1434c7e9d8
Add route-level regex constraints to all token route parameters, requiring exactly 64 alphanumeric characters. Malformed tokens (path traversal attempts, overly long strings, special characters) now receive a 404 at the routing layer before reaching controllers or triggering database lookups. Fixes #43 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
63 lines
1.9 KiB
PHP
63 lines
1.9 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
/**
|
|
* Tenant Module Web Routes
|
|
*
|
|
* Account management and workspace routes.
|
|
*/
|
|
|
|
use Core\Tenant\Controllers\WorkspaceInvitationController;
|
|
use Core\Tenant\View\Modal\Web\CancelDeletion;
|
|
use Core\Tenant\View\Modal\Web\ConfirmDeletion;
|
|
use Core\Tenant\View\Modal\Web\WorkspaceHome;
|
|
use Illuminate\Support\Facades\Route;
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Account Deletion Routes (No Auth Required)
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Token-based account deletion confirmation and cancellation.
|
|
| Users receive these links via email - no login required.
|
|
|
|
|
*/
|
|
|
|
Route::prefix('account')->name('account.')->group(function () {
|
|
Route::get('/delete/{token}', ConfirmDeletion::class)
|
|
->name('delete.confirm')
|
|
->where('token', '[a-zA-Z0-9]{64}');
|
|
|
|
Route::get('/delete/{token}/cancel', CancelDeletion::class)
|
|
->name('delete.cancel')
|
|
->where('token', '[a-zA-Z0-9]{64}');
|
|
});
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Workspace Invitation Routes
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Token-based workspace invitation acceptance.
|
|
| Users receive these links via email to join a workspace.
|
|
|
|
|
*/
|
|
|
|
Route::get('/workspace/invitation/{token}', WorkspaceInvitationController::class)
|
|
->name('workspace.invitation.accept')
|
|
->where('token', '[a-zA-Z0-9]{64}');
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Workspace Public Routes
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Workspace home page, typically accessed via subdomain.
|
|
| The workspace slug is resolved from subdomain middleware or route param.
|
|
|
|
|
*/
|
|
|
|
Route::get('/workspace/{workspace?}', WorkspaceHome::class)
|
|
->name('workspace.home')
|
|
->where('workspace', '[a-z0-9\-]+');
|