Josep Piguillem
3897113313
Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer collective, backed by the Pireon OAuth identity server. The public site is a separate, server-rendered application consuming /api/public/v1. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
82 lines
2.2 KiB
PHP
82 lines
2.2 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use App\Support\PreviewLink;
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
/**
|
|
* Lets the frontend render unpublished content when it presents the preview
|
|
* secret.
|
|
*
|
|
* Because the frontend renders on the server, this is simple: the preview route
|
|
* forwards the secret on its own fetch, and nothing about it reaches the
|
|
* visitor's browser. The flag is read by the public controllers to decide
|
|
* whether to apply the `published` scope.
|
|
*/
|
|
class AllowPreview
|
|
{
|
|
public function handle(Request $request, Closure $next): Response
|
|
{
|
|
$request->attributes->set('preview', $this->isPreview($request));
|
|
|
|
return $next($request);
|
|
}
|
|
|
|
protected function isPreview(Request $request): bool
|
|
{
|
|
return $this->hasSharedSecret($request) || $this->hasSignedLink($request);
|
|
}
|
|
|
|
/**
|
|
* The shared secret: one value, held by the frontend, that unlocks
|
|
* everything unpublished.
|
|
*/
|
|
protected function hasSharedSecret(Request $request): bool
|
|
{
|
|
$secret = (string) config('site.preview_token');
|
|
|
|
// An unset secret must never mean "everyone gets preview access".
|
|
if (blank($secret)) {
|
|
return false;
|
|
}
|
|
|
|
$presented = $request->header('X-Preview-Token')
|
|
?? $request->query('preview_token');
|
|
|
|
return is_string($presented) && hash_equals($secret, $presented);
|
|
}
|
|
|
|
/**
|
|
* A link generated for one record.
|
|
*
|
|
* Signed and short-lived, and it says which record it is for — so one
|
|
* forwarded to the wrong person leaks a single draft rather than every
|
|
* unpublished thing on the site.
|
|
*/
|
|
protected function hasSignedLink(Request $request): bool
|
|
{
|
|
$token = $request->header('X-Preview-Link') ?? $request->query('preview');
|
|
|
|
if (! is_string($token) || blank($token)) {
|
|
return false;
|
|
}
|
|
|
|
$payload = PreviewLink::open($token);
|
|
|
|
if ($payload === null) {
|
|
return false;
|
|
}
|
|
|
|
// Handed to the controllers so a link for one draft cannot be used to
|
|
// read another.
|
|
$request->attributes->set('preview_scope', $payload);
|
|
|
|
return true;
|
|
}
|
|
}
|