initial commit

app/Http/Middleware/ApiKeyMiddleware.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Illuminate\Support\Facades\DB;
+
+class ApiKeyMiddleware
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     */
+    public function handle(Request $request, Closure $next)
+    {
+        // TO be implemented in middleware
+        $apiKey = $request->header('X-API-Key'); 
+
+        if (!$apiKey || !DB::table('api_keys')->where('key', $apiKey)->exists()) {
+            return response()->json(['message' => 'Unauthorized'], 401);
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/Authenticate.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Helpers\ResponseJson;
+use Illuminate\Auth\Middleware\Authenticate as Middleware;
+use Illuminate\Http\Request;
+
+class Authenticate extends Middleware
+{
+    /**
+     * Get the path the user should be redirected to when they are not authenticated.
+     */
+    protected function redirectTo(Request $request): ?string
+    {
+        if ($request->expectsJson()) {
+            return ResponseJson::unauthorizeResponse('You are not logged in', []);
+        }
+
+        // return ResponseJson::failedResponse('Bad Request', []);
+    }
+}

app/Http/Middleware/CheckApiKey.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use App\Helpers\ResponseJson;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class CheckApiKey
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     */
+    public function handle(Request $request, Closure $next)
+    {
+        $apiKey = $request->header('X-API-Key');
+        
+        if (!$apiKey || $apiKey !== config('app.api_key')) {
+            return ResponseJson::unauthorizeResponse('Invalid API Key', []);
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/CheckCommentAuthorOrAdmin.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use App\Models\Comment;
+use App\Helpers\ResponseJson;
+
+class CheckCommentAuthorOrAdmin
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Closure  $next
+     * @return mixed
+     */
+    public function handle(Request $request, Closure $next)
+    {
+        $user = $request->user();
+        $commentId = $request->route('commentId');
+        $comment = Comment::find($commentId);
+
+        if (!$comment) {
+            return ResponseJson::pageNotFoundResponse('Comment not found', []);
+        }
+
+        if ($comment->user_id !== $user->id && $user->role !== 'admin') {
+            return ResponseJson::forbidenResponse('Unauthorized to edit or delete this comment.', []);
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/CheckDiseaseAccess.php

@@ -0,0 +1,30 @@
+<?php
+
+// app/Http/Middleware/CheckDiseaseAccess.php
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use App\Helpers\ResponseJson;
+
+class CheckDiseaseAccess
+{
+    public function handle(Request $request, Closure $next)
+    {
+        $user = $request->user();
+        
+        if (!$user) {
+            return ResponseJson::unauthorizeResponse('Unauthorized Access', []);
+        }
+
+        if (in_array($user->role, ['operator', 'admin'])) {
+            return $next($request);
+        }
+
+        if (($user->role === 'peneliti') && $user->approval_status === 'approved') {
+            return $next($request);
+        }
+
+        return ResponseJson::forbidenResponse('User is not approved', []);
+    }
+}

app/Http/Middleware/CheckRole.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Illuminate\Support\Facades\Auth;
+
+class CheckRole
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     */
+    public function handle(Request $request, Closure $next, ...$roles): Response
+    {
+        if (!in_array(Auth::user()->role, $roles)) {
+            return response()->json([
+                'success' => false,
+                'message' => 'Forbidden',
+                'data' => []
+            ], 403);
+        }
+        return $next($request);
+    }
+}

app/Http/Middleware/EncryptCookies.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Cookie\Middleware\EncryptCookies as Middleware;
+
+class EncryptCookies extends Middleware
+{
+    /**
+     * The names of the cookies that should not be encrypted.
+     *
+     * @var array<int, string>
+     */
+    protected $except = [
+        //
+    ];
+}

app/Http/Middleware/EnsureAcceptJson.php

@@ -0,0 +1,59 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+use Illuminate\Http\JsonResponse;
+
+use Symfony\Component\HttpFoundation\BinaryFileResponse;
+use Symfony\Component\HttpFoundation\StreamedResponse;
+
+class EnsureAcceptJson
+{
+    public function handle(Request $request, Closure $next)
+    {
+        // Allow multipart/form-data for POST and PUT
+        if (($request->isMethod('post') || $request->isMethod('put')) && 
+            $request->hasHeader('Content-Type', 'multipart/form-data')) {
+            return $next($request);
+        }
+
+        // Allow file downloads to pass through
+        if ($request->route() && strpos($request->route()->getName(), 'download') !== false) {
+            return $next($request);
+        }
+
+        // Set Accept header to JSON for other requests
+        $request->headers->set('Accept', 'application/json');
+        
+        $response = $next($request);
+
+        // Only transform non-file responses
+        if (!$response instanceof BinaryFileResponse && 
+            !$response instanceof StreamedResponse) {
+            if (!$response instanceof JsonResponse) {
+                if ($response instanceof Response) {
+                    $content = $response->getContent();
+
+                    $decoded = json_decode($content);
+                    if (json_last_error() === JSON_ERROR_NONE) {
+                        $data = $decoded;
+                    } else {
+                        $data = ['message' => $content];
+                    }
+
+                    $response = response()->json(
+                        $data,
+                        $response->status()
+                    );
+                }
+            }
+            
+            $response->header('Content-Type', 'application/json');
+        }
+        
+        return $response;
+    }
+}

app/Http/Middleware/EnsureOperatorManagesDisease.php

@@ -0,0 +1,56 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Helpers\ResponseJson;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use App\Models\User;
+use Illuminate\Http\JsonResponse;
+
+class EnsureOperatorManagesDisease
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Closure  $next
+     * @param  string  $diseaseParam
+     * @return mixed
+     */
+    public function handle(Request $request, Closure $next)
+    {
+        $userId = auth()->id();
+
+        $user = User::findOrFail($userId);
+        // echo($user);
+        // Ensure user is authenticated
+        if (!$user) {
+            return ResponseJson::unauthorizeResponse('Unauthorized', []);
+        }
+
+        // Allow admins to bypass the check
+        if ($user->role === 'admin') {
+            return $next($request);
+        }
+
+        // Check if the user is an operator and manages the specified disease
+
+        $diseaseId = $request->route('diseaseId');
+        // echo($diseaseId);
+
+        $managesDisease = $user->managed_diseases['disease_id'];
+        // echo($managesDisease);
+        // echo($managesDisease === $diseaseId);
+        if ($user->role === 'operator') {
+            if ($managesDisease != $diseaseId) {
+                return ResponseJson::forbidenResponse('Access denied: Unauthorized to manage this disease', []);
+            }
+
+            return $next($request);
+        }
+
+        return ResponseJson::forbidenResponse('Access denied', []);
+    }
+}

app/Http/Middleware/EnsureUserIsApproved.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureUserIsApproved
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        if ($request->user() && $request->user()->approval_status !== 'approved') {
+            return response()->json(['message' => 'Your account is not approved yet.'], 403);
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/PreventRequestsDuringMaintenance.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Foundation\Http\Middleware\PreventRequestsDuringMaintenance as Middleware;
+
+class PreventRequestsDuringMaintenance extends Middleware
+{
+    /**
+     * The URIs that should be reachable while maintenance mode is enabled.
+     *
+     * @var array<int, string>
+     */
+    protected $except = [
+        //
+    ];
+}

app/Http/Middleware/RedirectIfAuthenticated.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Providers\RouteServiceProvider;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Symfony\Component\HttpFoundation\Response;
+
+class RedirectIfAuthenticated
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     */
+    public function handle(Request $request, Closure $next, string ...$guards): Response
+    {
+        $guards = empty($guards) ? [null] : $guards;
+
+        foreach ($guards as $guard) {
+            if (Auth::guard($guard)->check()) {
+                return redirect(RouteServiceProvider::HOME);
+            }
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/TrimStrings.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Foundation\Http\Middleware\TrimStrings as Middleware;
+
+class TrimStrings extends Middleware
+{
+    /**
+     * The names of the attributes that should not be trimmed.
+     *
+     * @var array<int, string>
+     */
+    protected $except = [
+        'current_password',
+        'password',
+        'password_confirmation',
+    ];
+}

app/Http/Middleware/TrustHosts.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Http\Middleware\TrustHosts as Middleware;
+
+class TrustHosts extends Middleware
+{
+    /**
+     * Get the host patterns that should be trusted.
+     *
+     * @return array<int, string|null>
+     */
+    public function hosts(): array
+    {
+        return [
+            $this->allSubdomainsOfApplicationUrl(),
+        ];
+    }
+}

app/Http/Middleware/TrustProxies.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Http\Middleware\TrustProxies as Middleware;
+use Illuminate\Http\Request;
+
+class TrustProxies extends Middleware
+{
+    /**
+     * The trusted proxies for this application.
+     *
+     * @var array<int, string>|string|null
+     */
+    protected $proxies;
+
+    /**
+     * The headers that should be used to detect proxies.
+     *
+     * @var int
+     */
+    protected $headers =
+        Request::HEADER_X_FORWARDED_FOR |
+        Request::HEADER_X_FORWARDED_HOST |
+        Request::HEADER_X_FORWARDED_PORT |
+        Request::HEADER_X_FORWARDED_PROTO |
+        Request::HEADER_X_FORWARDED_AWS_ELB;
+}

app/Http/Middleware/ValidateSignature.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Routing\Middleware\ValidateSignature as Middleware;
+
+class ValidateSignature extends Middleware
+{
+    /**
+     * The names of the query string parameters that should be ignored.
+     *
+     * @var array<int, string>
+     */
+    protected $except = [
+        // 'fbclid',
+        // 'utm_campaign',
+        // 'utm_content',
+        // 'utm_medium',
+        // 'utm_source',
+        // 'utm_term',
+    ];
+}

app/Http/Middleware/VerifyCsrfToken.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;
+
+class VerifyCsrfToken extends Middleware
+{
+    /**
+     * The URIs that should be excluded from CSRF verification.
+     *
+     * @var array<int, string>
+     */
+    protected $except = [
+        //
+    ];
+}