tiago/Condominio_SeConectai
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Libera listagem de condominios por api key

Browse Source
This commit is contained in:
Tiago
2026-10-06 16:08:08 -03:00
parent 4a7066296e
commit e0b76c16a7
2 changed files with 40 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/seconectai/condocontab/Main.java
+1
View File
@@ -84,6 +84,7 @@ public final class Main {
router.post("/api/integracao/mensagens", authMiddleware.exigirApiKey(externalBridgeHandler)); router.post("/api/integracao/mensagens", authMiddleware.exigirApiKey(externalBridgeHandler));
router.prefix("/api/master/", authMiddleware.exigirMaster(masterHandlers)); router.prefix("/api/master/", authMiddleware.exigirMaster(masterHandlers));
router.prefix("/api/financeiro/", authMiddleware.exigirFuncionario(financeiroHandlers)); router.prefix("/api/financeiro/", authMiddleware.exigirFuncionario(financeiroHandlers));
router.get("/api/condominios", authMiddleware.exigirFuncionarioOuApiKeyLeitura(clienteHandlers));
router.prefix("/api/", authMiddleware.exigirFuncionario(clienteHandlers)); router.prefix("/api/", authMiddleware.exigirFuncionario(clienteHandlers));
router.fallback(new StaticFileHandler()); router.fallback(new StaticFileHandler());
src/main/java/com/seconectai/condocontab/auth/http/AuthMiddleware.java
+39 -1
View File
@@ -54,9 +54,39 @@ public final class AuthMiddleware {
}; };
} }
public HttpHandler exigirFuncionarioOuApiKeyLeitura(HttpHandler next) {
return exchange -> {
var claims = bearerClaims(exchange);
if (claims != null && "empresa".equals(claims.get("escopo"))) {
exchange.setAttribute(ATTR_EMPRESA_ID, toLong(claims.get("empresa_id")));
exchange.setAttribute(ATTR_FUNCIONARIO_ID, toLong(claims.get("funcionario_id")));
exchange.setAttribute(ATTR_CARGO, String.valueOf(claims.getOrDefault("cargo", "")));
next.handle(exchange);
return;
}
if (!"GET".equals(exchange.getRequestMethod())) {
HttpResponses.json(exchange, 401, Map.of("erro", "nao_autorizado"));
return;
}
try {
var empresaId = apiKeyService.validar(apiKeyHeader(exchange));
if (empresaId.isEmpty()) {
HttpResponses.json(exchange, 401, Map.of("erro", "api_key_invalida"));
return;
}
exchange.setAttribute(ATTR_EMPRESA_ID, empresaId.getAsLong());
exchange.setAttribute(ATTR_FUNCIONARIO_ID, 0L);
exchange.setAttribute(ATTR_CARGO, "admin_empresa");
next.handle(exchange);
} catch (SQLException e) {
HttpResponses.json(exchange, 500, Map.of("erro", "erro_validacao_api_key"));
}
};
}
public HttpHandler exigirApiKey(HttpHandler next) { public HttpHandler exigirApiKey(HttpHandler next) {
return exchange -> { return exchange -> {
String chave = exchange.getRequestHeaders().getFirst("X-API-Key"); String chave = apiKeyHeader(exchange);
try { try {
var empresaId = apiKeyService.validar(chave); var empresaId = apiKeyService.validar(chave);
if (empresaId.isEmpty()) { if (empresaId.isEmpty()) {
@@ -71,6 +101,14 @@ public final class AuthMiddleware {
}; };
} }
private String apiKeyHeader(HttpExchange exchange) {
String chave = exchange.getRequestHeaders().getFirst("X-API-Key");
if (chave != null && !chave.isBlank()) return chave.trim();
String auth = exchange.getRequestHeaders().getFirst("Authorization");
if (auth != null && auth.startsWith("Bearer ")) return auth.substring("Bearer ".length()).trim();
return chave;
}
private Map<String, Object> bearerClaims(HttpExchange exchange) throws IOException { private Map<String, Object> bearerClaims(HttpExchange exchange) throws IOException {
String auth = exchange.getRequestHeaders().getFirst("Authorization"); String auth = exchange.getRequestHeaders().getFirst("Authorization");
if (auth == null || !auth.startsWith("Bearer ")) { if (auth == null || !auth.startsWith("Bearer ")) {