tiago/Condominio_SeConectai
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Permite api key nos endpoints da empresa

Browse Source
This commit is contained in:
Tiago
2026-10-06 16:14:42 -03:00
parent e0b76c16a7
commit 0952eeb33c
2 changed files with 21 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/seconectai/condocontab/Main.java
-1
View File
@@ -84,7 +84,6 @@ public final class Main {
router.post("/api/integracao/mensagens", authMiddleware.exigirApiKey(externalBridgeHandler)); router.post("/api/integracao/mensagens", authMiddleware.exigirApiKey(externalBridgeHandler));
router.prefix("/api/master/", authMiddleware.exigirMaster(masterHandlers)); router.prefix("/api/master/", authMiddleware.exigirMaster(masterHandlers));
router.prefix("/api/financeiro/", authMiddleware.exigirFuncionario(financeiroHandlers)); router.prefix("/api/financeiro/", authMiddleware.exigirFuncionario(financeiroHandlers));
router.get("/api/condominios", authMiddleware.exigirFuncionarioOuApiKeyLeitura(clienteHandlers));
router.prefix("/api/", authMiddleware.exigirFuncionario(clienteHandlers)); router.prefix("/api/", authMiddleware.exigirFuncionario(clienteHandlers));
router.fallback(new StaticFileHandler()); router.fallback(new StaticFileHandler());
src/main/java/com/seconectai/condocontab/auth/http/AuthMiddleware.java
+19 -35
View File
@@ -38,14 +38,28 @@ public final class AuthMiddleware {
public HttpHandler exigirFuncionario(HttpHandler next) { public HttpHandler exigirFuncionario(HttpHandler next) {
return exchange -> { return exchange -> {
var claims = bearerClaims(exchange); var claims = bearerClaims(exchange);
if (claims == null || !"empresa".equals(claims.get("escopo"))) { Long empresaId = null;
if (claims != null && "empresa".equals(claims.get("escopo"))) {
empresaId = toLong(claims.get("empresa_id"));
exchange.setAttribute(ATTR_EMPRESA_ID, empresaId);
exchange.setAttribute(ATTR_FUNCIONARIO_ID, toLong(claims.get("funcionario_id")));
exchange.setAttribute(ATTR_CARGO, String.valueOf(claims.getOrDefault("cargo", "")));
} else {
try {
var apiEmpresaId = apiKeyService.validar(apiKeyHeader(exchange));
if (apiEmpresaId.isEmpty()) {
HttpResponses.json(exchange, 401, Map.of("erro", "nao_autorizado")); HttpResponses.json(exchange, 401, Map.of("erro", "nao_autorizado"));
return; return;
} }
exchange.setAttribute(ATTR_EMPRESA_ID, toLong(claims.get("empresa_id"))); empresaId = apiEmpresaId.getAsLong();
exchange.setAttribute(ATTR_FUNCIONARIO_ID, toLong(claims.get("funcionario_id"))); exchange.setAttribute(ATTR_EMPRESA_ID, empresaId);
exchange.setAttribute(ATTR_CARGO, String.valueOf(claims.getOrDefault("cargo", ""))); exchange.setAttribute(ATTR_FUNCIONARIO_ID, 0L);
Long empresaId = toLong(claims.get("empresa_id")); exchange.setAttribute(ATTR_CARGO, "admin_empresa");
} catch (SQLException e) {
HttpResponses.json(exchange, 500, Map.of("erro", "erro_validacao_api_key"));
return;
}
}
if (empresaBloqueada(empresaId) && !exchange.getRequestURI().getPath().startsWith("/api/financeiro/")) { if (empresaBloqueada(empresaId) && !exchange.getRequestURI().getPath().startsWith("/api/financeiro/")) {
HttpResponses.json(exchange, 403, Map.of("erro", "pendencia_financeira", "mensagem", "Seu acesso esta bloqueado por pendencia de pagamento.")); HttpResponses.json(exchange, 403, Map.of("erro", "pendencia_financeira", "mensagem", "Seu acesso esta bloqueado por pendencia de pagamento."));
return; return;
@@ -54,36 +68,6 @@ public final class AuthMiddleware {
}; };
} }
public HttpHandler exigirFuncionarioOuApiKeyLeitura(HttpHandler next) {
return exchange -> {
var claims = bearerClaims(exchange);
if (claims != null && "empresa".equals(claims.get("escopo"))) {
exchange.setAttribute(ATTR_EMPRESA_ID, toLong(claims.get("empresa_id")));
exchange.setAttribute(ATTR_FUNCIONARIO_ID, toLong(claims.get("funcionario_id")));
exchange.setAttribute(ATTR_CARGO, String.valueOf(claims.getOrDefault("cargo", "")));
next.handle(exchange);
return;
}
if (!"GET".equals(exchange.getRequestMethod())) {
HttpResponses.json(exchange, 401, Map.of("erro", "nao_autorizado"));
return;
}
try {
var empresaId = apiKeyService.validar(apiKeyHeader(exchange));
if (empresaId.isEmpty()) {
HttpResponses.json(exchange, 401, Map.of("erro", "api_key_invalida"));
return;
}
exchange.setAttribute(ATTR_EMPRESA_ID, empresaId.getAsLong());
exchange.setAttribute(ATTR_FUNCIONARIO_ID, 0L);
exchange.setAttribute(ATTR_CARGO, "admin_empresa");
next.handle(exchange);
} catch (SQLException e) {
HttpResponses.json(exchange, 500, Map.of("erro", "erro_validacao_api_key"));
}
};
}
public HttpHandler exigirApiKey(HttpHandler next) { public HttpHandler exigirApiKey(HttpHandler next) {
return exchange -> { return exchange -> {
String chave = apiKeyHeader(exchange); String chave = apiKeyHeader(exchange);