Josep Piguillem
c2b5291a74
Laravel-based OAuth/IAM service with Passport, Vue 3 frontend, and Docker Compose setup for local and production deployment. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
75 lines
4.3 KiB
PHP
75 lines
4.3 KiB
PHP
<?php
|
|
|
|
use App\Http\Controllers\Admin\AnalyticsController;
|
|
use App\Http\Controllers\Admin\AppController;
|
|
use App\Http\Controllers\Admin\UserController;
|
|
use App\Http\Controllers\Auth\AuthController;
|
|
use App\Http\Controllers\OAuth\AuthorizedAppController;
|
|
use App\Http\Controllers\OAuth\ClientController;
|
|
use App\Http\Controllers\OAuth\PersonalAccessTokenController;
|
|
use Illuminate\Support\Facades\Route;
|
|
use Laravel\Passport\Passport;
|
|
|
|
// Selector de idioma (es/en/ca), no requiere sesión.
|
|
Route::post('/web-api/locale', function () {
|
|
request()->validate(['locale' => 'required|in:es,en,ca']);
|
|
session(['locale' => request('locale')]);
|
|
|
|
return response()->noContent();
|
|
});
|
|
|
|
// Endpoints de sesión (guard "web") que consume la SPA para loguearse y
|
|
// administrar el servidor OAuth2 (clientes, personal access tokens, apps autorizadas).
|
|
Route::prefix('web-api')->group(function () {
|
|
Route::get('/setup-status', [AuthController::class, 'setupStatus']);
|
|
Route::post('/register', [AuthController::class, 'register']);
|
|
Route::post('/login', [AuthController::class, 'login']);
|
|
|
|
Route::middleware('auth')->group(function () {
|
|
Route::post('/logout', [AuthController::class, 'logout']);
|
|
Route::get('/me', [AuthController::class, 'me']);
|
|
Route::get('/scopes', fn () => response()->json(Passport::scopes()));
|
|
|
|
Route::apiResource('clients', ClientController::class)->except(['show']);
|
|
|
|
Route::get('/personal-access-tokens', [PersonalAccessTokenController::class, 'index']);
|
|
Route::post('/personal-access-tokens', [PersonalAccessTokenController::class, 'store']);
|
|
Route::delete('/personal-access-tokens/{tokenId}', [PersonalAccessTokenController::class, 'destroy']);
|
|
|
|
Route::get('/authorized-apps', [AuthorizedAppController::class, 'index']);
|
|
Route::delete('/authorized-apps/{tokenId}', [AuthorizedAppController::class, 'destroy']);
|
|
|
|
// Panel de administración de usuarios (solo para roles/permisos con "users.*").
|
|
Route::prefix('admin')->group(function () {
|
|
Route::get('/users', [UserController::class, 'index'])->middleware('can:users.view');
|
|
Route::get('/users/trashed', [UserController::class, 'trashed'])->middleware('can:users.view');
|
|
Route::get('/users/pending', [UserController::class, 'pending'])->middleware('can:users.view');
|
|
Route::post('/users', [UserController::class, 'store'])->middleware('can:users.create');
|
|
Route::put('/users/{user}', [UserController::class, 'update'])->middleware('can:users.update');
|
|
Route::delete('/users/{user}', [UserController::class, 'destroy'])->middleware('can:users.delete');
|
|
Route::post('/users/{id}/restore', [UserController::class, 'restore'])->middleware('can:users.update')->whereNumber('id');
|
|
Route::delete('/users/{id}/force', [UserController::class, 'forceDelete'])->middleware('can:users.delete')->whereNumber('id');
|
|
Route::post('/users/{user}/approve', [UserController::class, 'approve'])->middleware('can:users.update');
|
|
|
|
// Roles por app (multi-tenant): a qué app y con qué rol puede entrar cada usuario.
|
|
Route::get('/apps', [AppController::class, 'index'])->middleware('can:users.view');
|
|
Route::get('/users/{user}/app-roles', [UserController::class, 'appRoles'])->middleware('can:users.view');
|
|
Route::post('/users/{user}/app-roles', [UserController::class, 'assignAppRole'])->middleware('can:users.update');
|
|
Route::delete('/users/{user}/app-roles/{clientId}/{role}', [UserController::class, 'revokeAppRole'])->middleware('can:users.update');
|
|
|
|
// Analíticas de uso: sesiones, logins por app, actividad reciente.
|
|
Route::get('/analytics/summary', [AnalyticsController::class, 'summary'])->middleware('can:users.view');
|
|
});
|
|
});
|
|
});
|
|
|
|
// Laravel/Passport redirige a los invitados no autenticados a route('login'), así que
|
|
// necesita una ruta fija (no el wildcard de abajo, que exige un parámetro).
|
|
Route::view('/login', 'app')->name('login');
|
|
|
|
// Todo lo demás (home, register, dashboard, /oauth/authorize cuando hay sesión, etc.)
|
|
// lo resuelve el shell de la SPA Vue (Vue Router decide qué pantalla mostrar).
|
|
Route::view('/', 'app');
|
|
Route::get('/{any}', fn () => view('app'))
|
|
->where('any', '^(?!web-api|api|oauth|storage|login).*$');
|