119 lines
7.7 KiB
PHP
119 lines
7.7 KiB
PHP
<?php
|
|
|
|
use App\Http\Controllers\Admin\AnalyticsController;
|
|
use App\Http\Controllers\Admin\AppController;
|
|
use App\Http\Controllers\Admin\AuditLogController;
|
|
use App\Http\Controllers\Admin\UserController;
|
|
use App\Http\Controllers\Admin\UserSessionController;
|
|
use App\Http\Controllers\Auth\AuthController;
|
|
use App\Http\Controllers\Auth\PasswordResetController;
|
|
use App\Http\Controllers\Auth\TwoFactorController;
|
|
use App\Http\Controllers\OAuth\AuthorizationEventController;
|
|
use App\Http\Controllers\OAuth\AuthorizedAppController;
|
|
use App\Http\Controllers\OAuth\ClientController;
|
|
use App\Http\Controllers\OAuth\PersonalAccessTokenController;
|
|
use App\Http\Controllers\OAuth\WebhookController;
|
|
use Illuminate\Support\Facades\Route;
|
|
use Laravel\Passport\Passport;
|
|
|
|
// Selector de idioma (es/en/ca), no requiere sesión.
|
|
Route::post('/web-api/locale', function () {
|
|
request()->validate(['locale' => 'required|in:es,en,ca']);
|
|
session(['locale' => request('locale')]);
|
|
|
|
return response()->noContent();
|
|
});
|
|
|
|
// Endpoints de sesión (guard "web") que consume la SPA para loguearse y
|
|
// administrar el servidor OAuth2 (clientes, personal access tokens, apps autorizadas).
|
|
Route::prefix('web-api')->group(function () {
|
|
Route::get('/setup-status', [AuthController::class, 'setupStatus']);
|
|
Route::post('/register', [AuthController::class, 'register'])->middleware('throttle:register');
|
|
Route::post('/login', [AuthController::class, 'login'])->middleware('throttle:login');
|
|
// Segundo paso del login cuando el usuario tiene 2FA activo. Throttle
|
|
// acotado: el espacio de códigos TOTP de 6 dígitos es chico.
|
|
Route::post('/login/2fa', [AuthController::class, 'loginTwoFactor'])->middleware('throttle:6,1');
|
|
|
|
Route::post('/forgot-password', [PasswordResetController::class, 'forgotPassword'])->middleware('throttle:password-reset');
|
|
Route::post('/reset-password', [PasswordResetController::class, 'resetPassword'])->middleware('throttle:password-reset');
|
|
|
|
Route::middleware('auth')->group(function () {
|
|
Route::post('/logout', [AuthController::class, 'logout']);
|
|
Route::get('/me', [AuthController::class, 'me']);
|
|
Route::get('/scopes', fn () => response()->json(Passport::scopes()));
|
|
|
|
// 2FA propio (self-service, como clientes/tokens): setup pendiente,
|
|
// confirmación, desactivación y regeneración de códigos de recuperación.
|
|
Route::post('/2fa/setup', [TwoFactorController::class, 'setup']);
|
|
// Confirmar activación (código TOTP) y confirmar contraseña actual
|
|
// (disable/recovery-codes) son ambos espacios de adivinanza chicos —
|
|
// mismo throttle acotado que el segundo paso del login con 2FA.
|
|
Route::post('/2fa/confirm', [TwoFactorController::class, 'confirm'])->middleware('throttle:6,1');
|
|
Route::post('/2fa/disable', [TwoFactorController::class, 'disable'])->middleware('throttle:6,1');
|
|
Route::post('/2fa/recovery-codes', [TwoFactorController::class, 'regenerateRecoveryCodes'])->middleware('throttle:6,1');
|
|
|
|
Route::apiResource('clients', ClientController::class)->except(['show']);
|
|
Route::post('/clients/{client}/rotate-secret', [ClientController::class, 'rotateSecret']);
|
|
|
|
// Webhooks salientes de un client propio (token.revoked, user.deactivated).
|
|
Route::get('/clients/{client}/webhooks', [WebhookController::class, 'index']);
|
|
Route::post('/clients/{client}/webhooks', [WebhookController::class, 'store']);
|
|
Route::put('/clients/{client}/webhooks/{webhook}', [WebhookController::class, 'update']);
|
|
Route::delete('/clients/{client}/webhooks/{webhook}', [WebhookController::class, 'destroy']);
|
|
Route::get('/clients/{client}/webhooks/{webhook}/deliveries', [WebhookController::class, 'deliveries']);
|
|
Route::post('/clients/{client}/webhooks/{webhook}/deliveries/{delivery}/retry', [WebhookController::class, 'retryDelivery']);
|
|
|
|
Route::get('/personal-access-tokens', [PersonalAccessTokenController::class, 'index']);
|
|
Route::post('/personal-access-tokens', [PersonalAccessTokenController::class, 'store']);
|
|
Route::delete('/personal-access-tokens/{tokenId}', [PersonalAccessTokenController::class, 'destroy']);
|
|
|
|
Route::get('/authorized-apps', [AuthorizedAppController::class, 'index']);
|
|
Route::delete('/authorized-apps/{tokenId}', [AuthorizedAppController::class, 'destroy']);
|
|
|
|
// Analíticas del funnel de autorización OAuth (intento/aprobación/denegación),
|
|
// registrado desde la pantalla de consentimiento (Authorize.vue).
|
|
Route::post('/oauth/authorize-events', [AuthorizationEventController::class, 'store']);
|
|
|
|
// Panel de administración de usuarios (solo para roles/permisos con "users.*").
|
|
Route::prefix('admin')->group(function () {
|
|
Route::get('/users', [UserController::class, 'index'])->middleware('can:users.view');
|
|
Route::get('/users/trashed', [UserController::class, 'trashed'])->middleware('can:users.view');
|
|
Route::get('/users/pending', [UserController::class, 'pending'])->middleware('can:users.view');
|
|
Route::post('/users', [UserController::class, 'store'])->middleware('can:users.create');
|
|
Route::put('/users/{user}', [UserController::class, 'update'])->middleware('can:users.update');
|
|
Route::delete('/users/{user}', [UserController::class, 'destroy'])->middleware('can:users.delete');
|
|
Route::post('/users/{id}/restore', [UserController::class, 'restore'])->middleware('can:users.update')->whereNumber('id');
|
|
Route::delete('/users/{id}/force', [UserController::class, 'forceDelete'])->middleware('can:users.delete')->whereNumber('id');
|
|
Route::post('/users/{user}/approve', [UserController::class, 'approve'])->middleware('can:users.update');
|
|
|
|
// Roles por app (multi-tenant): a qué app y con qué rol puede entrar cada usuario.
|
|
Route::get('/apps', [AppController::class, 'index'])->middleware('can:users.view');
|
|
Route::get('/users/{user}/app-roles', [UserController::class, 'appRoles'])->middleware('can:users.view');
|
|
Route::post('/users/{user}/app-roles', [UserController::class, 'assignAppRole'])->middleware('can:users.update');
|
|
Route::delete('/users/{user}/app-roles/{clientId}/{role}', [UserController::class, 'revokeAppRole'])->middleware('can:users.update');
|
|
|
|
// Sesiones (tokens OAuth activos) de un usuario — para incident response:
|
|
// ver qué apps/tokens tiene vigentes y cerrarlos remotamente.
|
|
Route::get('/users/{user}/sessions', [UserSessionController::class, 'index'])->middleware('can:users.view');
|
|
Route::delete('/users/{user}/sessions/{tokenId}', [UserSessionController::class, 'destroy'])->middleware('can:users.update');
|
|
Route::delete('/users/{user}/sessions', [UserSessionController::class, 'destroyAll'])->middleware('can:users.update');
|
|
|
|
// Analíticas de uso: sesiones, logins por app, actividad reciente.
|
|
Route::get('/analytics/summary', [AnalyticsController::class, 'summary'])->middleware('can:users.view');
|
|
|
|
// Audit log: altas/bajas de usuarios, cambios de rol y de clientes OAuth.
|
|
Route::get('/audit-log', [AuditLogController::class, 'index'])->middleware('can:audit.view');
|
|
});
|
|
});
|
|
});
|
|
|
|
// Laravel/Passport redirige a los invitados no autenticados a route('login'), así que
|
|
// necesita una ruta fija (no el wildcard de abajo, que exige un parámetro).
|
|
Route::view('/login', 'app')->name('login');
|
|
|
|
// Todo lo demás (home, register, dashboard, /oauth/authorize cuando hay sesión, etc.)
|
|
// lo resuelve el shell de la SPA Vue (Vue Router decide qué pantalla mostrar).
|
|
Route::view('/', 'app');
|
|
Route::get('/{any}', fn () => view('app'))
|
|
->where('any', '^(?!web-api|api|oauth|storage|login).*$');
|