diff options
Diffstat (limited to 'public/app/controllers/Auth.php')
| -rw-r--r-- | public/app/controllers/Auth.php | 142 |
1 files changed, 98 insertions, 44 deletions
diff --git a/public/app/controllers/Auth.php b/public/app/controllers/Auth.php index cbf4d19..02a059f 100644 --- a/public/app/controllers/Auth.php +++ b/public/app/controllers/Auth.php @@ -20,23 +20,18 @@ use app\extends\SendMail_service; */ class Auth { - /** AJAX POST: login + ## handle user's record / token / session + ## ------------------------------------------------------------------------- + + /** user from record * - * checks visitor's credentials; - * if valid, authenticates user + * create and return a user based on the record of properties * + * @param array $record + * @return AppUser */ - public static function login() + private static function user_fromRecord($record) { - $req = Registry::get('REQUEST'); - - // get the record of the target user - $record = Access_model::checkUser($req->POST['email']); - - // if no user exists, return false - if ($record === false) return false; - - // user is valid; check user password // create a user object $user = (new App_user()) ->setID($record['id']) @@ -56,37 +51,89 @@ class Auth { ->set('position', $record['position']) ->set('registration_number', $record['registration_number']) ->set('belonging_school', $record['belonging_school']); + return $user; + } - // let user manager to validate user credentials + /** setSessionToken_forUser + * (RE-)set Session-Token for specified user object + * + * @param AppUser $user + */ + private static function setSessionToken_forUser($user) + { $userManager = new App_manager(); + + // regeneration session ID (prevent session fixation) + session_unset(); // unset $_SESSION variable for the run-time + session_destroy(); // destroy session data in storage before continue + session_start(); + session_regenerate_id(); + + // set cookie for connected user + setcookie( + CONNECTION_COOKIE, + rawurlencode(json_encode( + [ 'rid' => $user->getRoles()[0], 'name' => $user->getName() ], + JSON_UNESCAPED_UNICODE + )), + [ + 'expires' =>time()+60*60*10, // 10 hours + 'path' => '/', + // 'domain' => COOKIE_DOMAIN, + 'secure' => COOKIE_SECURE, + 'samesite' => COOKIE_SAMESITE + ] + ); + + // login OK, set Token in session + $userManager->createUserToken($user); + + return true; + } + + + /** update session token + * + */ + private static function reset_user_token($uid) + { + $rec = Access_model::getUser_byID($uid); + if ($rec !== false) { + $user = self::user_fromRecord($rec); + self::setSessionToken_forUser($user); + } + return true; + } + + + ## handle comon ajax requests + ## (login, activate. update etc ) + ## ------------------------------------------------------------------------- + + /** AJAX POST: login + * + * checks visitor's credentials; + * if valid, authenticates user + * + */ + public static function login() + { + $req = Registry::get('REQUEST'); + + // get the record of the target user + $record = Access_model::checkUser($req->POST['email']); + + // if no user exists, return false + if ($record === false) return false; + // user is valid; check user password + $user = self::user_fromRecord($record); // create User object + $userManager = new App_manager(); // let Manager to check if ($userManager->isPasswordValid($user, $req->POST['password'])) { - // regeneration session ID (prevent session fixation) - session_unset(); // unset $_SESSION variable for the run-time - session_destroy(); // destroy session data in storage before continue - session_start(); - session_regenerate_id(); - - // set cookie for connected user - setcookie( - CONNECTION_COOKIE, - rawurlencode(json_encode( - [ 'rid' => $record['role_id'], 'name' => $user->getName() ], - JSON_UNESCAPED_UNICODE - )), - [ - 'expires' =>time()+60*60*10, // 10 hours - 'path' => '/', - // 'domain' => COOKIE_DOMAIN, - 'secure' => COOKIE_SECURE, - 'samesite' => COOKIE_SAMESITE - ] - ); - - // login OK, set Token in session - $userManager->createUserToken($user); + self::setSessionToken_forUser($user); // re-set Session Token + return [ 'success' => true, 'goto' => '/panel' @@ -143,24 +190,28 @@ class Auth { { $req = Registry::get('REQUEST'); $manager = new App_manager(); - ; - // print_r($req->POST); die(); + $uid = $manager->getUserToken()->getUser()->getID(); // ask model to update user; get user-id from user-manager $check = Access_model::update_user( $req->POST, - $manager->getUserToken()->getUser()->getID() + $uid ); - // TODO: message for user updating properties + // user properties changed, so update user's session token + self::reset_user_token($uid); + Render::json([ - 'title' => ACCOUNT_ACTIVATED_TITLE, - 'message' => ACCOUNT_ACTIVATED_MESSAGE . '<br>(msg code: '. $check .')' + 'title' => ACCOUNT_UPDATED_TITLE, + 'message' => ACCOUNT_UPDATED_MESSAGE . '<br>(msg code: '. $check .')' ]); } + ## serve user management forms + ## ------------------------------------------------------------------------- + /** SERVE FORM: invitation * * setups and renders the form for a certain invitation @@ -260,6 +311,9 @@ class Auth { } + ## suplamentary methods + ## ------------------------------------------------------------------------- + /** is_connected * checks if the user is connected * |