85 lines
3.2 KiB
PHP
85 lines
3.2 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use App\Models\Auth\DingTalkIdentity;
|
|
use App\Services\Auth\DingTalkClosedAccess;
|
|
use App\Services\Auth\FinanceRoster;
|
|
use App\Services\Auth\SupplierPortalAccess;
|
|
use Closure;
|
|
use Illuminate\Support\Facades\Auth;
|
|
use Throwable;
|
|
|
|
class LogoutIfDingTalkBindingRevoked
|
|
{
|
|
public function handle($request, Closure $next)
|
|
{
|
|
$identityId = $request->session()->get('dingtalk_identity_id');
|
|
$user = $request->user();
|
|
if (! $identityId) {
|
|
if (! $user) {
|
|
return $next($request);
|
|
}
|
|
if (config('auth.password_login_enabled', false)) {
|
|
return $next($request);
|
|
}
|
|
|
|
// Every web session must originate from the DingTalk callback.
|
|
// Reject legacy or direct password sessions before serving data.
|
|
return $this->revoke($request, $user, null, 'dingtalk_login_required');
|
|
}
|
|
|
|
$identity = $user ? DingTalkIdentity::query()->whereKey($identityId)->where('user_id', $user->id)->first() : null;
|
|
if ($user && $user->enabled && $identity) {
|
|
$checkedAt = (int) $request->session()->get('dingtalk_roster_checked_at', 0);
|
|
if ($checkedAt > now()->timestamp - 300) {
|
|
return $next($request);
|
|
}
|
|
try {
|
|
$eligible = SupplierPortalAccess::isSupplierUser($user)
|
|
? app(SupplierPortalAccess::class)->revalidate($user) !== null
|
|
: app(FinanceRoster::class)->findEligible((string) $identity->dingtalk_user_id);
|
|
} catch (Throwable) {
|
|
// Retain the session during an HR outage, but do not serve data
|
|
// using an expired authorization decision.
|
|
return response(trans('auth.dingtalk.roster_unavailable'), 503)
|
|
->header('Cache-Control', 'no-store');
|
|
}
|
|
if ($eligible) {
|
|
$request->session()->put('dingtalk_roster_checked_at', now()->timestamp);
|
|
return $next($request);
|
|
}
|
|
}
|
|
|
|
return $this->revoke(
|
|
$request,
|
|
$user,
|
|
$identity,
|
|
! $user?->enabled
|
|
? 'local_account_ineligible'
|
|
: (! $identity
|
|
? 'binding_revoked'
|
|
: (SupplierPortalAccess::isSupplierUser($user) ? 'outside_supplier_roster' : 'outside_finance_roster'))
|
|
);
|
|
}
|
|
|
|
private function revoke($request, $user, ?DingTalkIdentity $identity, string $reason)
|
|
{
|
|
app(DingTalkClosedAccess::class)->audit('session_revoked', 'denied', $user?->id, null, $identity?->union_id, $request, [
|
|
'reason' => $reason,
|
|
]);
|
|
auth()->logout();
|
|
cookie()->queue(cookie()->forget(Auth::guard()->getRecallerName()));
|
|
$request->session()->invalidate();
|
|
$request->session()->regenerateToken();
|
|
|
|
if ($request->expectsJson()) {
|
|
return response()->json(['message' => trans('auth.dingtalk.session_expired')], 401)
|
|
->header('Cache-Control', 'no-store');
|
|
}
|
|
|
|
return redirect()->route('login')
|
|
->with('dingtalk_error', trans('auth.dingtalk.session_expired'));
|
|
}
|
|
}
|