new funcionality

2026-07-27 17:20:02 +02:00
parent c2b5291a74
commit c5ce8a7a36
101 changed files with 6889 additions and 176 deletions
--- a/database/factories/UserFactory.php
+++ b/database/factories/UserFactory.php
@@ -42,4 +42,16 @@ class UserFactory extends Factory
            'email_verified_at' => null,
        ]);
    }
+
+    /**
+     * approved_at es nullable sin default (ver migración add_approved_at):
+     * un usuario recién creado por el factory queda "pendiente" (isPending()
+     * === true) salvo que se pida explícitamente este estado.
+     */
+    public function approved(): static
+    {
+        return $this->state(fn (array $attributes) => [
+            'approved_at' => now(),
+        ]);
+    }
 }
--- a/database/migrations/2026_07_26_130000_add_outcome_to_login_events_table.php
+++ b/database/migrations/2026_07_26_130000_add_outcome_to_login_events_table.php
@@ -0,0 +1,32 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('login_events', function (Blueprint $table) {
+            // Default 'success' backfilla las filas existentes: hasta ahora
+            // login_events solo registraba logins exitosos.
+            $table->string('outcome')->default('success')->after('type');
+            $table->index(['type', 'outcome', 'created_at']);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('login_events', function (Blueprint $table) {
+            $table->dropIndex(['type', 'outcome', 'created_at']);
+            $table->dropColumn('outcome');
+        });
+    }
+};
--- a/database/migrations/2026_07_26_130001_create_oauth_authorization_events_table.php
+++ b/database/migrations/2026_07_26_130001_create_oauth_authorization_events_table.php
@@ -0,0 +1,37 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('oauth_authorization_events', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('user_id')->nullable()->constrained()->nullOnDelete();
+            $table->foreignUuid('client_id')->nullable()->constrained('oauth_clients')->nullOnDelete();
+            $table->string('outcome'); // 'attempted' | 'approved' | 'denied'
+            $table->json('scopes')->nullable();
+            $table->string('ip_address', 45)->nullable();
+            $table->string('user_agent')->nullable();
+            $table->timestamp('created_at')->nullable();
+
+            $table->index(['created_at']);
+            $table->index(['client_id', 'created_at']);
+            $table->index(['outcome']);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::dropIfExists('oauth_authorization_events');
+    }
+};
--- a/database/migrations/2026_07_26_140000_create_audit_logs_table.php
+++ b/database/migrations/2026_07_26_140000_create_audit_logs_table.php
@@ -0,0 +1,47 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('audit_logs', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('actor_id')->nullable()->constrained('users')->nullOnDelete();
+            $table->string('action'); // 'user.created', 'client.revoked', etc.
+            // subject_id es string (no FK/morphs): cubre tanto ids autoincrementales
+            // (User) como uuid (Client) sin mezclar tipos en una sola columna.
+            $table->string('subject_type'); // 'user' | 'client'
+            $table->string('subject_id');
+            // Snapshot de texto (email del usuario, nombre del client) al momento
+            // del evento — sigue siendo legible aunque el sujeto se borre después.
+            $table->string('subject_label')->nullable();
+            // Se llama "metadata" y no "changes": ese nombre colisiona con la
+            // propiedad protegida $changes que Eloquent usa internamente para
+            // dirty-tracking (HasAttributes), y el choque solo se manifiesta
+            // cuando se accede al atributo desde dentro de esta misma clase.
+            $table->json('metadata')->nullable();
+            $table->string('ip_address', 45)->nullable();
+            $table->string('user_agent')->nullable();
+            $table->timestamp('created_at')->nullable();
+
+            $table->index(['created_at']);
+            $table->index(['action', 'created_at']);
+            $table->index(['subject_type', 'subject_id']);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::dropIfExists('audit_logs');
+    }
+};
--- a/database/migrations/2026_07_26_140001_add_audit_view_permission.php
+++ b/database/migrations/2026_07_26_140001_add_audit_view_permission.php
@@ -0,0 +1,34 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Spatie\Permission\Models\Permission;
+use Spatie\Permission\Models\Role;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * Backfilla el permiso "audit.view" para instalaciones ya sembradas
+     * (RolesAndPermissionsSeeder solo corre en instalaciones nuevas o al
+     * registrar el primer usuario) y se lo da al rol admin.
+     */
+    public function up(): void
+    {
+        $permission = Permission::findOrCreate('audit.view');
+
+        $admin = Role::where('name', 'admin')->first();
+
+        if ($admin && ! $admin->hasPermissionTo($permission)) {
+            $admin->givePermissionTo($permission);
+        }
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Permission::where('name', 'audit.view')->delete();
+    }
+};
--- a/database/migrations/2026_07_26_150000_add_two_factor_columns_to_users_table.php
+++ b/database/migrations/2026_07_26_150000_add_two_factor_columns_to_users_table.php
@@ -0,0 +1,35 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            // Guardados encriptados (cast 'encrypted'/'encrypted:array' en el
+            // modelo) — por eso alcanza con "text" acá, no hace falta un tipo
+            // especial. two_factor_confirmed_at null = activación pendiente
+            // (secreto generado pero todavía no confirmado con un código) o
+            // 2FA desactivado; no null = 2FA activo de verdad.
+            $table->text('two_factor_secret')->nullable()->after('password');
+            $table->text('two_factor_recovery_codes')->nullable()->after('two_factor_secret');
+            $table->timestamp('two_factor_confirmed_at')->nullable()->after('two_factor_recovery_codes');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->dropColumn(['two_factor_secret', 'two_factor_recovery_codes', 'two_factor_confirmed_at']);
+        });
+    }
+};
--- a/database/migrations/2026_07_27_100000_create_webhook_endpoints_table.php
+++ b/database/migrations/2026_07_27_100000_create_webhook_endpoints_table.php
@@ -0,0 +1,38 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('webhook_endpoints', function (Blueprint $table) {
+            $table->id();
+            $table->foreignUuid('client_id')->constrained('oauth_clients')->cascadeOnDelete();
+            $table->string('url');
+            // Encriptado (cast 'encrypted' en el modelo) — a diferencia del
+            // secret de un client OAuth, este SÍ hay que poder recuperarlo en
+            // texto plano después para firmar cada entrega (HMAC), no solo
+            // verificarlo una vez.
+            $table->text('secret');
+            $table->json('events'); // ej. ['token.revoked', 'user.deactivated']
+            $table->boolean('active')->default(true);
+            $table->timestamps();
+
+            $table->index(['client_id', 'active']);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::dropIfExists('webhook_endpoints');
+    }
+};
--- a/database/migrations/2026_07_27_100001_create_webhook_deliveries_table.php
+++ b/database/migrations/2026_07_27_100001_create_webhook_deliveries_table.php
@@ -0,0 +1,36 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('webhook_deliveries', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('webhook_endpoint_id')->constrained()->cascadeOnDelete();
+            $table->string('event');
+            $table->json('payload');
+            $table->unsignedSmallInteger('response_status')->nullable();
+            $table->text('response_body')->nullable();
+            $table->unsignedTinyInteger('attempts')->default(0);
+            $table->timestamp('delivered_at')->nullable();
+            $table->timestamp('created_at')->nullable();
+
+            $table->index(['webhook_endpoint_id', 'created_at']);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::dropIfExists('webhook_deliveries');
+    }
+};
--- a/database/migrations/2026_07_27_120000_add_secret_rotation_to_oauth_clients_table.php
+++ b/database/migrations/2026_07_27_120000_add_secret_rotation_to_oauth_clients_table.php
@@ -0,0 +1,33 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('oauth_clients', function (Blueprint $table) {
+            // Copia del hash del secret anterior (no se re-hashea, ya viene
+            // hasheado de la columna "secret") — sigue siendo válido hasta
+            // previous_secret_expires_at, para no cortar integraciones que
+            // todavía no se actualizaron al secret nuevo.
+            $table->text('previous_secret')->nullable()->after('secret');
+            $table->timestamp('previous_secret_expires_at')->nullable()->after('previous_secret');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('oauth_clients', function (Blueprint $table) {
+            $table->dropColumn(['previous_secret', 'previous_secret_expires_at']);
+        });
+    }
+};
--- a/database/seeders/RolesAndPermissionsSeeder.php
+++ b/database/seeders/RolesAndPermissionsSeeder.php
@@ -16,7 +16,7 @@ class RolesAndPermissionsSeeder extends Seeder
 {
    public function run(): void
    {
-        foreach (['users.view', 'users.create', 'users.update', 'users.delete'] as $permission) {
+        foreach (['users.view', 'users.create', 'users.update', 'users.delete', 'audit.view'] as $permission) {
            Permission::findOrCreate($permission);
        }