auth-token')->plainTextToken;
|
|
|
|
return $this->success([
|
|
'user' => [
|
|
'id' => $user->id,
|
|
'first_name' => $user->first_name,
|
|
'last_name' => $user->last_name,
|
|
'full_name' => $user->full_name,
|
|
'email' => $user->email,
|
|
],
|
|
], 'Uitnodiging geaccepteerd')
|
|
->withCookie($this->makeAuthCookie($sanctumToken));
|
|
}
|
|
|
|
public function revoke(Organisation $organisation, UserInvitation $invitation): JsonResponse
|
|
{
|
|
// Verify invitation belongs to this organisation
|
|
if ($invitation->organisation_id !== $organisation->id) {
|
|
return $this->notFound('Uitnodiging niet gevonden');
|
|
}
|
|
|
|
Gate::authorize('invite', $organisation);
|
|
|
|
if (! $invitation->isPending()) {
|
|
return $this->error('Alleen openstaande uitnodigingen kunnen worden ingetrokken.', 422);
|
|
}
|
|
|
|
$invitation->markAsExpired();
|
|
|
|
return response()->json(null, 204);
|
|
}
|
|
}
|