116 lines
3.2 KiB
PHP
116 lines
3.2 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Support\Concerns;
|
|
|
|
use App\Models\Tenant;
|
|
use App\Support\WorkspaceIsolation\WorkspaceIsolationViolation;
|
|
use Illuminate\Database\Eloquent\Model;
|
|
|
|
trait DerivesWorkspaceIdFromTenant
|
|
{
|
|
public static function bootDerivesWorkspaceIdFromTenant(): void
|
|
{
|
|
static::creating(static function (Model $model): void {
|
|
self::enforceWorkspaceBinding($model);
|
|
});
|
|
|
|
static::updating(static function (Model $model): void {
|
|
self::enforceWorkspaceBinding($model);
|
|
});
|
|
}
|
|
|
|
private static function enforceWorkspaceBinding(Model $model): void
|
|
{
|
|
$tenantId = self::resolveTenantId($model);
|
|
|
|
self::ensureTenantIdIsImmutable($model, $tenantId);
|
|
|
|
$tenantWorkspaceId = self::resolveTenantWorkspaceId($model, $tenantId);
|
|
|
|
$workspaceId = $model->getAttribute('workspace_id');
|
|
|
|
if ($workspaceId === null || $workspaceId === '') {
|
|
$model->setAttribute('workspace_id', $tenantWorkspaceId);
|
|
|
|
return;
|
|
}
|
|
|
|
if (! is_numeric($workspaceId)) {
|
|
throw WorkspaceIsolationViolation::workspaceMismatch(
|
|
class_basename($model),
|
|
$tenantId,
|
|
$tenantWorkspaceId,
|
|
0,
|
|
);
|
|
}
|
|
|
|
$workspaceId = (int) $workspaceId;
|
|
|
|
if ($workspaceId !== $tenantWorkspaceId) {
|
|
throw WorkspaceIsolationViolation::workspaceMismatch(
|
|
class_basename($model),
|
|
$tenantId,
|
|
$tenantWorkspaceId,
|
|
$workspaceId,
|
|
);
|
|
}
|
|
}
|
|
|
|
private static function resolveTenantId(Model $model): int
|
|
{
|
|
$tenantId = $model->getAttribute('tenant_id');
|
|
|
|
if (! is_numeric($tenantId)) {
|
|
throw WorkspaceIsolationViolation::missingTenantId(class_basename($model));
|
|
}
|
|
|
|
return (int) $tenantId;
|
|
}
|
|
|
|
private static function ensureTenantIdIsImmutable(Model $model, int $tenantId): void
|
|
{
|
|
if (! $model->exists || ! $model->isDirty('tenant_id')) {
|
|
return;
|
|
}
|
|
|
|
$originalTenantId = $model->getOriginal('tenant_id');
|
|
|
|
if (! is_numeric($originalTenantId)) {
|
|
return;
|
|
}
|
|
|
|
$originalTenantId = (int) $originalTenantId;
|
|
|
|
if ($originalTenantId === $tenantId) {
|
|
return;
|
|
}
|
|
|
|
throw WorkspaceIsolationViolation::tenantImmutable(
|
|
class_basename($model),
|
|
$originalTenantId,
|
|
$tenantId,
|
|
);
|
|
}
|
|
|
|
private static function resolveTenantWorkspaceId(Model $model, int $tenantId): int
|
|
{
|
|
$tenant = $model->relationLoaded('tenant') ? $model->getRelation('tenant') : null;
|
|
|
|
if (! $tenant instanceof Tenant || (int) $tenant->getKey() !== $tenantId) {
|
|
$tenant = Tenant::query()->find($tenantId);
|
|
}
|
|
|
|
if (! $tenant instanceof Tenant) {
|
|
throw WorkspaceIsolationViolation::tenantNotFound(class_basename($model), $tenantId);
|
|
}
|
|
|
|
if (! is_numeric($tenant->workspace_id)) {
|
|
throw WorkspaceIsolationViolation::tenantWorkspaceMissing(class_basename($model), $tenantId);
|
|
}
|
|
|
|
return (int) $tenant->workspace_id;
|
|
}
|
|
}
|