Auth class cleaned; hot session reset

12 files changed, 267 insertions, 83 deletions

diff --git a/public/app/config/setup_application.php b/public/app/config/setup_application.php
index f56cc1a..e7d2ca4 100644
--- a/public/app/config/setup_application.php
+++ b/public/app/config/setup_application.php
@@ -125,6 +125,14 @@ define('NOT_VALID_ACTIVATION_TITLE', 'Σφάλμα!');
 define('NOT_VALID_ACTIVATION_MESSAGE', 'Ο λογαριασμός δεν έχει ενεργοποιηθεί.
     Ξαναδοκιμάστε αργότερα κι αν το σφάλμα επιμείνει, επικοινωνήστε με την υπεύθυνη του προγράμμαρος.');
 
+// update properties
+// ---
+define('ACCOUNT_UPDATED_TITLE','Ο λογαριασμός σας ενημερώθηκε!');
+define('ACCOUNT_UPDATED_MESSAGE','Τώρα μπορείτε να επιστρέψετε 
+<a href="/panel">στον πίνακα ελέγχου</a>.');
+
+
+
 define ('PETITION_TYPE', [
     1 => 'common',
     2 => 'penalty'
diff --git a/public/app/controllers/Auth.php b/public/app/controllers/Auth.php
index cbf4d19..02a059f 100644
--- a/public/app/controllers/Auth.php
+++ b/public/app/controllers/Auth.php
@@ -20,23 +20,18 @@ use app\extends\SendMail_service;
  */
 class Auth {
 
-    /** AJAX POST: login
+    ## handle user's record / token / session
+    ## -------------------------------------------------------------------------
+    
+    /** user from record
      * 
-     * checks visitor's credentials;
-     * if valid, authenticates user
+     * create and return a user based on the record of properties
      * 
+     * @param array $record
+     * @return AppUser
      */
-    public static function login()
+    private static function user_fromRecord($record)
     {
-        $req = Registry::get('REQUEST');
-
-        // get the record of the target user
-        $record = Access_model::checkUser($req->POST['email']);
-       
-        // if no user exists, return false
-        if ($record === false)     return false;
-        
-        // user is valid; check user password
         // create a user object
         $user = (new App_user())
             ->setID($record['id'])
@@ -56,37 +51,89 @@ class Auth {
             ->set('position', $record['position'])
             ->set('registration_number', $record['registration_number'])
             ->set('belonging_school', $record['belonging_school']);
+        return $user;
+    }
 
 
-        // let user manager to validate user credentials
+    /** setSessionToken_forUser
+     * (RE-)set Session-Token for specified user object
+     * 
+     * @param AppUser $user
+     */
+    private static function setSessionToken_forUser($user)
+    {       
         $userManager = new App_manager();
+
+        // regeneration session ID (prevent session fixation)
+        session_unset();     // unset $_SESSION variable for the run-time
+        session_destroy();   // destroy session data in storage before continue
+        session_start();
+        session_regenerate_id();
+        
+        // set cookie for connected user
+        setcookie(
+            CONNECTION_COOKIE,
+            rawurlencode(json_encode(
+                [ 'rid' => $user->getRoles()[0], 'name' => $user->getName() ],
+                JSON_UNESCAPED_UNICODE
+            )),
+            [
+                'expires' =>time()+60*60*10,    // 10 hours
+                'path' => '/',
+                // 'domain' => COOKIE_DOMAIN,
+                'secure' => COOKIE_SECURE,
+                'samesite' => COOKIE_SAMESITE
+            ]
+        );
+
+        // login OK, set Token in session
+        $userManager->createUserToken($user);
+
+        return true;
+    }
+
+
+    /** update session token
+     * 
+     */
+    private static function reset_user_token($uid)
+    {
+        $rec = Access_model::getUser_byID($uid);
+        if ($rec !== false) {
+            $user = self::user_fromRecord($rec);
+            self::setSessionToken_forUser($user);
+        }
+        return true;
+    }
+
+
+    ## handle comon ajax requests
+    ## (login, activate. update etc )
+    ## -------------------------------------------------------------------------
+
+    /** AJAX POST: login
+     * 
+     * checks visitor's credentials;
+     * if valid, authenticates user
+     * 
+     */
+    public static function login()
+    {
+        $req = Registry::get('REQUEST');
+
+        // get the record of the target user
+        $record = Access_model::checkUser($req->POST['email']);
+       
+        // if no user exists, return false
+        if ($record === false)     return false;
         
+        // user is valid; check user password
+        $user = self::user_fromRecord($record);     // create User object
+        $userManager = new App_manager();           // let Manager to check       
         if ($userManager->isPasswordValid($user, $req->POST['password'])) {
 
-            // regeneration session ID (prevent session fixation)
-            session_unset();     // unset $_SESSION variable for the run-time
-            session_destroy();   // destroy session data in storage before continue
-            session_start();
-            session_regenerate_id();
-            
-            // set cookie for connected user
-            setcookie(
-                CONNECTION_COOKIE,
-                rawurlencode(json_encode(
-                    [ 'rid' => $record['role_id'], 'name' => $user->getName() ],
-                    JSON_UNESCAPED_UNICODE
-                )),
-                [
-                    'expires' =>time()+60*60*10,    // 10 hours
-                    'path' => '/',
-                    // 'domain' => COOKIE_DOMAIN,
-                    'secure' => COOKIE_SECURE,
-                    'samesite' => COOKIE_SAMESITE
-                ]
-            );
-   
-            // login OK, set Token in session
-            $userManager->createUserToken($user);
+            self::setSessionToken_forUser($user);   // re-set Session Token
+
             return [
                 'success' => true,
                 'goto' => '/panel'
@@ -143,24 +190,28 @@ class Auth {
     {
         $req = Registry::get('REQUEST');
         $manager = new App_manager();
-        ;
-        // print_r($req->POST); die();
+        $uid = $manager->getUserToken()->getUser()->getID();
 
         // ask model to update user; get user-id from user-manager
         $check = Access_model::update_user(
             $req->POST,
-            $manager->getUserToken()->getUser()->getID()
+            $uid
         );
 
-        // TODO: message for user updating properties
+        // user properties changed, so update user's session token
+        self::reset_user_token($uid);
+
         Render::json([
-            'title' => ACCOUNT_ACTIVATED_TITLE,
-            'message' => ACCOUNT_ACTIVATED_MESSAGE . '<br>(msg code: '. $check .')'
+            'title' => ACCOUNT_UPDATED_TITLE,
+            'message' => ACCOUNT_UPDATED_MESSAGE . '<br>(msg code: '. $check .')'
         ]);
 
     }
 
 
+    ## serve user management forms
+    ## -------------------------------------------------------------------------
+
     /** SERVE FORM: invitation
      * 
      * setups and renders the form for a certain invitation
@@ -260,6 +311,9 @@ class Auth {
     }
 
 
+    ## suplamentary methods
+    ## -------------------------------------------------------------------------
+
     /** is_connected
      * checks if the user is connected
      * 
diff --git a/public/app/models/Access_model.php b/public/app/models/Access_model.php
index 5c9f991..2d36285 100644
--- a/public/app/models/Access_model.php
+++ b/public/app/models/Access_model.php
@@ -33,6 +33,22 @@ class Access_model
     }
 
 
+    /** get user by id
+     * 
+     */
+    public static function getUser_byID($uid)
+    {
+        $user = Registry::use('database')->query(
+            "SELECT * FROM user WHERE id = :uid AND active = 1",
+            [ ':uid' => $uid ]
+        )->getFirst();
+       
+        // if no user, return false
+        if ($user === false)     return false;
+       
+        return $user;
+    }
+
     /** getUserByInvitation
      * 
      * @param string $invitation
@@ -173,7 +189,7 @@ class Access_model
      * @param array $post;
      * @param int $id: user id
      */
-    public static function update_user($post, $id)
+    public static function update_user($post, $uid)
     {
         // Update and set activate = true
         $rowCount = Registry::use('database')->query(
@@ -201,14 +217,14 @@ class Access_model
                 ':position' => $post['position'],
                 ':phone' => $post['phone'],
                 ':active' => 1,
-                ':id' => $id
+                ':id' => $uid
             ]
         )->rowCount();
 
         // update history
         if ($rowCount != 0) {
             History_model::trackUserAccess(
-                $id, TRACK_ACCOUNT, 'User properties changed'
+                $uid, TRACK_ACCOUNT, 'User properties changed'
             );
         }
 
diff --git a/public/app/views/components/header_includes.php b/public/app/views/components/header_includes.php
index 0600450..1b52824 100644
--- a/public/app/views/components/header_includes.php
+++ b/public/app/views/components/header_includes.php
@@ -51,6 +51,12 @@
 <link href="/assets/css/overides.css" rel="stylesheet">
 
 
+<!-- THEME CSS
+    /////////////////////////////////////////////////////////////////////////-->
+
+<?php   // decide a theme
+    Render::view('components/theme');
+?>
 
 <!-- JAVASCRIPT 
     /////////////////////////////////////////////////////////////////////////-->
diff --git a/public/app/views/components/theme.php b/public/app/views/components/theme.php
new file mode 100644
index 0000000..238f932
--- /dev/null
+++ b/public/app/views/components/theme.php
@@ -0,0 +1,98 @@
+<?php 
+
+// decide a theme according to month
+$month = idate('m');
+
+switch ($month) {
+    case 12: case 1: case 2:
+        $season = 'winter';
+        break;
+
+    case 3: case 4: case 5:
+        $season = 'spring';
+        break;
+
+    case 6: case 7: case 8:
+        $season = 'summer';
+        break;
+
+    case 9: case 10: case 11:
+        $season = 'fall';
+        break;
+
+    default:
+        $season = 'spring';
+}
+
+
+/** themes
+ * --- -- -- - - -
+ * auto select one id of L = array.LENGTH, per month:
+ * ( ( (month*31 + day) % L*2 ) div 2 )
+ * 
+ * this will allow theme exchange every 2 days
+ */
+
+
+$themes = [
+
+    'summer' => [
+        [
+            'css' => 'summer-05',
+            'url' => 'https://www.vecteezy.com/vector-art/6691305',
+            'label' => 'Mohammad Arfa Affan: 3d Vectors (@Vecteezy)'
+        ],
+        [
+            'css' => 'summer-02',
+            'url' => 'https://www.pxfuel.com/en/desktop-wallpaper-elkiv',
+            'label' => '@pxfuel: Faded orange lines'
+        ],
+        [
+            'css' => 'summer-01',
+            'url' => 'https://www.freepik.com/free-photo/nazare-portugal_7487018.htm',
+            'label' => 'frimufilms: North beach and ocean in Nazare, Portugal'
+        ]
+    ],
+
+
+    'fall' => [
+
+        [
+            'css' => 'spring-04',
+            'url' => 'https://www.pxfuel.com/en/desktop-wallpaper-evgsz',
+            'label' => '@pxfuel: Nature, lights'
+        ]
+    ],
+
+    // summer-09
+    // https://www.freepik.com/free-photo/body-water_13126578.htm
+    // ninjason1: Body of water
+
+    'winter' => [
+        [
+            'css' => 'winter-09',
+            'url' => 'https://www.freepik.com/free-photo/abstract-water-waves-with-ink-dots_5068293.htm',
+            'label' => 'freepik: Abstract water waves with ink dots'
+        ]
+
+    ],
+
+
+    'spring' => [
+        [
+            'css' => 'spring-04',
+            'url' => 'https://www.pxfuel.com/en/desktop-wallpaper-evgsz',
+            'label' => '@pxfuel: Nature, lights'
+        ]
+
+    ]
+
+
+];
+
+
+define('THEME', $themes['summer'][2]);
+
+?>
+<link href="/assets/css/themes/<?=THEME['css']?>.css" rel="stylesheet">
+
diff --git a/public/app/views/js/credits.php b/public/app/views/js/credits.php
new file mode 100644
index 0000000..ca0f15c
--- /dev/null
+++ b/public/app/views/js/credits.php
@@ -0,0 +1,10 @@
+<script>
+// create image-credits div
+let ic_div = document.createElement('div');
+ic_div.innerHTML = '<a href="<?=THEME['url']?>" target="_blank" title="Attribution for the lovely background image"><?=THEME['label']?></a>';
+ic_div.className = 'image-credits';
+
+// append image-credits div to body
+document.querySelector('body').appendChild(ic_div);     
+
+</script>
\ No newline at end of file
diff --git a/public/app/views/templates/application.php b/public/app/views/templates/application.php
index 4855383..35b1435 100644
--- a/public/app/views/templates/application.php
+++ b/public/app/views/templates/application.php
@@ -98,13 +98,11 @@
 
 </script>
 
-
 <?php   // include select2 supplementary functions
     ////////////////////////////////////////////////////////////////////////////
     Render::view('js/select2-supplementary');   
 ?>
 
-
 <script>// pass dynamic js prepared by form designer
     $(document).ready(function() {
 
@@ -115,41 +113,23 @@
     });
 </script>
 
-
 <?php   // handle form submition
     ////////////////////////////////////////////////////////////////////////////
     Render::view('js/submit/application-form');
 ?>
 
-
 <?php   // load application pdf-designer
     ////////////////////////////////////////////////////////////////////////////
     Render::view('js/pdf-designer/application');
 ?>
 
-
 <?php   // include attachments handling
     ////////////////////////////////////////////////////////////////////////////
     Render::view('js/attachments-handling');   
 ?>
 
-<!--
-<script>
-var source = {
-    first_name: 'George',
-    last_name: 'Its me!',
-    father_name: 'Pipis',
-    message: 'Adhaesiones ratione beate arbitraretur detractis perdiscere, constituant hostis polyaeno.',
-    constants: {
-        organization: 'Ministry of Nothing'
-    }  
-}
-
-
-// pdfMake.createPdf(designer(source)).open();
-// download (+title):   .download('my-doc-title.pdf');
-// open in same window: .open({}, window);
-// print:               .print();
-</script>
--->
+<?php // credits
+  //////////////////////////////////////////////////////////////////////////////
+  Render::view('js/credits');
+?>
 </html>
diff --git a/public/app/views/templates/penalty.php b/public/app/views/templates/penalty.php
index 4709d60..cad9221 100644
--- a/public/app/views/templates/penalty.php
+++ b/public/app/views/templates/penalty.php
@@ -64,13 +64,11 @@
     };
 </script>
 
-
 <?php   // include select2 supplementary functions
     ////////////////////////////////////////////////////////////////////////////
     Render::view('js/select2-supplementary');   
 ?>
 
-
 <script>// pass dynamic js prepared by form designer
     $(document).ready(function() {
 
@@ -81,7 +79,6 @@
     });
 </script>
 
-
 <?php   // handle form submition
     ////////////////////////////////////////////////////////////////////////////
     Render::view('js/submit/penalty-form');
@@ -152,5 +149,8 @@
   });
 </script>
 -->
-
+<?php // credits
+  //////////////////////////////////////////////////////////////////////////////
+  Render::view('js/credits');
+?>
 </html>
diff --git a/public/app/views/user/invitation.php b/public/app/views/user/invitation.php
index 030c1d3..328c621 100644
--- a/public/app/views/user/invitation.php
+++ b/public/app/views/user/invitation.php
@@ -64,7 +64,6 @@
     var empty = '';
 </script>
 
-
 <?php   // include select2 supplementary functions
     ////////////////////////////////////////////////////////////////////////////
     Render::view('js/select2-supplementary');   
@@ -87,9 +86,13 @@ $(document).ready(function() {
 });
 </script>
 
-
 <?php   // handle form submition
     ////////////////////////////////////////////////////////////////////////////
     Render::view('js/submit/invitation-form');
 ?>
+
+<?php // credits
+  //////////////////////////////////////////////////////////////////////////////
+  Render::view('js/credits');
+?>
 </html>
diff --git a/public/app/views/user/login.php b/public/app/views/user/login.php
index 871e501..6bf3b0a 100644
--- a/public/app/views/user/login.php
+++ b/public/app/views/user/login.php
@@ -96,4 +96,8 @@
     });
 </script>
 
+<?php // credits
+  //////////////////////////////////////////////////////////////////////////////
+  Render::view('js/credits');
+?>
 </html>
diff --git a/public/app/views/user/panel.php b/public/app/views/user/panel.php
index fbfdd0c..9ac7908 100644
--- a/public/app/views/user/panel.php
+++ b/public/app/views/user/panel.php
@@ -98,7 +98,7 @@
 
   </body>
 
-    <script src="/assets/js/panel/<?=$content?>.js"></script>
+<script src="/assets/js/panel/<?=$content?>.js"></script>
 
   <!-- scripts 
     * handle show petition request
@@ -106,6 +106,8 @@
     if admin:
     * modal + give protocol-number
   -->
-
-
+<?php // credits
+    //////////////////////////////////////////////////////////////////////////////
+    Render::view('js/credits');
+?>
 </html>
diff --git a/public/app/views/user/update_properties.php b/public/app/views/user/update_properties.php
index 35a1b1e..f10e36b 100644
--- a/public/app/views/user/update_properties.php
+++ b/public/app/views/user/update_properties.php
@@ -39,7 +39,6 @@
     var empty = '';
 </script>
 
-
 <?php   // include select2 supplementary functions
     ////////////////////////////////////////////////////////////////////////////
     Render::view('js/select2-supplementary');   
@@ -62,9 +61,13 @@ $(document).ready(function() {
 });
 </script>
 
-
 <?php   // handle form submition
     ////////////////////////////////////////////////////////////////////////////
-    Render::view('js/submit/invitation-form');
+    Render::view('js/submit/update-properties');
+?>
+
+<?php // credits
+  //////////////////////////////////////////////////////////////////////////////
+  Render::view('js/credits');
 ?>
 </html>