From 0952eeb33ccaec63e3bb757d4835cabb0efd711b Mon Sep 17 00:00:00 2001
From: Tiago <tiago@seconectai.com.br>
Date: Tue, 6 Oct 2026 16:14:42 -0300
Subject: [PATCH] Permite api key nos endpoints da empresa

---
 .../java/com/seconectai/condocontab/Main.java |  1 -
 .../condocontab/auth/http/AuthMiddleware.java | 58 +++++++------------
 2 files changed, 21 insertions(+), 38 deletions(-)

diff --git a/src/main/java/com/seconectai/condocontab/Main.java b/src/main/java/com/seconectai/condocontab/Main.java
index f8d4f76..2eb7911 100644
--- a/src/main/java/com/seconectai/condocontab/Main.java
+++ b/src/main/java/com/seconectai/condocontab/Main.java
@@ -84,7 +84,6 @@ public final class Main {
             router.post("/api/integracao/mensagens", authMiddleware.exigirApiKey(externalBridgeHandler));
             router.prefix("/api/master/", authMiddleware.exigirMaster(masterHandlers));
             router.prefix("/api/financeiro/", authMiddleware.exigirFuncionario(financeiroHandlers));
-            router.get("/api/condominios", authMiddleware.exigirFuncionarioOuApiKeyLeitura(clienteHandlers));
             router.prefix("/api/", authMiddleware.exigirFuncionario(clienteHandlers));
             router.fallback(new StaticFileHandler());
 
diff --git a/src/main/java/com/seconectai/condocontab/auth/http/AuthMiddleware.java b/src/main/java/com/seconectai/condocontab/auth/http/AuthMiddleware.java
index 8451f26..f7919a5 100644
--- a/src/main/java/com/seconectai/condocontab/auth/http/AuthMiddleware.java
+++ b/src/main/java/com/seconectai/condocontab/auth/http/AuthMiddleware.java
@@ -38,14 +38,28 @@ public final class AuthMiddleware {
     public HttpHandler exigirFuncionario(HttpHandler next) {
         return exchange -> {
             var claims = bearerClaims(exchange);
-            if (claims == null || !"empresa".equals(claims.get("escopo"))) {
-                HttpResponses.json(exchange, 401, Map.of("erro", "nao_autorizado"));
-                return;
+            Long empresaId = null;
+            if (claims != null && "empresa".equals(claims.get("escopo"))) {
+                empresaId = toLong(claims.get("empresa_id"));
+                exchange.setAttribute(ATTR_EMPRESA_ID, empresaId);
+                exchange.setAttribute(ATTR_FUNCIONARIO_ID, toLong(claims.get("funcionario_id")));
+                exchange.setAttribute(ATTR_CARGO, String.valueOf(claims.getOrDefault("cargo", "")));
+            } else {
+                try {
+                    var apiEmpresaId = apiKeyService.validar(apiKeyHeader(exchange));
+                    if (apiEmpresaId.isEmpty()) {
+                        HttpResponses.json(exchange, 401, Map.of("erro", "nao_autorizado"));
+                        return;
+                    }
+                    empresaId = apiEmpresaId.getAsLong();
+                    exchange.setAttribute(ATTR_EMPRESA_ID, empresaId);
+                    exchange.setAttribute(ATTR_FUNCIONARIO_ID, 0L);
+                    exchange.setAttribute(ATTR_CARGO, "admin_empresa");
+                } catch (SQLException e) {
+                    HttpResponses.json(exchange, 500, Map.of("erro", "erro_validacao_api_key"));
+                    return;
+                }
             }
-            exchange.setAttribute(ATTR_EMPRESA_ID, toLong(claims.get("empresa_id")));
-            exchange.setAttribute(ATTR_FUNCIONARIO_ID, toLong(claims.get("funcionario_id")));
-            exchange.setAttribute(ATTR_CARGO, String.valueOf(claims.getOrDefault("cargo", "")));
-            Long empresaId = toLong(claims.get("empresa_id"));
             if (empresaBloqueada(empresaId) && !exchange.getRequestURI().getPath().startsWith("/api/financeiro/")) {
                 HttpResponses.json(exchange, 403, Map.of("erro", "pendencia_financeira", "mensagem", "Seu acesso esta bloqueado por pendencia de pagamento."));
                 return;
@@ -54,36 +68,6 @@ public final class AuthMiddleware {
         };
     }
 
-    public HttpHandler exigirFuncionarioOuApiKeyLeitura(HttpHandler next) {
-        return exchange -> {
-            var claims = bearerClaims(exchange);
-            if (claims != null && "empresa".equals(claims.get("escopo"))) {
-                exchange.setAttribute(ATTR_EMPRESA_ID, toLong(claims.get("empresa_id")));
-                exchange.setAttribute(ATTR_FUNCIONARIO_ID, toLong(claims.get("funcionario_id")));
-                exchange.setAttribute(ATTR_CARGO, String.valueOf(claims.getOrDefault("cargo", "")));
-                next.handle(exchange);
-                return;
-            }
-            if (!"GET".equals(exchange.getRequestMethod())) {
-                HttpResponses.json(exchange, 401, Map.of("erro", "nao_autorizado"));
-                return;
-            }
-            try {
-                var empresaId = apiKeyService.validar(apiKeyHeader(exchange));
-                if (empresaId.isEmpty()) {
-                    HttpResponses.json(exchange, 401, Map.of("erro", "api_key_invalida"));
-                    return;
-                }
-                exchange.setAttribute(ATTR_EMPRESA_ID, empresaId.getAsLong());
-                exchange.setAttribute(ATTR_FUNCIONARIO_ID, 0L);
-                exchange.setAttribute(ATTR_CARGO, "admin_empresa");
-                next.handle(exchange);
-            } catch (SQLException e) {
-                HttpResponses.json(exchange, 500, Map.of("erro", "erro_validacao_api_key"));
-            }
-        };
-    }
-
     public HttpHandler exigirApiKey(HttpHandler next) {
         return exchange -> {
             String chave = apiKeyHeader(exchange);