287 lines
10 KiB
PHP
287 lines
10 KiB
PHP
<?php
|
|
|
|
require_once __DIR__ . '/../lib/settings.php';
|
|
require_once __DIR__ . '/../lib/login_rate_limit.php';
|
|
require_once __DIR__ . '/../lib/keycloak_auth.php';
|
|
|
|
switch ($route) {
|
|
|
|
case 'auth/login':
|
|
if ($method !== 'POST') {
|
|
json_error('METHOD_NOT_ALLOWED', 'Method not allowed', 405);
|
|
}
|
|
|
|
$body = read_json_body();
|
|
$username = trim($body['username'] ?? '');
|
|
$password = (string)($body['password'] ?? '');
|
|
|
|
if ($username === '' || $password === '') {
|
|
json_error('MISSING_FIELDS', 'Username and password are required', 400);
|
|
}
|
|
|
|
$securitySettings = qdb_settings_get();
|
|
[$allowed, $retryAfter] = qdb_login_rate_limit_check($username, $securitySettings);
|
|
if (!$allowed) {
|
|
qdb_login_rate_limit_deny($retryAfter);
|
|
}
|
|
|
|
try {
|
|
[$pdo, $tmpDb, $lockFp] = qdb_open_read_or_fail();
|
|
$stmt = $pdo->prepare(
|
|
"SELECT userID, passwordHash, role, entityID, mustChangePassword
|
|
FROM users WHERE username = :u"
|
|
);
|
|
$stmt->execute([':u' => $username]);
|
|
$user = $stmt->fetch(PDO::FETCH_ASSOC);
|
|
|
|
if (!$user || !password_verify($password, $user['passwordHash'])) {
|
|
qdb_discard($tmpDb, $lockFp);
|
|
$retryAfter = qdb_login_rate_limit_record_failure($username, $securitySettings);
|
|
if ($retryAfter > 0) {
|
|
qdb_login_rate_limit_deny($retryAfter);
|
|
}
|
|
json_error('INVALID_CREDENTIALS', 'Invalid username or password', 401);
|
|
}
|
|
|
|
qdb_login_rate_limit_clear($username);
|
|
|
|
$assignedClients = [];
|
|
if (($user['role'] ?? '') === 'coach' && ($user['entityID'] ?? '') !== '') {
|
|
$cStmt = $pdo->prepare(
|
|
"SELECT clientCode FROM client
|
|
WHERE coachID = :cid AND COALESCE(archived, 0) = 0
|
|
ORDER BY clientCode"
|
|
);
|
|
$cStmt->execute([':cid' => $user['entityID']]);
|
|
$assignedClients = array_map(
|
|
fn($code) => ['clientCode' => $code],
|
|
$cStmt->fetchAll(PDO::FETCH_COLUMN)
|
|
);
|
|
}
|
|
|
|
qdb_discard($tmpDb, $lockFp);
|
|
|
|
qdb_reject_coach_web_login((string)($user['role'] ?? ''));
|
|
|
|
if ((int)$user['mustChangePassword'] === 1) {
|
|
$tempToken = bin2hex(random_bytes(32));
|
|
token_add($tempToken, qdb_session_ttl_seconds($securitySettings, true), [
|
|
'role' => $user['role'],
|
|
'entityID' => $user['entityID'],
|
|
'userID' => $user['userID'],
|
|
'temp' => true,
|
|
]);
|
|
json_success([
|
|
'mustChangePassword' => true,
|
|
'token' => $tempToken,
|
|
'user' => $username,
|
|
'role' => $user['role'],
|
|
]);
|
|
}
|
|
|
|
$token = bin2hex(random_bytes(32));
|
|
token_add($token, qdb_session_ttl_seconds($securitySettings, false), [
|
|
'role' => $user['role'],
|
|
'entityID' => $user['entityID'],
|
|
'userID' => $user['userID'],
|
|
]);
|
|
$loginData = [
|
|
'token' => $token,
|
|
'user' => $username,
|
|
'role' => $user['role'],
|
|
];
|
|
if ($assignedClients !== []) {
|
|
$loginData['clientsPayload'] = qdb_sensitive_envelope(
|
|
json_encode(['clients' => $assignedClients], JSON_UNESCAPED_UNICODE),
|
|
$token
|
|
);
|
|
}
|
|
json_success($loginData);
|
|
} catch (Throwable $e) {
|
|
qdb_handler_fail($e, 'auth', null, $tmpDb ?? null, $lockFp ?? null);
|
|
}
|
|
break;
|
|
|
|
case 'auth/change-password':
|
|
if ($method !== 'POST') {
|
|
json_error('METHOD_NOT_ALLOWED', 'Method not allowed', 405);
|
|
}
|
|
|
|
$bearerToken = get_bearer_token();
|
|
if (!$bearerToken) {
|
|
json_error('UNAUTHORIZED', 'Bearer token required', 401);
|
|
}
|
|
$tokenRec = token_get_record($bearerToken);
|
|
if (!$tokenRec) {
|
|
json_error('FORBIDDEN', 'Invalid or expired token', 403);
|
|
}
|
|
|
|
$body = read_json_body();
|
|
$username = trim($body['username'] ?? '');
|
|
$oldPassword = (string)($body['old_password'] ?? '');
|
|
$newPassword = (string)($body['new_password'] ?? '');
|
|
|
|
if ($username === '' || $oldPassword === '' || $newPassword === '') {
|
|
json_error('MISSING_FIELDS', 'username, old_password, and new_password are required', 400);
|
|
}
|
|
if (strlen($newPassword) < 6) {
|
|
json_error('PASSWORD_TOO_SHORT', 'New password must be at least 6 characters', 400);
|
|
}
|
|
|
|
if (($tokenRec['userID'] ?? '') === '') {
|
|
json_error('FORBIDDEN', 'Token not associated with a user', 403);
|
|
}
|
|
|
|
try {
|
|
[$pdo, $tmpDb, $lockFp] = qdb_open_write_or_fail();
|
|
|
|
$stmt = $pdo->prepare(
|
|
"SELECT userID, passwordHash, role, entityID FROM users WHERE username = :u"
|
|
);
|
|
$stmt->execute([':u' => $username]);
|
|
$user = $stmt->fetch(PDO::FETCH_ASSOC);
|
|
|
|
if (!$user) {
|
|
qdb_discard($tmpDb, $lockFp);
|
|
json_error('INVALID_CREDENTIALS', 'Invalid credentials', 401);
|
|
}
|
|
|
|
if ($user['userID'] !== $tokenRec['userID']) {
|
|
qdb_discard($tmpDb, $lockFp);
|
|
json_error('FORBIDDEN', 'Token does not match user', 403);
|
|
}
|
|
|
|
qdb_reject_coach_web_login((string)($user['role'] ?? ''));
|
|
|
|
if (!password_verify($oldPassword, $user['passwordHash'])) {
|
|
qdb_discard($tmpDb, $lockFp);
|
|
json_error('INVALID_CREDENTIALS', 'Old password incorrect', 401);
|
|
}
|
|
|
|
$newHash = password_hash($newPassword, PASSWORD_DEFAULT);
|
|
$pdo->prepare(
|
|
"UPDATE users SET passwordHash = :h, mustChangePassword = 0 WHERE userID = :uid"
|
|
)->execute([':h' => $newHash, ':uid' => $user['userID']]);
|
|
|
|
token_revoke_all_for_user_on_pdo($pdo, $user['userID']);
|
|
|
|
qdb_save($tmpDb, $lockFp);
|
|
|
|
$securitySettings = qdb_settings_get();
|
|
|
|
// Issue a fresh session for this browser only
|
|
$newToken = bin2hex(random_bytes(32));
|
|
token_add($newToken, qdb_session_ttl_seconds($securitySettings, false), [
|
|
'role' => $user['role'],
|
|
'entityID' => $user['entityID'],
|
|
'userID' => $user['userID'],
|
|
]);
|
|
|
|
json_success([
|
|
'token' => $newToken,
|
|
'user' => $username,
|
|
'role' => $user['role'],
|
|
]);
|
|
} catch (Throwable $e) {
|
|
qdb_handler_fail($e, 'auth', null, $tmpDb ?? null, $lockFp ?? null);
|
|
}
|
|
break;
|
|
|
|
case 'auth/keycloak-config':
|
|
if ($method !== 'GET') {
|
|
json_error('METHOD_NOT_ALLOWED', 'Method not allowed', 405);
|
|
}
|
|
$kcConfig = qdb_keycloak_config();
|
|
json_success([
|
|
'enabled' => qdb_keycloak_is_configured($kcConfig),
|
|
'displayName' => $kcConfig['display_name'],
|
|
'loginUrl' => qdb_keycloak_is_configured($kcConfig) ? 'auth/keycloak-login' : '',
|
|
]);
|
|
break;
|
|
|
|
case 'auth/keycloak-login':
|
|
if ($method !== 'GET') {
|
|
json_error('METHOD_NOT_ALLOWED', 'Method not allowed', 405);
|
|
}
|
|
$kcConfig = qdb_keycloak_config();
|
|
if (!qdb_keycloak_is_configured($kcConfig)) {
|
|
json_error('KEYCLOAK_NOT_CONFIGURED', 'University login is not configured', 503);
|
|
}
|
|
try {
|
|
$discovery = qdb_keycloak_discovery($kcConfig);
|
|
$nonce = bin2hex(random_bytes(16));
|
|
$params = [
|
|
'client_id' => $kcConfig['client_id'],
|
|
'redirect_uri' => $kcConfig['redirect_uri'],
|
|
'response_type' => 'code',
|
|
'scope' => 'openid profile email',
|
|
'state' => qdb_keycloak_create_state($nonce),
|
|
'nonce' => $nonce,
|
|
];
|
|
qdb_keycloak_redirect($discovery['authorization_endpoint'] . '?' . http_build_query($params));
|
|
} catch (Throwable $e) {
|
|
qdb_handler_fail($e, 'keycloak-login', null, null, null);
|
|
}
|
|
break;
|
|
|
|
case 'auth/keycloak-callback':
|
|
if ($method !== 'GET') {
|
|
json_error('METHOD_NOT_ALLOWED', 'Method not allowed', 405);
|
|
}
|
|
if (isset($_GET['error'])) {
|
|
json_error('KEYCLOAK_DENIED', 'University login was cancelled or denied', 401);
|
|
}
|
|
$code = trim((string)($_GET['code'] ?? ''));
|
|
$state = trim((string)($_GET['state'] ?? ''));
|
|
if ($code === '' || $state === '') {
|
|
json_error('MISSING_FIELDS', 'Keycloak callback requires code and state', 400);
|
|
}
|
|
$kcConfig = qdb_keycloak_config();
|
|
if (!qdb_keycloak_is_configured($kcConfig)) {
|
|
json_error('KEYCLOAK_NOT_CONFIGURED', 'University login is not configured', 503);
|
|
}
|
|
try {
|
|
qdb_keycloak_verify_state($state);
|
|
$discovery = qdb_keycloak_discovery($kcConfig);
|
|
$tokenResponse = qdb_keycloak_exchange_code($kcConfig, $discovery, $code);
|
|
$accessToken = (string)($tokenResponse['access_token'] ?? '');
|
|
if ($accessToken === '') {
|
|
json_error('KEYCLOAK_TOKEN_FAILED', 'University login did not return an access token', 401);
|
|
}
|
|
$claims = qdb_keycloak_userinfo($discovery, $accessToken);
|
|
$username = qdb_keycloak_claim_username($kcConfig, $claims);
|
|
|
|
[$pdo, $tmpDb, $lockFp] = qdb_open_read_or_fail();
|
|
$stmt = $pdo->prepare(
|
|
"SELECT userID, role, entityID, mustChangePassword
|
|
FROM users WHERE username = :u"
|
|
);
|
|
$stmt->execute([':u' => $username]);
|
|
$user = $stmt->fetch(PDO::FETCH_ASSOC);
|
|
qdb_discard($tmpDb, $lockFp);
|
|
|
|
if (!$user) {
|
|
json_error('KEYCLOAK_USER_NOT_ALLOWED', 'University account is not registered for this application', 403);
|
|
}
|
|
qdb_reject_coach_web_login((string)($user['role'] ?? ''));
|
|
if ((int)($user['mustChangePassword'] ?? 0) === 1) {
|
|
json_error('PASSWORD_CHANGE_REQUIRED', 'Please sign in locally once to change your temporary password before using University login', 403);
|
|
}
|
|
|
|
$securitySettings = qdb_settings_get();
|
|
$token = bin2hex(random_bytes(32));
|
|
token_add($token, qdb_session_ttl_seconds($securitySettings, false), [
|
|
'role' => $user['role'],
|
|
'entityID' => $user['entityID'],
|
|
'userID' => $user['userID'],
|
|
]);
|
|
qdb_keycloak_finish_html($token, $username, (string)$user['role']);
|
|
} catch (Throwable $e) {
|
|
qdb_handler_fail($e, 'keycloak-callback', null, $tmpDb ?? null, $lockFp ?? null);
|
|
}
|
|
break;
|
|
|
|
default:
|
|
json_error('NOT_FOUND', 'Unknown auth route', 404);
|
|
}
|