120 lines
4.4 KiB
PHP
120 lines
4.4 KiB
PHP
<?php declare(strict_types=1);
|
|
|
|
namespace FeedReaderCentral;
|
|
|
|
use BitBadger\PDODocument\{DocumentException, Field, Patch};
|
|
|
|
/**
|
|
* Security functions
|
|
*/
|
|
class Security
|
|
{
|
|
/** @var int Run as a single user requiring no password */
|
|
public const SINGLE_USER = 0;
|
|
|
|
/** @var int Run as a single user requiring a password */
|
|
public const SINGLE_USER_WITH_PASSWORD = 1;
|
|
|
|
/** @var int Require users to provide e-mail address and password */
|
|
public const MULTI_USER = 2;
|
|
|
|
/** @var string The e-mail address for the single user */
|
|
public const SINGLE_USER_EMAIL = 'solouser@example.com';
|
|
|
|
/** @var string The password for the single user with no password */
|
|
public const SINGLE_USER_PASSWORD = 'no-password-required';
|
|
|
|
/** @var string The password algorithm to use for our passwords */
|
|
public const PW_ALGORITHM = PASSWORD_DEFAULT;
|
|
|
|
/**
|
|
* Verify a user's password
|
|
*
|
|
* @param User $user The user information retrieved from the database
|
|
* @param string $password The password provided by the user
|
|
* @param string|null $returnTo The URL to which the user should be redirected
|
|
* @throws DocumentException if any is encountered
|
|
*/
|
|
private static function verifyPassword(User $user, string $password, ?string $returnTo): void
|
|
{
|
|
if (password_verify($password, $user->password)) {
|
|
if (password_needs_rehash($user->password, self::PW_ALGORITHM)) {
|
|
Patch::byId(Table::USER, $user->id, ['password' => password_hash($password, self::PW_ALGORITHM)]);
|
|
}
|
|
$_SESSION[Key::USER_ID] = $user->id;
|
|
$_SESSION[Key::USER_EMAIL] = $user->email;
|
|
frc_redirect($returnTo ?? '/');
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Log on a user with e-mail address and password
|
|
*
|
|
* @param string $email The e-mail address for the user (cannot be the single-user mode user)
|
|
* @param string $password The password provided by the user
|
|
* @param string|null $returnTo The URL to which the user should be redirected
|
|
* @throws DocumentException If any is encountered
|
|
*/
|
|
public static function logOnUser(string $email, string $password, ?string $returnTo): void {
|
|
if (SECURITY_MODEL == self::SINGLE_USER_WITH_PASSWORD) {
|
|
$dbEmail = self::SINGLE_USER_EMAIL;
|
|
} else {
|
|
if ($email == self::SINGLE_USER_EMAIL) {
|
|
add_error('Invalid credentials; log on unsuccessful');
|
|
return;
|
|
}
|
|
$dbEmail = $email;
|
|
}
|
|
$user = User::findByEmail($dbEmail);
|
|
if ($user) self::verifyPassword($user, $password, $returnTo);
|
|
add_error('Invalid credentials; log on unsuccessful');
|
|
}
|
|
|
|
/**
|
|
* Update the password for the given user
|
|
*
|
|
* @param string $email The e-mail address of the user whose password should be updated
|
|
* @param string $password The new password for this user
|
|
* @throws DocumentException If any is encountered
|
|
*/
|
|
public static function updatePassword(string $email, string $password): void {
|
|
Patch::byFields(Table::USER, [Field::EQ('email', $email)],
|
|
['password' => password_hash($password, self::PW_ALGORITHM)]);
|
|
}
|
|
|
|
/**
|
|
* Log on the single user
|
|
*
|
|
* @throws DocumentException If any is encountered
|
|
*/
|
|
private static function logOnSingleUser(): void {
|
|
$user = User::findByEmail(self::SINGLE_USER_EMAIL);
|
|
if (!$user) {
|
|
User::add(self::SINGLE_USER_EMAIL, self::SINGLE_USER_PASSWORD);
|
|
$user = User::findByEmail(self::SINGLE_USER_EMAIL);
|
|
}
|
|
self::verifyPassword($user, self::SINGLE_USER_PASSWORD, $_GET['returnTo']);
|
|
}
|
|
|
|
/**
|
|
* Verify that user is logged on
|
|
*
|
|
* @param bool $redirectIfAnonymous Whether to redirect the request if there is no user logged on
|
|
* @throws DocumentException If any is encountered
|
|
*/
|
|
public static function verifyUser(bool $redirectIfAnonymous = true): void {
|
|
if (key_exists(Key::USER_ID, $_SESSION)) return;
|
|
|
|
if (SECURITY_MODEL == self::SINGLE_USER) self::logOnSingleUser();
|
|
|
|
if (SECURITY_MODEL != self::SINGLE_USER_WITH_PASSWORD && SECURITY_MODEL != self::MULTI_USER) {
|
|
die('Unrecognized security model (' . SECURITY_MODEL . ')');
|
|
}
|
|
|
|
if ($redirectIfAnonymous) {
|
|
header("Location: /user/log-on?returnTo={$_SERVER['REQUEST_URI']}", true, 307);
|
|
die();
|
|
}
|
|
}
|
|
}
|