path: root/public/app/controllers/Auth.php

<?php
namespace app\controllers;

use Registry;
use Render;

// user classes and models
use app\extends\Classroom_user;
use app\extends\Classroom_manager;
use app\models\Access_model;
use app\extends\SendMail_service;



/** class Auth
 * 
 * handles user's Authentication and Authorizarion
 * 
 */
class Auth {

    /** login
     * 
     * checks visitor's credentials;
     * if valid, authenticates user
     * 
     */
    public static function login()
    {
        $req = Registry::get('REQUEST');

        // get the record of the target user
        $record = Access_model::checkUser($req->POST['email']);
       
        // if no user exists, return false
        if ($record === false)     return false;
        
        // user is valid; check user password
        // create a user object
        $user = (new Classroom_user())
            ->setID($record['id'])
            ->setUserName($record['email'])
            ->setName($record['first_name'] .' '. $record['last_name'])
            ->setPassword($record['password'])
            ->setEnabled($record['active']);

        // let user manager to validate user credentials
        $userManager = new Classroom_manager();
        
        if ($userManager->isPasswordValid($user, $req->POST['password'])) {

            // get user's security attributes
            $attributes = Access_model::getUser($record['id']);
            $roles = json_decode($attributes['Roles_json']);
            $user
                ->setRoles($roles)
                ->setPrivileges(
                    array_merge(
                        json_decode($attributes['RootPrivileges_json']),
                        self::merge_lists_array(
                            json_decode($attributes['SubPrivileges_json'])
                        )
                    )
                );
            
            // regeneration session ID (prevent session fixation)
            session_regenerate_id();
            // set cookie for connected user
            setcookie(
                'cluser',
                'connected;'. $user->getName(),
                time()+60*60*8,     // 8 hours
                '/'
            );

            // check if admin (and redirect differently)
            $is_admin = (!empty(array_intersect([1,2,3], $roles)));
    
            // login OK, set Token in session
            $userManager->createUserToken($user);
            return [
                'success' => true,
                'goto' => $is_admin ? '/admin/lessons' : '/user/profile',
            ];
    
        } else {
            return false;
        }
    }


    /**
     * merges an array of lists to one list
     */
    private static function merge_lists_array( $list )
    {
        $current = [];
        foreach($list as $sublist) {
            $current = array_merge($current, $sublist);
        }
        return $current;
    }


    /** activate
     * resolves a call like: /account/activate?ticket=ca42d68cfba5fbbafeacc010b8e3a551
     */
    public static function activate()
    {
        $req = Registry::get('REQUEST');

        // get the record of the target user
        $check = Access_model::activate($req->GET['ticket']);

        if ($check == true) {
            Render::view('/error/general', [
                'title' => ACCOUNT_ACTIVATED_TITLE,
                 'message' => ACCOUNT_ACTIVATED_MESSAGE
            ]);

        } else  {
            Render::view('/error/general', [
                'title' => NOT_VALID_ACTIVATION_TITLE,
                 'message' => NOT_VALID_ACTIVATION_MESSAGE
            ]);
        }

    }

    /** register
     * 
     * Method for new user registration
     * 
     */
    public static function register()
    {
        $userManager = new Classroom_manager();
        $req = Registry::get('REQUEST');

        // create a salted password hash
        $password = $userManager->cryptPassword($req->POST['password']);

        // echo $password; print_r($req->POST); die(); // OK!
        
        $user = (new Classroom_user())
            ->setUserName($req->POST['email'])
            ->setName($req->POST['name'] .' '. $req->POST['surname'])
            ->setPassword($password)
            ->setRoles([ READER ])      // Role: authorized reader
            ->setPrivileges([]);        // none privilege until acount confirmation

        // create user record
        $activation_code = Access_model::registerUser($req->POST, $password);

        // TODO:
        // handle error on user registration
        // ...
        //
        // if ($activatopn_code[] == -1) {
        //     return [
        //         'success' => false,
        //         'message' => REGISTRATION_USER_EXISTS
        //     ];
        // }

        $send_mail = SendMail_service::send_activation_code([
            'email' => $req->POST['email'],
            'name' => $req->POST['name'] .' '. $req->POST['surname'],
            'code' => $activation_code['activation']
        ]);

        // Send replies
        if ($send_mail) {
            return [
                'success' => true,
                'message' => REGISTRATION_SUCCESS
            ];

        } else {
            return [
                'success' => false,
                'message' => 'error on sending email'
            ];
        }  

    }

    /** is_connected
     * checks if the user is connected
     * 
     * @return true|false
     */
    public static function is_connected()
    {
        $manager = new Classroom_manager();
        if ($manager->hasUserToken()) {

            // user is connected;
            $token = $manager->getUserToken();
            $user = $token->getUser();

            return $user;

        } else {
            // user is not connected;
            return false;
        }
    }


    /** logout
     * 
     * performs a secure logout;
     * regenerates session; deletes cookies;
     */
    public static function logout()
    {
        $userManager = new Classroom_manager();
        $userManager->logout();

        // regeneration session ID (prevent session fixation)
        session_regenerate_id();

        // remove user-conected cookie
        if (isset($_COOKIE['cluser'])) {
            unset($_COOKIE['cluser']); 
            setcookie('cluser', '', -1, '/'); 
            return true;
            
        } else {
            return false;
        }
    }



    /** hasPermition( PERMIT )
     * 
     * checks if the user owns the specified permition
     * to access the source
     * 
     */
    public static function hasPermition($permit = [0])
    {
        if (in_array(0, $permit)) {     // permision 0 means public
            return true;        // permision 0 is always granted
        }

        if ($user = self::is_connected() === false) {      // if not connected
            return false;           // then no other permition is granted
        }

        if ($user instanceof UserInterface) {
            return ( !empty( array_intersect($permit, $user->getPrivileges()) ) );
        }
    }


    /** isAuthenticated()
     * 
     * chechs if the user's roles and permitions
     * satisfy the specified requirements 
     * to access the source
     * 
     * @param $requirements (array of rules-array)
     * 
     * example:
     * [
     *    [
     *       role => [2, 3]
     *       permition => ['10', '12', '18']
     *    ],
     *    [
     *       role => [1 , 4]
     *    ],
     *    [
     *       permition => [ 3 ]
     *    ]
     * ]
     * 
     * defines (and parses to) a requirements rule of:
     * [
     *    user should be creator or editor
     *    _AND_ have permition 10 or 12 or 18
     * ]
     * OR
     * [
     *    user should be an administrator or developer
     * ]
     * OR
     * [
     *    user should have permition #3
     * ]
     *
     * 
     */
    public static function isAuthorized($requirements)
    {
        $authorized = false;
        foreach($requirements as $required) {

            if (isset($required['role'])) {         // if a role is required
                if ( (self::isGranted($required['role']))       // authorize both role
                && (self::hasPermition($required['permition'] ?? [ 0 ])) ) {    // and permition
                    // $authorized = true;
                    return true;
                }

            } else {    // else, if not is not required
                if (self::hasPermition($required['permition'] ?? [ 0 ])) {  // authorize permition
                    // $authorized = true;
                    return true;
                }
            }
        }
        return $authorized;
    }


    public static function forgot_pass()
    {
    }



    public static function validate_otp()
    {
    }


    /** allowRoles
     * 
     * method filters access for certain roles
     * if user is not grented acces, a forbiden message is sent and app ends._
     * otherwise the method returns true (app will continue)
     * 
     * @param $allowed (array) : array of allowed roles
     * @return true or die();
     */
    public static function allowRoles($allowed)
    {
        $manager = new Classroom_manager();
        if ($manager->isGranted($allowed)) {    // if valid, return true (continue)
            return true;

        } else {    // no user, no access; die._
            Render::view('error/general', [
                'title' => 'Forbidden',
                'message' => 'Access is forbidden'
            ]);
            die();
            return false;       // this line will never run
        }
    }


    /** hasValidRole
     * like allowRoles() but dowes not stop execution
     * 
     * @return true|false
     */
    public static function hasValidRole($allowed)
    {
        $manager = new Classroom_manager();
        return ($manager->isGranted($allowed));
    }


    public static function in_admin_group()
    {
        $manager = new Classroom_manager();
        return ($manager->isGranted([1, 2, 3]));
    }


    
}


// NOTE:
// check: https://netcorecloud.com/tutorials/send-an-email-via-gmail-smtp-server-using-php/