Kevin Adametz
39e13d6d84
- trustHosts erlaubt nur die konfigurierten Domains (plus localhost/IP für Health-Checks) und verwirft fremde Host-Header, sodass X-Forwarded-Host keine URL-Generierung mehr vergiften kann (H5). - Legacy-API-Keys nur noch per Header (Bearer/X-ApiKey); die alte Query-/Body-Übergabe wird nicht mehr zur Auth akzeptiert, erhält aber weiterhin den 410-Migrationshinweis statt eines opaken 401 (M11). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
67 lines
2.5 KiB
PHP
67 lines
2.5 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers\Api\Legacy;
|
|
|
|
use App\Http\Controllers\Controller;
|
|
use App\Models\Company;
|
|
use Illuminate\Http\JsonResponse;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Validation\ValidationException;
|
|
|
|
/**
|
|
* Alt-Vertrag POST /service/users/me/companies/{id}/contacts:
|
|
* Felder unter contact[...], salutation_id 1/2 → mr/mrs (wie ContactImporter),
|
|
* nur eigene Firmen. Paritäts-Doku §1/§4 S1.
|
|
*/
|
|
class LegacyContactController extends Controller
|
|
{
|
|
use RespondsLikeLegacyApi;
|
|
|
|
public function store(Request $request, int $company): JsonResponse
|
|
{
|
|
abort_unless($request->user()->tokenCan('press-releases:write'), 403);
|
|
|
|
$company = Company::withoutGlobalScopes()
|
|
->whereKey($company)
|
|
->accessibleBy($request->user())
|
|
->first();
|
|
|
|
if (! $company) {
|
|
return $this->legacyError(403, ['You may only access companies which are related to your user-account']);
|
|
}
|
|
|
|
try {
|
|
$validated = $request->validate([
|
|
'contact' => ['required', 'array'],
|
|
'contact.salutation_id' => ['nullable', 'integer'],
|
|
'contact.title' => ['nullable', 'string', 'max:100'],
|
|
'contact.first_name' => ['required', 'string', 'max:255'],
|
|
'contact.last_name' => ['required', 'string', 'max:255'],
|
|
'contact.responsibility' => ['nullable', 'string', 'max:255'],
|
|
'contact.phone' => ['nullable', 'string', 'max:100'],
|
|
'contact.fax' => ['nullable', 'string', 'max:100'],
|
|
'contact.email' => ['nullable', 'email', 'max:255'],
|
|
])['contact'];
|
|
} catch (ValidationException $exception) {
|
|
return $this->legacyValidationError($exception);
|
|
}
|
|
|
|
$contact = $company->contacts()->create([
|
|
'portal' => $company->portal?->value,
|
|
'salutation_key' => match ((int) ($validated['salutation_id'] ?? 0)) {
|
|
1 => 'mr',
|
|
2 => 'mrs',
|
|
default => null,
|
|
},
|
|
'title' => $validated['title'] ?? null,
|
|
'first_name' => $validated['first_name'],
|
|
'last_name' => $validated['last_name'],
|
|
'responsibility' => $validated['responsibility'] ?? null,
|
|
'phone' => $validated['phone'] ?? null,
|
|
'fax' => $validated['fax'] ?? null,
|
|
'email' => $validated['email'] ?? null,
|
|
]);
|
|
|
|
return $this->legacyCreated(url("/service/users/me/companies/{$company->id}/contacts/{$contact->id}"));
|
|
}
|
|
}
|