tomh104/nat-as-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

securing translation endpoint
Some checks failed
PHPUnit / test (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Tom Hempel
2026-07-18 13:40:06 +02:00
parent 154535edc2
commit 06d53c564e
4 changed files with 133 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
handlers/app_questionnaires.php
View File

@ -3,7 +3,8 @@
* Android app API endpoint.
* GET (no params) -> ordered questionnaire list with conditions
* GET ?id=<questionnaireID> -> single questionnaire in app JSON format
* GET ?translations=1 -> global app UI strings only (not questionnaire content); **no auth** (login screen).
* GET ?translations=1 -> global app UI strings only (not questionnaire content); requires Bearer token
* GET ?loginTranslations=1 -> login + auth-help UI strings only; **no auth** (pre-login screen)
* GET ?clients=1 -> list of clients assigned to the authenticated coach
* GET ?clientCode=X&answers=1 -> all completed questionnaire answers for one client (encrypted)
* GET ?answersBulk=1 -> all assigned clients' answers in one payload (coach, encrypted)
@ -16,16 +17,22 @@
* Sensitive POST/GET ?clients=1 bodies use encrypted payloads (HKDF from Bearer token).
*/
// Public app UI catalog for the login screen (no token, no PII).
if ($method === 'GET' && !empty($_GET['translations'])) {
// Public login-screen catalog (auth + help_auth only; no PII).
if ($method === 'GET' && !empty($_GET['loginTranslations'])) {
$opened = qdb_open_read_or_fail();
[$pdo, $tmpDb, $lockFp] = $opened;
json_success([
'translations' => qdb_build_app_translations_map($pdo),
'availableLanguages' => qdb_available_language_codes($pdo),
]);
$payload = [
'translations' => qdb_build_public_login_translations_map($pdo),
'availableLanguages' => array_values(array_intersect(
qdb_available_language_codes($pdo),
['de', 'en'],
)),
];
if ($payload['availableLanguages'] === []) {
$payload['availableLanguages'] = ['de', 'en'];
}
qdb_discard($tmpDb, $lockFp);
return;
json_success($payload);
}
$tokenRec = require_valid_token();
@ -393,6 +400,15 @@ $fetchScoringProfiles = $_GET['scoringProfiles'] ?? '';
$fetchScoringReview = $_GET['scoringReview'] ?? '';
$clientCode = trim($_GET['clientCode'] ?? '');
if ($translations) {
$payload = [
'translations' => qdb_build_app_translations_map($pdo),
'availableLanguages' => qdb_available_language_codes($pdo),
];
qdb_discard($tmpDb, $lockFp);
json_success($payload);
}
if ($fetchScoringProfiles) {
require_role(['coach'], $tokenRec);
require_once __DIR__ . '/../lib/scoring.php';