fs
25370a1a55
- Add icanhazstring/composer-unused as dev dependency for dependency hygiene checks - Add German documentation (docs/) covering architecture, conventions, workflows, and developer checklists - Add API layer (ApiAuth, ApiBootstrap, ApiResponse), audit, scheduler, custom fields, and SSO services - Add Microsoft OIDC SSO, API token management, and user lifecycle features - Add swagger-ui vendor integration and OpenAPI spec - Add production Docker setup and bin/ scripts - Update composer dependencies, config, templates, and frontend assets throughout Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
87 lines
2.3 KiB
PHP
87 lines
2.3 KiB
PHP
<?php
|
|
|
|
namespace MintyPHP\Http;
|
|
|
|
use MintyPHP\I18n;
|
|
use MintyPHP\Router;
|
|
|
|
/**
|
|
* Handles public path detection and authentication guards.
|
|
*/
|
|
class AccessControl
|
|
{
|
|
/** Prefixes that are always public */
|
|
private const ALWAYS_PUBLIC_PREFIXES = [
|
|
'branding/',
|
|
'auth/tenant-avatar-file',
|
|
'flash/',
|
|
'auth/microsoft/',
|
|
'api/',
|
|
];
|
|
|
|
private array $configuredPublicPaths;
|
|
|
|
public function __construct(?array $publicPaths = null)
|
|
{
|
|
$this->configuredPublicPaths = $publicPaths ?? (defined('APP_PUBLIC_PATHS') ? APP_PUBLIC_PATHS : []);
|
|
}
|
|
|
|
/**
|
|
* Check if a path is publicly accessible (no authentication required).
|
|
*/
|
|
public function isPublicPath(string $path): bool
|
|
{
|
|
$normalizedPath = $this->normalizePath($path);
|
|
|
|
// Root path check
|
|
if ($normalizedPath === '/') {
|
|
return in_array('/', $this->configuredPublicPaths, true);
|
|
}
|
|
|
|
// Check configured public paths
|
|
if (in_array($normalizedPath, $this->configuredPublicPaths, true)) {
|
|
return true;
|
|
}
|
|
|
|
// Check page/ prefix with slug lookup
|
|
if (str_starts_with($normalizedPath, 'page/')) {
|
|
$pageSlug = substr($normalizedPath, strlen('page/'));
|
|
if (in_array($pageSlug, $this->configuredPublicPaths, true)) {
|
|
return true;
|
|
}
|
|
}
|
|
|
|
// Check always-public prefixes
|
|
foreach (self::ALWAYS_PUBLIC_PREFIXES as $prefix) {
|
|
if (str_starts_with($normalizedPath, $prefix)) {
|
|
return true;
|
|
}
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Redirect to login if the path requires authentication and user is not logged in.
|
|
*
|
|
* @return bool True if access is allowed, false if redirected
|
|
*/
|
|
public function requireAuthOrRedirect(string $path, bool $isLoggedIn): bool
|
|
{
|
|
if ($this->isPublicPath($path) || $isLoggedIn) {
|
|
return true;
|
|
}
|
|
|
|
$locale = I18n::$locale ?? I18n::$defaultLocale;
|
|
Router::redirect(Request::withLocale('login', $locale));
|
|
|
|
return false;
|
|
}
|
|
|
|
private function normalizePath(string $path): string
|
|
{
|
|
$normalized = trim($path, '/');
|
|
return $normalized === '' ? '/' : $normalized;
|
|
}
|
|
}
|