135 lines
4.0 KiB
PHP
135 lines
4.0 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Support\Concerns;
|
|
|
|
use App\Models\Tenant;
|
|
use App\Support\WorkspaceIsolation\WorkspaceIsolationViolation;
|
|
use Illuminate\Database\Eloquent\Model;
|
|
|
|
/**
|
|
* Like DerivesWorkspaceIdFromTenant, but allows tenant_id to be null.
|
|
*
|
|
* When tenant_id IS present the trait enforces the same workspace-derivation
|
|
* and immutability rules as DerivesWorkspaceIdFromTenant.
|
|
* When tenant_id IS NULL the caller MUST supply workspace_id explicitly.
|
|
*/
|
|
trait DerivesWorkspaceIdFromTenantWhenPresent
|
|
{
|
|
public static function bootDerivesWorkspaceIdFromTenantWhenPresent(): void
|
|
{
|
|
static::creating(static function (Model $model): void {
|
|
self::enforceWorkspaceBindingOptional($model);
|
|
});
|
|
|
|
static::updating(static function (Model $model): void {
|
|
self::enforceWorkspaceBindingOptional($model);
|
|
});
|
|
}
|
|
|
|
private static function enforceWorkspaceBindingOptional(Model $model): void
|
|
{
|
|
$tenantId = $model->getAttribute('tenant_id');
|
|
|
|
if ($tenantId === null || $tenantId === '') {
|
|
self::requireExplicitWorkspaceId($model);
|
|
|
|
return;
|
|
}
|
|
|
|
if (! is_numeric($tenantId)) {
|
|
throw WorkspaceIsolationViolation::missingTenantId(class_basename($model));
|
|
}
|
|
|
|
$tenantId = (int) $tenantId;
|
|
|
|
self::ensureTenantIdIsImmutableOptional($model, $tenantId);
|
|
|
|
$tenantWorkspaceId = self::resolveTenantWorkspaceIdOptional($model, $tenantId);
|
|
|
|
$workspaceId = $model->getAttribute('workspace_id');
|
|
|
|
if ($workspaceId === null || $workspaceId === '') {
|
|
$model->setAttribute('workspace_id', $tenantWorkspaceId);
|
|
|
|
return;
|
|
}
|
|
|
|
if (! is_numeric($workspaceId)) {
|
|
throw WorkspaceIsolationViolation::workspaceMismatch(
|
|
class_basename($model),
|
|
$tenantId,
|
|
$tenantWorkspaceId,
|
|
0,
|
|
);
|
|
}
|
|
|
|
$workspaceId = (int) $workspaceId;
|
|
|
|
if ($workspaceId !== $tenantWorkspaceId) {
|
|
throw WorkspaceIsolationViolation::workspaceMismatch(
|
|
class_basename($model),
|
|
$tenantId,
|
|
$tenantWorkspaceId,
|
|
$workspaceId,
|
|
);
|
|
}
|
|
}
|
|
|
|
private static function requireExplicitWorkspaceId(Model $model): void
|
|
{
|
|
$workspaceId = $model->getAttribute('workspace_id');
|
|
|
|
if (! is_numeric($workspaceId) || (int) $workspaceId <= 0) {
|
|
throw WorkspaceIsolationViolation::missingTenantId(
|
|
class_basename($model).' (tenantless record requires explicit workspace_id)',
|
|
);
|
|
}
|
|
}
|
|
|
|
private static function ensureTenantIdIsImmutableOptional(Model $model, int $tenantId): void
|
|
{
|
|
if (! $model->exists || ! $model->isDirty('tenant_id')) {
|
|
return;
|
|
}
|
|
|
|
$originalTenantId = $model->getOriginal('tenant_id');
|
|
|
|
if (! is_numeric($originalTenantId)) {
|
|
return;
|
|
}
|
|
|
|
$originalTenantId = (int) $originalTenantId;
|
|
|
|
if ($originalTenantId === $tenantId) {
|
|
return;
|
|
}
|
|
|
|
throw WorkspaceIsolationViolation::tenantImmutable(
|
|
class_basename($model),
|
|
$originalTenantId,
|
|
$tenantId,
|
|
);
|
|
}
|
|
|
|
private static function resolveTenantWorkspaceIdOptional(Model $model, int $tenantId): int
|
|
{
|
|
$tenant = $model->relationLoaded('tenant') ? $model->getRelation('tenant') : null;
|
|
|
|
if (! $tenant instanceof Tenant || (int) $tenant->getKey() !== $tenantId) {
|
|
$tenant = Tenant::query()->find($tenantId);
|
|
}
|
|
|
|
if (! $tenant instanceof Tenant) {
|
|
throw WorkspaceIsolationViolation::tenantNotFound(class_basename($model), $tenantId);
|
|
}
|
|
|
|
if (! is_numeric($tenant->workspace_id)) {
|
|
throw WorkspaceIsolationViolation::tenantWorkspaceMissing(class_basename($model), $tenantId);
|
|
}
|
|
|
|
return (int) $tenant->workspace_id;
|
|
}
|
|
}
|