64 lines
2.6 KiB
PHP
64 lines
2.6 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use App\Models\Auth\DingTalkIdentity;
|
|
use App\Services\Auth\FinanceRoster;
|
|
use App\Services\Auth\DingTalkClosedAccess;
|
|
use Closure;
|
|
use Throwable;
|
|
|
|
class LogoutIfDingTalkBindingRevoked
|
|
{
|
|
public function handle($request, Closure $next)
|
|
{
|
|
$identityId = $request->session()->get('dingtalk_identity_id');
|
|
$user = $request->user();
|
|
if (! $identityId) {
|
|
if (! $user || $user->created_from !== 'dingtalk_roster') {
|
|
return $next($request);
|
|
}
|
|
// A password reset must not bypass HR eligibility for provisioned
|
|
// accounts. Apply the same boundary after every sign-in method.
|
|
$identityId = $user->dingtalkIdentity?->id;
|
|
$request->session()->put('dingtalk_identity_id', $identityId);
|
|
$request->session()->forget('dingtalk_roster_checked_at');
|
|
}
|
|
|
|
$identity = $user ? DingTalkIdentity::query()->whereKey($identityId)->where('user_id', $user->id)->first() : null;
|
|
if ($user && $user->enabled && $identity) {
|
|
$checkedAt = (int) $request->session()->get('dingtalk_roster_checked_at', 0);
|
|
if ($checkedAt > now()->timestamp - 300) {
|
|
return $next($request);
|
|
}
|
|
try {
|
|
$eligible = app(FinanceRoster::class)->findEligible((string) $identity->dingtalk_user_id);
|
|
} catch (Throwable) {
|
|
// Retain the session during an HR outage, but do not serve data
|
|
// using an expired authorization decision.
|
|
return response(trans('auth.dingtalk.roster_unavailable'), 503)
|
|
->header('Cache-Control', 'no-store');
|
|
}
|
|
if ($eligible) {
|
|
$request->session()->put('dingtalk_roster_checked_at', now()->timestamp);
|
|
return $next($request);
|
|
}
|
|
}
|
|
|
|
app(DingTalkClosedAccess::class)->audit('session_revoked', 'denied', $user?->id, null, $identity?->union_id, $request, [
|
|
'reason' => ! $user?->enabled ? 'local_account_ineligible' : (! $identity ? 'binding_revoked' : 'outside_finance_roster'),
|
|
]);
|
|
auth()->logout();
|
|
$request->session()->invalidate();
|
|
$request->session()->regenerateToken();
|
|
|
|
if ($request->expectsJson()) {
|
|
return response()->json(['message' => trans('auth.dingtalk.session_expired')], 401)
|
|
->header('Cache-Control', 'no-store');
|
|
}
|
|
|
|
return redirect()->route('login')
|
|
->with('dingtalk_error', trans('auth.dingtalk.session_expired'));
|
|
}
|
|
}
|