40 lines
1.4 KiB
PHP
40 lines
1.4 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use App\Models\Customer;
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\Auth;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
/**
|
|
* Enforce customer account lifecycle on portal requests: a suspended or closed
|
|
* customer must lose access. Admins are exempt, and an active impersonation
|
|
* session is exempt so operators can still inspect a suspended customer's portal.
|
|
*/
|
|
class EnsureCustomerActive
|
|
{
|
|
public function handle(Request $request, Closure $next): Response
|
|
{
|
|
$user = $request->user();
|
|
|
|
if ($user !== null && ! $user->is_admin && ! $request->session()->has('impersonator_id')) {
|
|
$customer = Customer::query()->where('user_id', $user->id)->first()
|
|
?? Customer::query()->where('email', $user->email)->first();
|
|
|
|
if ($customer !== null && ($customer->status === 'suspended' || $customer->status === 'closed' || $customer->closed_at !== null)) {
|
|
Auth::logout();
|
|
$request->session()->invalidate();
|
|
$request->session()->regenerateToken();
|
|
|
|
$key = $customer->closed_at !== null || $customer->status === 'closed' ? 'auth.account_closed' : 'auth.account_suspended';
|
|
|
|
return redirect()->route('login')->withErrors(['email' => __($key)]);
|
|
}
|
|
}
|
|
|
|
return $next($request);
|
|
}
|
|
}
|