Kevin Adametz
39e13d6d84
- trustHosts erlaubt nur die konfigurierten Domains (plus localhost/IP für Health-Checks) und verwirft fremde Host-Header, sodass X-Forwarded-Host keine URL-Generierung mehr vergiften kann (H5). - Legacy-API-Keys nur noch per Header (Bearer/X-ApiKey); die alte Query-/Body-Übergabe wird nicht mehr zur Auth akzeptiert, erhält aber weiterhin den 410-Migrationshinweis statt eines opaken 401 (M11). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
62 lines
2.4 KiB
PHP
62 lines
2.4 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers\Api\Legacy;
|
|
|
|
use App\Enums\CompanyType;
|
|
use App\Http\Controllers\Controller;
|
|
use App\Models\Company;
|
|
use Illuminate\Http\JsonResponse;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Validation\ValidationException;
|
|
|
|
/**
|
|
* Alt-Vertrag POST /service/users/me/companies (meistgenutzter Legacy-Call,
|
|
* 5.935x in den Prod-Logs): Felder verschachtelt unter company[...],
|
|
* Response 201 + Location + {}. Paritäts-Doku §1/§4 S1.
|
|
*/
|
|
class LegacyCompanyController extends Controller
|
|
{
|
|
use RespondsLikeLegacyApi;
|
|
|
|
public function store(Request $request): JsonResponse
|
|
{
|
|
abort_unless($request->user()->tokenCan('press-releases:write'), 403);
|
|
|
|
try {
|
|
$validated = $request->validate([
|
|
'company' => ['required', 'array'],
|
|
'company.name' => ['required', 'string', 'max:255'],
|
|
'company.address' => ['nullable', 'string', 'max:1000'],
|
|
'company.country_id' => ['nullable', 'integer'],
|
|
'company.phone' => ['nullable', 'string', 'max:100'],
|
|
'company.fax' => ['nullable', 'string', 'max:100'],
|
|
'company.email' => ['nullable', 'email', 'max:255'],
|
|
'company.website' => ['nullable', 'string', 'max:255'],
|
|
])['company'];
|
|
} catch (ValidationException $exception) {
|
|
return $this->legacyValidationError($exception);
|
|
}
|
|
|
|
$user = $request->user();
|
|
|
|
$company = new Company([
|
|
'portal' => $user->portal?->value,
|
|
'type' => CompanyType::Company->value,
|
|
'name' => $validated['name'],
|
|
'address' => $validated['address'] ?? null,
|
|
'country_code' => $this->legacyCountryCode($validated['country_id'] ?? null),
|
|
'phone' => $validated['phone'] ?? null,
|
|
'fax' => $validated['fax'] ?? null,
|
|
'email' => $validated['email'] ?? null,
|
|
'website' => $validated['website'] ?? null,
|
|
// Alt-Verhalten: per API angelegte Firmen waren sofort nutzbar.
|
|
'is_active' => true,
|
|
]);
|
|
$company->owner_user_id = $user->id;
|
|
$company->slug = $company->generateUniqueSlug($company->name);
|
|
$company->save();
|
|
$company->users()->attach($user->id, ['role' => 'owner']);
|
|
|
|
return $this->legacyCreated(url("/service/users/me/companies/{$company->id}"));
|
|
}
|
|
}
|