tiago/Condominio_SeConectai
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Permite api key nos endpoints da empresa

Browse Source
This commit is contained in:
Tiago
2026-10-06 16:14:42 -03:00
parent e0b76c16a7
commit 0952eeb33c
2 changed files with 21 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/seconectai/condocontab/Main.java
-1
View File
@@ -84,7 +84,6 @@ public final class Main {
router.post("/api/integracao/mensagens", authMiddleware.exigirApiKey(externalBridgeHandler));
router.prefix("/api/master/", authMiddleware.exigirMaster(masterHandlers));
router.prefix("/api/financeiro/", authMiddleware.exigirFuncionario(financeiroHandlers));
router.get("/api/condominios", authMiddleware.exigirFuncionarioOuApiKeyLeitura(clienteHandlers));
router.prefix("/api/", authMiddleware.exigirFuncionario(clienteHandlers));
router.fallback(new StaticFileHandler());
src/main/java/com/seconectai/condocontab/auth/http/AuthMiddleware.java
+21 -37
View File
@@ -38,14 +38,28 @@ public final class AuthMiddleware {
public HttpHandler exigirFuncionario(HttpHandler next) {
return exchange -> {
var claims = bearerClaims(exchange);
if (claims == null || !"empresa".equals(claims.get("escopo"))) {
HttpResponses.json(exchange, 401, Map.of("erro", "nao_autorizado"));
return;
Long empresaId = null;
if (claims != null && "empresa".equals(claims.get("escopo"))) {
empresaId = toLong(claims.get("empresa_id"));
exchange.setAttribute(ATTR_EMPRESA_ID, empresaId);
exchange.setAttribute(ATTR_FUNCIONARIO_ID, toLong(claims.get("funcionario_id")));
exchange.setAttribute(ATTR_CARGO, String.valueOf(claims.getOrDefault("cargo", "")));
} else {
try {
var apiEmpresaId = apiKeyService.validar(apiKeyHeader(exchange));
if (apiEmpresaId.isEmpty()) {
HttpResponses.json(exchange, 401, Map.of("erro", "nao_autorizado"));
return;
}
empresaId = apiEmpresaId.getAsLong();
exchange.setAttribute(ATTR_EMPRESA_ID, empresaId);
exchange.setAttribute(ATTR_FUNCIONARIO_ID, 0L);
exchange.setAttribute(ATTR_CARGO, "admin_empresa");
} catch (SQLException e) {
HttpResponses.json(exchange, 500, Map.of("erro", "erro_validacao_api_key"));
return;
}
}
exchange.setAttribute(ATTR_EMPRESA_ID, toLong(claims.get("empresa_id")));
exchange.setAttribute(ATTR_FUNCIONARIO_ID, toLong(claims.get("funcionario_id")));
exchange.setAttribute(ATTR_CARGO, String.valueOf(claims.getOrDefault("cargo", "")));
Long empresaId = toLong(claims.get("empresa_id"));
if (empresaBloqueada(empresaId) && !exchange.getRequestURI().getPath().startsWith("/api/financeiro/")) {
HttpResponses.json(exchange, 403, Map.of("erro", "pendencia_financeira", "mensagem", "Seu acesso esta bloqueado por pendencia de pagamento."));
return;
@@ -54,36 +68,6 @@ public final class AuthMiddleware {
};
}
public HttpHandler exigirFuncionarioOuApiKeyLeitura(HttpHandler next) {
return exchange -> {
var claims = bearerClaims(exchange);
if (claims != null && "empresa".equals(claims.get("escopo"))) {
exchange.setAttribute(ATTR_EMPRESA_ID, toLong(claims.get("empresa_id")));
exchange.setAttribute(ATTR_FUNCIONARIO_ID, toLong(claims.get("funcionario_id")));
exchange.setAttribute(ATTR_CARGO, String.valueOf(claims.getOrDefault("cargo", "")));
next.handle(exchange);
return;
}
if (!"GET".equals(exchange.getRequestMethod())) {
HttpResponses.json(exchange, 401, Map.of("erro", "nao_autorizado"));
return;
}
try {
var empresaId = apiKeyService.validar(apiKeyHeader(exchange));
if (empresaId.isEmpty()) {
HttpResponses.json(exchange, 401, Map.of("erro", "api_key_invalida"));
return;
}
exchange.setAttribute(ATTR_EMPRESA_ID, empresaId.getAsLong());
exchange.setAttribute(ATTR_FUNCIONARIO_ID, 0L);
exchange.setAttribute(ATTR_CARGO, "admin_empresa");
next.handle(exchange);
} catch (SQLException e) {
HttpResponses.json(exchange, 500, Map.of("erro", "erro_validacao_api_key"));
}
};
}
public HttpHandler exigirApiKey(HttpHandler next) {
return exchange -> {
String chave = apiKeyHeader(exchange);