Auth class cleaned; hot session reset

1 files changed, 98 insertions, 44 deletions

diff --git a/public/app/controllers/Auth.php b/public/app/controllers/Auth.php
index cbf4d19..02a059f 100644
--- a/public/app/controllers/Auth.php
+++ b/public/app/controllers/Auth.php
@@ -20,23 +20,18 @@ use app\extends\SendMail_service;
  */
 class Auth {
 
-    /** AJAX POST: login
+    ## handle user's record / token / session
+    ## -------------------------------------------------------------------------
+    
+    /** user from record
      * 
-     * checks visitor's credentials;
-     * if valid, authenticates user
+     * create and return a user based on the record of properties
      * 
+     * @param array $record
+     * @return AppUser
      */
-    public static function login()
+    private static function user_fromRecord($record)
     {
-        $req = Registry::get('REQUEST');
-
-        // get the record of the target user
-        $record = Access_model::checkUser($req->POST['email']);
-       
-        // if no user exists, return false
-        if ($record === false)     return false;
-        
-        // user is valid; check user password
         // create a user object
         $user = (new App_user())
             ->setID($record['id'])
@@ -56,37 +51,89 @@ class Auth {
             ->set('position', $record['position'])
             ->set('registration_number', $record['registration_number'])
             ->set('belonging_school', $record['belonging_school']);
+        return $user;
+    }
 
 
-        // let user manager to validate user credentials
+    /** setSessionToken_forUser
+     * (RE-)set Session-Token for specified user object
+     * 
+     * @param AppUser $user
+     */
+    private static function setSessionToken_forUser($user)
+    {       
         $userManager = new App_manager();
+
+        // regeneration session ID (prevent session fixation)
+        session_unset();     // unset $_SESSION variable for the run-time
+        session_destroy();   // destroy session data in storage before continue
+        session_start();
+        session_regenerate_id();
+        
+        // set cookie for connected user
+        setcookie(
+            CONNECTION_COOKIE,
+            rawurlencode(json_encode(
+                [ 'rid' => $user->getRoles()[0], 'name' => $user->getName() ],
+                JSON_UNESCAPED_UNICODE
+            )),
+            [
+                'expires' =>time()+60*60*10,    // 10 hours
+                'path' => '/',
+                // 'domain' => COOKIE_DOMAIN,
+                'secure' => COOKIE_SECURE,
+                'samesite' => COOKIE_SAMESITE
+            ]
+        );
+
+        // login OK, set Token in session
+        $userManager->createUserToken($user);
+
+        return true;
+    }
+
+
+    /** update session token
+     * 
+     */
+    private static function reset_user_token($uid)
+    {
+        $rec = Access_model::getUser_byID($uid);
+        if ($rec !== false) {
+            $user = self::user_fromRecord($rec);
+            self::setSessionToken_forUser($user);
+        }
+        return true;
+    }
+
+
+    ## handle comon ajax requests
+    ## (login, activate. update etc )
+    ## -------------------------------------------------------------------------
+
+    /** AJAX POST: login
+     * 
+     * checks visitor's credentials;
+     * if valid, authenticates user
+     * 
+     */
+    public static function login()
+    {
+        $req = Registry::get('REQUEST');
+
+        // get the record of the target user
+        $record = Access_model::checkUser($req->POST['email']);
+       
+        // if no user exists, return false
+        if ($record === false)     return false;
         
+        // user is valid; check user password
+        $user = self::user_fromRecord($record);     // create User object
+        $userManager = new App_manager();           // let Manager to check       
         if ($userManager->isPasswordValid($user, $req->POST['password'])) {
 
-            // regeneration session ID (prevent session fixation)
-            session_unset();     // unset $_SESSION variable for the run-time
-            session_destroy();   // destroy session data in storage before continue
-            session_start();
-            session_regenerate_id();
-            
-            // set cookie for connected user
-            setcookie(
-                CONNECTION_COOKIE,
-                rawurlencode(json_encode(
-                    [ 'rid' => $record['role_id'], 'name' => $user->getName() ],
-                    JSON_UNESCAPED_UNICODE
-                )),
-                [
-                    'expires' =>time()+60*60*10,    // 10 hours
-                    'path' => '/',
-                    // 'domain' => COOKIE_DOMAIN,
-                    'secure' => COOKIE_SECURE,
-                    'samesite' => COOKIE_SAMESITE
-                ]
-            );
-   
-            // login OK, set Token in session
-            $userManager->createUserToken($user);
+            self::setSessionToken_forUser($user);   // re-set Session Token
+
             return [
                 'success' => true,
                 'goto' => '/panel'
@@ -143,24 +190,28 @@ class Auth {
     {
         $req = Registry::get('REQUEST');
         $manager = new App_manager();
-        ;
-        // print_r($req->POST); die();
+        $uid = $manager->getUserToken()->getUser()->getID();
 
         // ask model to update user; get user-id from user-manager
         $check = Access_model::update_user(
             $req->POST,
-            $manager->getUserToken()->getUser()->getID()
+            $uid
         );
 
-        // TODO: message for user updating properties
+        // user properties changed, so update user's session token
+        self::reset_user_token($uid);
+
         Render::json([
-            'title' => ACCOUNT_ACTIVATED_TITLE,
-            'message' => ACCOUNT_ACTIVATED_MESSAGE . '<br>(msg code: '. $check .')'
+            'title' => ACCOUNT_UPDATED_TITLE,
+            'message' => ACCOUNT_UPDATED_MESSAGE . '<br>(msg code: '. $check .')'
         ]);
 
     }
 
 
+    ## serve user management forms
+    ## -------------------------------------------------------------------------
+
     /** SERVE FORM: invitation
      * 
      * setups and renders the form for a certain invitation
@@ -260,6 +311,9 @@ class Auth {
     }
 
 
+    ## suplamentary methods
+    ## -------------------------------------------------------------------------
+
     /** is_connected
      * checks if the user is connected
      *