fix: 🐛 added local admin-secure because of laravel version

2026-05-04 10:07:49 +02:00 · 2026-05-04 10:07:49 +02:00 · 03205e8f3a
commit 03205e8f3a
parent edf2a225af
9 changed files with 359 additions and 82 deletions
--- a/.env.example
+++ b/.env.example
@ -43,13 +43,11 @@ SENTRY_LARAVEL_DSN=
 # MATOMO
 MATOMO_SITE_ID=

-# ADMIN SECURE
-# - API ENDPOINT (Optional)
-LDC_WEB_API_ENDPOINT="https://ldc-web.ldc.fr/api/ldc-networks"
-# - API KEY
-LDC_WEB_API_KEY=""
+# UWIL ADMIN SECURE
+# - LIST SEPARATED WITH ',' (Required)
+UWIL_ADMIN_SECURE_CIDR_LIST=""
 # - LIST SEPARATED WITH ',' (Optional)
-LDC_WEB_CIDR_MANUAL_ALLOWED_LIST=""
+UWIL_ADMIN_SECURE_CIDR_PROJECT_ALLOWED_LIST=""

 # SAML
 SAML2_DEFAULT_TENANT_UUID=
--- a/app/Http/Kernel.php
+++ b/app/Http/Kernel.php
@ -71,5 +71,6 @@ class Kernel extends HttpKernel
        'throttle'         => \Illuminate\Routing\Middleware\ThrottleRequests::class,
        'verified'         => \Illuminate\Auth\Middleware\EnsureEmailIsVerified::class,
        'htmlsanitize'     => \App\Http\Middleware\HtmlSanitizer::class,
+        'admin-secure'     => \App\Http\Middleware\AdminSecureMiddleware::class,
    ];
 }
--- a/app/Http/Middleware/AdminSecureMiddleware.php
+++ b/app/Http/Middleware/AdminSecureMiddleware.php
@ -0,0 +1,49 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Lib\AdminSecure;
+use Closure;
+use Dxw\CIDR\IP;
+use Illuminate\Http\Request;
+
+class AdminSecureMiddleware
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Illuminate\Http\Request $request
+     * @param  \Closure                 $next
+     * @return mixed
+     */
+    public function handle(Request $request, Closure $next)
+    {
+        if (config('app.env') === 'local') {
+            return $next($request);
+        }
+
+        $client_ip     = AdminSecure::fetchClientIp();
+
+        $ip_is_allowed = \collect(AdminSecure::getOptions()->getCidrList())
+            ->reduce(function ($initial, $ip_range) use ($client_ip) {
+                return $initial || IP::contains(
+                    $ip_range,
+                    $client_ip
+                )->unwrap();
+            });
+
+        $ip_is_allowed_by_config = \collect(AdminSecure::getOptions()->getCidrAllowedList())
+            ->reduce(function ($initial, $ip_range) use ($client_ip) {
+                return $initial || IP::contains(
+                    $ip_range,
+                    $client_ip
+                )->unwrap();
+            });
+
+        if ($ip_is_allowed or $ip_is_allowed_by_config or AdminSecure::ipIsPrivate($client_ip)) {
+            return $next($request);
+        }
+
+        abort(403, \trans('Denied IP'));
+    }
+}
--- a/app/Lib/AdminSecure.php
+++ b/app/Lib/AdminSecure.php
@ -0,0 +1,131 @@
+<?php
+
+namespace App\Lib;
+
+use App\Lib\Options;
+use Dxw\CIDR\IPAddress;
+use Dxw\CIDR\IPv4Address;
+use Dxw\CIDR\IPv4Range;
+use Dxw\CIDR\IPv6Address;
+use Dxw\CIDR\IPv6Range;
+
+abstract class AdminSecure
+{
+    /**
+     * Private ipV4 CIDR list
+     *
+     * @var array
+     */
+    private static $private_ip_v4_cidr_list = [
+        '10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16'
+    ];
+
+    /**
+     * Private ipV4 CIDR loopback
+     *
+     * @var string
+     */
+    private static $private_ip_v4_loopback_cidr = '127.0.0.0/8';
+
+    /**
+     * Private ipV6 CIDR list
+     *
+     * @var array
+     */
+    private static $private_ip_v6_cidr_list = [
+        'fd00::/8'
+    ];
+
+    /**
+     * Private ipV6 CIDR loopback
+     *
+     * @var string
+     */
+    private static $private_ip_v6_loopback_cidr = '::1/128';
+
+    /**
+     * Private options
+     *
+     * @var \App\Lib\Options|null
+     */
+    private static $options = null;
+
+    /**
+     * Check if ip is private
+     *
+     * @param \Dxw\CIDR\IPv4Address|\Dxw\CIDR\IPv6Address $ip_address
+     * @return boolean
+     */
+    public static function ipIsPrivate($ip_address): bool
+    {
+        return \get_class($ip_address) === IPv4Address::class ?
+            self::ipV4IsPrivate($ip_address) : self::ipV6IsPrivate($ip_address);
+    }
+
+    /**
+     * Fetch client IP
+     *
+     * @return \Dxw\CIDR\IPv4Address|\Dxw\CIDR\IPv6Address
+     * @throws \Exception  If the ip is invalid.
+     */
+    public static function fetchClientIp()
+    {
+        // ! REVERSE PROXY HACK.
+        $ip = request()->server('HTTP_X_FORWARDED_FOR') ?? request()->getClientIp();
+        $ip = IPAddress::Make($ip);
+
+        if ($ip->isErr()) {
+            throw new \Exception(\trans('Client IP not valid ') . $ip->getErr());
+        }
+        return $ip->unwrap();
+    }
+
+    /**
+     * Check if ipV4 is private
+     *
+     * @param \Dxw\CIDR\IPv4Address $ipv4_address
+     * @return boolean
+     */
+    private static function ipV4IsPrivate(IPv4Address $ipv4_address): bool
+    {
+        return \collect(self::$private_ip_v4_cidr_list)
+            ->concat([self::$private_ip_v4_loopback_cidr])
+            ->map(function (string $ipv4_cidr) {
+                return IPv4Range::Make($ipv4_cidr)->unwrap();
+            })
+            ->reduce(function ($initial, IPv4Range $ipv4_range) use ($ipv4_address) {
+                return $initial || $ipv4_range->containsAddress($ipv4_address);
+            });
+    }
+
+    /**
+     * Check if ipV6 is private
+     *
+     * @param \Dxw\CIDR\IPv6Address $ipv6_address
+     * @return boolean
+     */
+    private static function ipV6IsPrivate(IPv6Address $ipv6_address): bool
+    {
+        return \collect(self::$private_ip_v6_cidr_list)
+            ->concat([self::$private_ip_v6_loopback_cidr])
+            ->map(function (string $ipv6_cidr) {
+                return IPv6Range::Make($ipv6_cidr)->unwrap();
+            })
+            ->reduce(function ($initial, IPv6Range $ipv6_range, IPv6Address $ipv6_address) {
+                return $initial || $ipv6_range->containsAddress($ipv6_address);
+            });
+    }
+
+    /**
+     * Get Admin secure options
+     *
+     * @return \App\Lib\Options
+     */
+    public static function getOptions(): Options
+    {
+        if (!self::$options) {
+            self::$options = new Options(\config('admin-secure'));
+        }
+        return self::$options;
+    }
+}
--- a/app/Lib/Options.php
+++ b/app/Lib/Options.php
@ -0,0 +1,159 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Lib;
+
+use Dxw\CIDR\IPv4Range;
+use Dxw\CIDR\IPv6Range;
+use Illuminate\Support\Facades\Cache;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+
+/**
+ * Configuration
+ */
+final class Options
+{
+    /**
+     * @var array<string, mixed> The configuration options
+     */
+    private $options;
+
+    /**
+     * @var \Symfony\Component\OptionsResolver\OptionsResolver The options resolver
+     */
+    private $resolver;
+
+    /**
+     * The cache key where to store config cidr list.
+     *
+     * @var string
+     */
+    private static $cache_config_key = 'uwil_ip_cidr_config_list';
+
+    /**
+     * Class constructor.
+     *
+     * @param array<string, mixed> $options The configuration options.
+     */
+    public function __construct(array $options = [])
+    {
+        $this->resolver = new OptionsResolver();
+
+        $this->configureOptions($this->resolver);
+
+        $this->options = $this->resolver->resolve($options);
+    }
+
+    /**
+     * Get cidr list
+     *
+     * @return array<\Dxw\CIDR\IPv4Range|\Dxw\CIDR\IPv6Range>
+     */
+    public function getCidrList(): array
+    {
+        return $this->options['cidrList'];
+    }
+
+    /**
+     * Get cidr project allowed list
+     *
+     * @return array<\Dxw\CIDR\IPv4Range|\Dxw\CIDR\IPv6Range>
+     */
+    public function getCidrAllowedList(): array
+    {
+        return $this->options['cidrProjectAllowedList'];
+    }
+
+    /**
+     * Configures the options of the client.
+     *
+     * @param \Symfony\Component\OptionsResolver\OptionsResolver $resolver The resolver for the options.
+     * @return void
+     */
+    private function configureOptions(OptionsResolver $resolver): void
+    {
+        $resolver->setDefaults([
+            'cidrList' => [],
+            'cidrProjectAllowedList' => []
+        ]);
+
+        $resolver->setNormalizer('cidrList', \Closure::fromCallable([$this, 'normalizeCidrList']));
+        $resolver->setNormalizer('cidrProjectAllowedList', \Closure::fromCallable([$this, 'normalizeCidrProjectList']));
+    }
+
+    /**
+     * Normalise Cidr list for cidrList option
+     *
+     * @param \Symfony\Component\OptionsResolver\Options $options
+     * @param string|null $value
+     * @return array
+     * @phpcs:disable Generic.CodeAnalysis.UnusedFunctionParameter.FoundBeforeLastUsed
+     */
+    private function normalizeCidrList(
+        \Symfony\Component\OptionsResolver\Options $options,
+        ?string $value
+    ): array {
+        // phpcs:enable
+        return $this->doNormalizeCidrList($value, 'cidrList');
+    }
+
+    /**
+     * Normalise Cidr list for cidrProjectAllowedList option
+     *
+     * @param \Symfony\Component\OptionsResolver\Options $options
+     * @param string|null $value
+     * @return array
+     * @phpcs:disable Generic.CodeAnalysis.UnusedFunctionParameter.FoundBeforeLastUsed
+     */
+    private function normalizeCidrProjectList(
+        \Symfony\Component\OptionsResolver\Options $options,
+        ?string $value
+    ): array {
+        // phpcs:enable
+        return $this->doNormalizeCidrList($value, 'cidrProjectAllowedList');
+    }
+
+    /**
+     * Normalize CIDR list with specific cache key.
+     *
+     * @param string|null $value
+     * @param string $optionName
+     * @return array<\Dxw\CIDR\IPv4Range|\Dxw\CIDR\IPv6Range>
+     */
+    private function doNormalizeCidrList(?string $value, string $optionName): array
+    {
+        $cacheConfigKey = self::$cache_config_key . '_' . $optionName;
+        $allowed_cidr_config_list = collect(explode(',', strval($value)))->filter();
+        $allowed_cidr_config_list_hash = \md5($allowed_cidr_config_list->implode(','));
+        $allowed_cidr_list = [];
+
+        // Flush cache if config hash changed
+        if ($allowed_cidr_config_list_hash !== \collect(Cache::get($cacheConfigKey))->get('hash')) {
+            Cache::forget($cacheConfigKey);
+
+            /** @var array<\Dxw\CIDR\IPv4Range|\Dxw\CIDR\IPv6Range> $allowed_cidr_list */
+            $allowed_cidr_list = $allowed_cidr_config_list
+                ->map(function (string $cidr) {
+                    $ip_range = !IPv4Range::Make($cidr)->isErr() ? IPv4Range::Make($cidr) : IPv6Range::Make($cidr);
+                    if ($ip_range->isErr()) {
+                        throw new \Exception(\trans(
+                            'CIDR LIST not valid (ipv4 or ipv6 cidr) :cidr',
+                            [
+                                'cidr' => $cidr
+                            ]
+                        ));
+                    }
+                    return $ip_range->unwrap();
+                })->all();
+        }
+
+        /** @var array<\Dxw\CIDR\IPv4Range|\Dxw\CIDR\IPv6Range> $allowed_cidr_list */
+        return \collect(Cache::rememberForever($cacheConfigKey, function() use ($allowed_cidr_list, $allowed_cidr_config_list_hash) {
+            return [
+                'list' => $allowed_cidr_list,
+                'hash' => $allowed_cidr_config_list_hash
+            ];
+        }))->get('list');
+    }
+}
--- a/composer.json
+++ b/composer.json
@ -8,11 +8,11 @@
        "24slides/laravel-saml2": "^2.4",
        "diglactic/laravel-breadcrumbs": "^8.0",
        "doctrine/dbal": "^3.8",
+        "dxw/cidr": "^3.2",
        "guzzlehttp/guzzle": "^7.2",
        "laravel/framework": "^10.0",
        "laravel/tinker": "^2.8",
        "laravel/ui": "^4.2",
-        "ldc/web-admin-secure-laravel": "^2.0",
        "mews/purifier": "^3.4",
        "sentry/sentry-laravel": "*",
        "uwil/k8s-laravel": "^1.2"
--- a/composer.lock
+++ b/composer.lock
@ -4,7 +4,7 @@
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "d42e6627078237324af561d52755a0c8",
+    "content-hash": "d3241300aff4d70e76a9a0689629f6c6",
    "packages": [
        {
            "name": "24slides/laravel-saml2",
@ -2182,73 +2182,6 @@
            },
            "time": "2026-03-17T13:41:52+00:00"
        },
-        {
-            "name": "ldc/web-admin-secure-laravel",
-            "version": "2.0.3",
-            "source": {
-                "type": "git",
-                "url": "git@lab.s-web.fr:ldc-web/projets/ldc-web-admin-secure-laravel.git",
-                "reference": "fc648612f0e16ca00c012e5305b28058312d68c0"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://lab.s-web.fr/api/v4/projects/20/packages/composer/archives/ldc/web-admin-secure-laravel.zip?sha=fc648612f0e16ca00c012e5305b28058312d68c0",
-                "reference": "fc648612f0e16ca00c012e5305b28058312d68c0",
-                "shasum": ""
-            },
-            "require": {
-                "dxw/cidr": "^3.1",
-                "illuminate/support": "~10",
-                "laravel/framework": "~10",
-                "php": ">=8.2",
-                "symfony/options-resolver": "^3.4.43|^4.4.30|^5.0.11|^6.0"
-            },
-            "require-dev": {
-                "larastan/larastan": "^2.6",
-                "orchestra/testbench": "^8",
-                "phpunit/php-code-coverage": "^9",
-                "phpunit/phpunit": "^9",
-                "slevomat/coding-standard": "^7",
-                "squizlabs/php_codesniffer": "^3"
-            },
-            "type": "library",
-            "extra": {
-                "laravel": {
-                    "providers": [
-                        "LDC\\WebAdminSecureLaravel\\AdminSecureServiceProvider"
-                    ]
-                }
-            },
-            "autoload": {
-                "psr-4": {
-                    "LDC\\WebAdminSecureLaravel\\": "src/"
-                }
-            },
-            "autoload-dev": {
-                "psr-4": {
-                    "LDC\\WebAdminSecureLaravel\\Tests\\": "tests"
-                }
-            },
-            "scripts": {
-                "test": [
-                    "vendor/bin/phpunit"
-                ],
-                "post-autoload-dump": [
-                    "@php ./vendor/bin/testbench package:discover --ansi"
-                ]
-            },
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Vincent BRIDIER",
-                    "email": "vincent.bridier@ldc.fr",
-                    "homepage": "https://www.ldc.fr"
-                }
-            ],
-            "description": "Restrict access to LDC Network"
-        },
        {
            "name": "league/commonmark",
            "version": "2.8.2",
@ -3434,16 +3367,16 @@
        },
        {
            "name": "phpseclib/phpseclib",
-            "version": "2.0.52",
+            "version": "2.0.54",
            "source": {
                "type": "git",
                "url": "https://github.com/phpseclib/phpseclib.git",
-                "reference": "2552c4001631d1cc844332faea6a08a49c964b28"
+                "reference": "a96a835067c39ee7a709329fe70869817da18081"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/phpseclib/phpseclib/zipball/2552c4001631d1cc844332faea6a08a49c964b28",
-                "reference": "2552c4001631d1cc844332faea6a08a49c964b28",
+                "url": "https://api.github.com/repos/phpseclib/phpseclib/zipball/a96a835067c39ee7a709329fe70869817da18081",
+                "reference": "a96a835067c39ee7a709329fe70869817da18081",
                "shasum": ""
            },
            "require": {
@ -3524,7 +3457,7 @@
            ],
            "support": {
                "issues": "https://github.com/phpseclib/phpseclib/issues",
-                "source": "https://github.com/phpseclib/phpseclib/tree/2.0.52"
+                "source": "https://github.com/phpseclib/phpseclib/tree/2.0.54"
            },
            "funding": [
                {
@ -3540,7 +3473,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-03-19T02:54:44+00:00"
+            "time": "2026-04-27T06:59:24+00:00"
        },
        {
            "name": "psr/cache",
--- a/config/admin-secure.php
+++ b/config/admin-secure.php
@ -0,0 +1,6 @@
+<?php
+
+return [
+    'cidrList' => env('UWIL_ADMIN_SECURE_CIDR_LIST'),
+    'cidrProjectAllowedList' => env('UWIL_ADMIN_SECURE_CIDR_PROJECT_ALLOWED_LIST')
+];
--- a/manifest.yaml
+++ b/manifest.yaml
@ -20,7 +20,6 @@ data:
  MAIL_ENCRYPTION: "${APP_MAIL_ENCRYPTION}"
  MAIL_FROM_ADDRESS: "${APP_MAIL_FROM_ADDRESS}"
  MAIL_FROM_NAME: "${APP_APP_NAME}"
-  LDC_WEB_API_KEY: "${APP_LDC_WEB_API_KEY}"
  GOOGLE_RECAPTCHA_PRIVATE: "${APP_GOOGLE_RECAPTCHA_PRIVATE}"
  GOOGLE_RECAPTCHA_PUBLIC: "${APP_GOOGLE_RECAPTCHA_PUBLIC}"
  GOOGLE_RECAPTCHA_VERSION: "${APP_GOOGLE_RECAPTCHA_VERSION}"
@ -32,6 +31,7 @@ data:
  SAML2_CONTACT_TECHNICAL_EMAIL: "${APP_SAML2_CONTACT_TECHNICAL_EMAIL}"
  SAML2_CONTACT_SUPPORT_EMAIL: "${APP_SAML2_CONTACT_SUPPORT_EMAIL}"
  SAML2_DEFAULT_TENANT_UUID: "${APP_SAML2_DEFAULT_TENANT_UUID}"
+  UWIL_ADMIN_SECURE_CIDR_LIST: "${APP_GLOBAL_UWIL_ADMIN_SECURE_CIDR_LIST}"

 ---
 apiVersion: v1