Proje dosyaları eklendi

2026-08-29 15:53:53 +03:00
commit d3313400ca
440 changed files with 24827 additions and 0 deletions
@@ -0,0 +1,118 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Enums\EarnApiTokenStatus;
+use App\Models\EarnApiToken;
+use App\Models\EarnMember;
+use App\Services\EarnApiAccessLogger;
+use App\Services\EarnDeviceIdentity;
+use Closure;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\RateLimiter;
+use Symfony\Component\HttpFoundation\Response;
+
+class AuthenticateEarnApiToken
+{
+    public function __construct(private EarnDeviceIdentity $devices, private EarnApiAccessLogger $logs) {}
+
+    /**
+     * Earn token yaşam döngüsünü, yeteneğini, cihaz bağını ve moda özel hız sınırını doğrular.
+     *
+     * @author Gökhan Engin - İletişim : https://bit.ly/YazılımUzmanı
+     */
+    public function handle(Request $request, Closure $next, string $ability, string $mode = 'tasks'): Response
+    {
+        $plain = $request->bearerToken();
+        if (! is_string($plain) || $plain === '') {
+            return $this->deny($request, 'TOKEN_MISSING', 401);
+        }
+        $token = EarnApiToken::findToken($plain);
+        if (! $token instanceof EarnApiToken || ! $token->tokenable instanceof EarnMember) {
+            return $this->deny($request, 'TOKEN_INVALID', 401);
+        }
+        $request->attributes->set('earn_api_token', $token);
+        $code = match ($token->status()) {
+            EarnApiTokenStatus::Inactive => 'TOKEN_INACTIVE', EarnApiTokenStatus::Expired => 'TOKEN_EXPIRED',
+            EarnApiTokenStatus::Revoked => 'TOKEN_REVOKED', default => null,
+        };
+        if ($code) {
+            return $this->deny($request, $code, 401, 'token_'.strtolower(substr($code, 6)));
+        }
+        $member = $token->tokenable;
+        if ($member->trashed() || $member->status->value !== 'active') {
+            return $this->deny($request, 'MEMBER_INACTIVE', 403, 'member_inactive');
+        }
+        if (! $member->hasVerifiedEmail()) {
+            return $this->deny($request, 'EMAIL_NOT_VERIFIED', 403);
+        }
+        if (! $token->can($ability)) {
+            return $this->deny($request, 'TOKEN_INVALID', 401);
+        }
+        $deviceId = $request->header('X-Device-ID');
+        if (! is_string($deviceId)) {
+            return $this->deny($request, 'DEVICE_ID_MISSING', 422);
+        }
+        $deviceId = $this->devices->normalize($deviceId);
+        if (! $this->devices->valid($deviceId)) {
+            return $this->deny($request, 'DEVICE_ID_INVALID', 422);
+        }
+        $hash = $this->devices->hash($deviceId);
+        $preview = $this->devices->preview($deviceId);
+        $request->attributes->set('earn_device_hash', $hash);
+        $request->attributes->set('earn_device_preview', $preview);
+        $limit = (int) config(match ($mode) {
+            'bind' => 'earn.api.bind_per_minute',
+            'results' => 'earn.api.task_results_per_minute',
+            default => 'earn.api.tasks_per_minute',
+        });
+        $rateKey = 'earn-api:'.$mode.':'.hash('sha256', $token->id.'|'.$hash.'|'.$request->ip());
+        if (RateLimiter::tooManyAttempts($rateKey, $limit)) {
+            $this->logs->record($request, $mode === 'results' ? 'task_result_rate_limited' : 'rate_limited', 429, 'RATE_LIMITED', $token, $hash, $preview);
+
+            return $this->error('RATE_LIMITED', 429)->header('Retry-After', (string) RateLimiter::availableIn($rateKey));
+        }
+        RateLimiter::hit($rateKey, 60);
+        if (in_array($mode, ['tasks', 'results'], true) && $token->device_id_hash === null) {
+            return $this->deny($request, 'DEVICE_NOT_BOUND', 409, 'device_not_bound', $hash, $preview);
+        }
+        if (in_array($mode, ['tasks', 'results'], true) && ! hash_equals($token->device_id_hash, $hash)) {
+            $failedKey = 'earn-api:failed-device:'.hash('sha256', $token->id.'|'.$request->ip());
+            $failedLimit = (int) config('earn.api.failed_device_per_minute');
+            if (RateLimiter::tooManyAttempts($failedKey, $failedLimit)) {
+                $this->logs->record($request, 'rate_limited', 429, 'RATE_LIMITED', $token, $hash, $preview);
+
+                return $this->error('RATE_LIMITED', 429)->header('Retry-After', (string) RateLimiter::availableIn($failedKey));
+            }
+            RateLimiter::hit($failedKey, 60);
+            $token->forceFill(['device_mismatch_seen' => true])->saveQuietly();
+
+            return $this->deny($request, 'DEVICE_MISMATCH', 409, 'device_mismatch', $hash, $preview);
+        }
+        $member->withAccessToken($token);
+        $request->setUserResolver(fn () => $member);
+        $response = $next($request);
+        if (in_array($mode, ['tasks', 'results'], true) && $response->isSuccessful()) {
+            if ($token->last_ip !== null && $token->last_ip !== $request->ip()) {
+                $this->logs->record($request, 'ip_changed', $response->getStatusCode(), null, $token, $hash, $preview);
+            }
+            $token->forceFill(['last_used_at' => now(), 'last_seen_at' => now(), 'last_ip' => $request->ip()])->saveQuietly();
+            $this->logs->record($request, $mode === 'results' ? 'task_results_access_granted' : 'tasks_access_granted', $response->getStatusCode(), null, $token, $hash, $preview);
+        }
+
+        return $response;
+    }
+
+    private function deny(Request $request, string $code, int $status, string $event = 'tasks_access_denied', ?string $hash = null, ?string $preview = null): JsonResponse
+    {
+        $this->logs->record($request, $event, $status, $code, null, $hash, $preview);
+
+        return $this->error($code, $status);
+    }
+
+    private function error(string $code, int $status): JsonResponse
+    {
+        return response()->json(['success' => false, 'error' => ['code' => $code, 'message' => __('earn_api.'.$code)]], $status)->header('Cache-Control', 'no-store');
+    }
+}