fs
0e86925464
Rename the top-level lib/ directory to core/ so the project root immediately communicates which code is core platform and which lives in modules/. PHP namespaces (MintyPHP\*) are unchanged — only the Composer PSR-4 path mapping moves from lib/ to core/. Module-internal lib/ directories (modules/*/lib/) are untouched. Updated across the full stack: - composer.json PSR-4 mapping - bootstrap entry points (web/index.php, bin/*, tests/bootstrap.php) - tooling configs (phpstan.neon, phpunit.xml, php-cs-fixer) - 26 architecture contract tests - enforcement-policy, guard-catalog, quality-gates - all documentation (CLAUDE.md, README, 25 docs/, .agents/skills/) - bin/qa-extended.sh search paths - .claude/settings.local.json permission paths Workflow: .agents/runs/CORE-LIB-RENAME-001/ (Analyst → Planner → Executor → Code Review (4 findings fixed) → Security Review → Acceptance Test → Finalizer) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
101 lines
2.8 KiB
PHP
101 lines
2.8 KiB
PHP
<?php
|
|
|
|
namespace MintyPHP\Http;
|
|
|
|
use MintyPHP\I18n;
|
|
use MintyPHP\Router;
|
|
|
|
/**
|
|
* Handles public path detection and authentication guards.
|
|
*/
|
|
class AccessControl
|
|
{
|
|
/** Prefixes that are always public */
|
|
private const ALWAYS_PUBLIC_PREFIXES = [
|
|
'branding/',
|
|
'auth/tenant-avatar-file',
|
|
'flash/',
|
|
'auth/microsoft/',
|
|
'api/',
|
|
];
|
|
|
|
private array $configuredPublicPaths;
|
|
private IntendedUrlService $intendedUrlService;
|
|
|
|
public function __construct(array $publicPaths, IntendedUrlService $intendedUrlService)
|
|
{
|
|
$normalizedPaths = [];
|
|
foreach ($publicPaths as $path) {
|
|
$rawPath = trim((string) $path);
|
|
if ($rawPath === '') {
|
|
continue;
|
|
}
|
|
$normalizedPaths[] = $rawPath === '/' ? '/' : trim($rawPath, '/');
|
|
}
|
|
|
|
$this->configuredPublicPaths = array_values(array_unique($normalizedPaths));
|
|
$this->intendedUrlService = $intendedUrlService;
|
|
}
|
|
|
|
/**
|
|
* Check if a path is publicly accessible (no authentication required).
|
|
*/
|
|
public function isPublicPath(string $path): bool
|
|
{
|
|
$normalizedPath = $this->normalizePath($path);
|
|
|
|
// Root path check
|
|
if ($normalizedPath === '/') {
|
|
return in_array('/', $this->configuredPublicPaths, true);
|
|
}
|
|
|
|
// Check configured public paths
|
|
if (in_array($normalizedPath, $this->configuredPublicPaths, true)) {
|
|
return true;
|
|
}
|
|
|
|
// Check always-public prefixes
|
|
foreach (self::ALWAYS_PUBLIC_PREFIXES as $prefix) {
|
|
if (str_starts_with($normalizedPath, $prefix)) {
|
|
return true;
|
|
}
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Redirect to login if the path requires authentication and user is not logged in.
|
|
*
|
|
* @return bool True if access is allowed, false if redirected
|
|
*/
|
|
/**
|
|
* Redirect to login if the path requires authentication and user is not logged in.
|
|
* Appends ?return_to= so the user is redirected back after login.
|
|
*
|
|
* @return bool True if access is allowed, false if redirected
|
|
*/
|
|
public function requireAuthOrRedirect(string $path, bool $isLoggedIn): bool
|
|
{
|
|
if ($this->isPublicPath($path) || $isLoggedIn) {
|
|
return true;
|
|
}
|
|
|
|
$locale = I18n::$locale ?? I18n::$defaultLocale;
|
|
$loginPath = Request::withLocale('login', $locale);
|
|
|
|
$requestUri = $_SERVER['REQUEST_URI'] ?? '';
|
|
$loginTarget = $this->intendedUrlService->buildLoginRedirect($loginPath, $requestUri);
|
|
|
|
Router::redirect($loginTarget);
|
|
|
|
return false;
|
|
}
|
|
|
|
private function normalizePath(string $path): string
|
|
{
|
|
$normalized = trim($path, '/');
|
|
return $normalized === '' ? '/' : $normalized;
|
|
}
|
|
}
|