forked from fa/breadcrumb-the-shire
367 lines
13 KiB
PHP
367 lines
13 KiB
PHP
<?php
|
|
|
|
namespace MintyPHP\Service\Auth;
|
|
|
|
use MintyPHP\Auth;
|
|
use MintyPHP\Repository\User\UserReadRepositoryInterface;
|
|
use MintyPHP\Repository\User\UserWriteRepositoryInterface;
|
|
use MintyPHP\Router;
|
|
use MintyPHP\Service\Audit\SystemAuditService;
|
|
use MintyPHP\Service\User\UserAccountService;
|
|
use MintyPHP\Service\User\UserTenantContextService;
|
|
use MintyPHP\Session;
|
|
use MintyPHP\Support\Flash;
|
|
|
|
class AuthService
|
|
{
|
|
public function __construct(
|
|
private readonly UserReadRepositoryInterface $userReadRepository,
|
|
private readonly UserWriteRepositoryInterface $userWriteRepository,
|
|
private readonly UserAccountService $userAccountService,
|
|
private readonly UserTenantContextService $userTenantContextService,
|
|
private readonly RememberMeService $rememberMeService,
|
|
private readonly EmailVerificationService $emailVerificationService,
|
|
private readonly AuthPermissionGateway $permissionGateway,
|
|
private readonly AuthTenantSsoGateway $tenantSsoGateway,
|
|
private readonly AuthSavedFilterGateway $savedFilterGateway,
|
|
private readonly SystemAuditService $systemAuditService
|
|
) {
|
|
}
|
|
|
|
public function login(string $email, string $password): array
|
|
{
|
|
$email = trim($email);
|
|
|
|
// Check if email is verified before attempting login
|
|
$existingUser = $this->userReadRepository->findByEmail($email);
|
|
if ($existingUser && empty($existingUser['email_verified_at'])) {
|
|
$this->recordAuthEvent('auth.login.failed', 'failed', [
|
|
'error_code' => 'email_not_verified',
|
|
'metadata' => ['email_hash' => \MintyPHP\Http\RequestContext::hashValue(strtolower($email))],
|
|
]);
|
|
return [
|
|
'ok' => false,
|
|
'message' => 'Please verify your email first',
|
|
'flash_key' => 'login_not_verified',
|
|
'needs_verification' => true,
|
|
'email' => $email,
|
|
];
|
|
}
|
|
|
|
$user = Auth::login($email, $password);
|
|
|
|
if (!$user) {
|
|
$this->recordAuthEvent('auth.login.failed', 'failed', [
|
|
'error_code' => 'invalid_credentials',
|
|
'metadata' => ['email_hash' => \MintyPHP\Http\RequestContext::hashValue(strtolower($email))],
|
|
]);
|
|
return [
|
|
'ok' => false,
|
|
'message' => 'Email/password not valid',
|
|
'flash_key' => 'login_invalid',
|
|
];
|
|
}
|
|
|
|
if (!($_SESSION['user']['active'] ?? 1)) {
|
|
Auth::logout();
|
|
$this->recordAuthEvent('auth.login.failed', 'failed', [
|
|
'error_code' => 'account_inactive',
|
|
'metadata' => ['email_hash' => \MintyPHP\Http\RequestContext::hashValue(strtolower($email))],
|
|
]);
|
|
return [
|
|
'ok' => false,
|
|
'message' => 'Account is inactive',
|
|
'flash_key' => 'login_inactive',
|
|
];
|
|
}
|
|
|
|
$userId = (int) ($_SESSION['user']['id'] ?? 0);
|
|
if ($userId > 0 && !$this->isLocalPasswordLoginAllowedForUser($userId)) {
|
|
Auth::logout();
|
|
$this->recordAuthEvent('auth.login.failed', 'failed', [
|
|
'error_code' => 'password_login_disabled',
|
|
'metadata' => ['email_hash' => \MintyPHP\Http\RequestContext::hashValue(strtolower($email))],
|
|
]);
|
|
return [
|
|
'ok' => false,
|
|
'message' => 'Password login is disabled for all assigned tenants',
|
|
'flash_key' => 'login_password_disabled_all_tenants',
|
|
];
|
|
}
|
|
if ($userId > 0) {
|
|
$this->permissionGateway->warmUserPermissions($userId, true);
|
|
$this->loadTenantDataIntoSession($userId);
|
|
if (!empty($_SESSION['no_active_tenant'])) {
|
|
Auth::logout();
|
|
$this->recordAuthEvent('auth.login.failed', 'failed', [
|
|
'error_code' => 'no_active_tenant',
|
|
'metadata' => ['email_hash' => \MintyPHP\Http\RequestContext::hashValue(strtolower($email))],
|
|
]);
|
|
return [
|
|
'ok' => false,
|
|
'message' => 'No active tenant assigned',
|
|
'flash_key' => 'login_no_active_tenant',
|
|
];
|
|
}
|
|
$this->userWriteRepository->updateLastLogin($userId, 'local');
|
|
}
|
|
|
|
$this->recordAuthEvent('auth.login.success', 'success', [
|
|
'actor_user_id' => $userId > 0 ? $userId : null,
|
|
'actor_tenant_id' => (int) ($_SESSION['current_tenant']['id'] ?? 0),
|
|
]);
|
|
|
|
return ['ok' => true];
|
|
}
|
|
|
|
private function isLocalPasswordLoginAllowedForUser(int $userId): bool
|
|
{
|
|
if ($userId <= 0) {
|
|
return false;
|
|
}
|
|
|
|
$availableTenants = $this->userTenantContextService->getAvailableTenants($userId);
|
|
if (!$availableTenants) {
|
|
return true;
|
|
}
|
|
|
|
foreach ($availableTenants as $tenant) {
|
|
$tenantId = (int) ($tenant['id'] ?? 0);
|
|
if ($tenantId <= 0) {
|
|
continue;
|
|
}
|
|
if ($this->tenantSsoGateway->isLocalPasswordLoginAllowed($tenantId)) {
|
|
return true;
|
|
}
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
public function canLoginToTenant(int $userId, int $tenantId): bool
|
|
{
|
|
if ($userId <= 0 || $tenantId <= 0) {
|
|
return false;
|
|
}
|
|
|
|
foreach ($this->userTenantContextService->getAvailableTenants($userId) as $tenant) {
|
|
if ((int) ($tenant['id'] ?? 0) === $tenantId) {
|
|
return true;
|
|
}
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
public function loginUserById(int $userId, ?int $preferredTenantId = null, string $loginProvider = 'local'): array
|
|
{
|
|
if ($userId <= 0) {
|
|
return ['ok' => false, 'error' => 'user_not_found'];
|
|
}
|
|
|
|
$user = $this->userReadRepository->find($userId);
|
|
if (!$user) {
|
|
return ['ok' => false, 'error' => 'user_not_found'];
|
|
}
|
|
if (!((int) ($user['active'] ?? 1) === 1)) {
|
|
return ['ok' => false, 'error' => 'user_inactive'];
|
|
}
|
|
|
|
Session::regenerate();
|
|
$_SESSION['user'] = $user;
|
|
|
|
if ($preferredTenantId !== null && $preferredTenantId > 0) {
|
|
$setTenant = $this->userTenantContextService->setCurrentTenant($userId, $preferredTenantId);
|
|
if ($setTenant['ok'] ?? false) {
|
|
$_SESSION['user']['current_tenant_id'] = $preferredTenantId;
|
|
}
|
|
}
|
|
|
|
$this->permissionGateway->warmUserPermissions($userId, true);
|
|
$this->loadTenantDataIntoSession($userId);
|
|
if (!empty($_SESSION['no_active_tenant'])) {
|
|
Auth::logout();
|
|
$this->recordAuthEvent('auth.login.failed', 'failed', [
|
|
'error_code' => 'login_no_active_tenant',
|
|
'actor_user_id' => $userId,
|
|
]);
|
|
return ['ok' => false, 'error' => 'login_no_active_tenant'];
|
|
}
|
|
|
|
$this->userWriteRepository->updateLastLogin($userId, $loginProvider);
|
|
$this->recordAuthEvent('auth.login.success', 'success', [
|
|
'actor_user_id' => $userId,
|
|
'actor_tenant_id' => (int) ($_SESSION['current_tenant']['id'] ?? 0),
|
|
'metadata' => ['provider' => $loginProvider],
|
|
]);
|
|
return ['ok' => true, 'user' => $user];
|
|
}
|
|
|
|
public function loginAndRedirect(
|
|
string $email,
|
|
string $password,
|
|
string $successTarget = 'admin',
|
|
string $failTarget = 'login',
|
|
bool $remember = false
|
|
): void {
|
|
$result = $this->login($email, $password);
|
|
|
|
if (!($result['ok'] ?? false)) {
|
|
// Check if user needs to verify email
|
|
if (!empty($result['needs_verification'])) {
|
|
$_SESSION['email_verification_email'] = $result['email'] ?? $email;
|
|
Flash::error(t('Please verify your email first'), 'verify-email', 'login_not_verified');
|
|
Router::redirect('verify-email');
|
|
}
|
|
|
|
$message = $result['message'] ?? 'Email/password not valid';
|
|
$key = $result['flash_key'] ?? 'login_invalid';
|
|
Flash::error($message, $failTarget, $key);
|
|
Router::redirect($failTarget);
|
|
}
|
|
|
|
if ($remember) {
|
|
$userId = (int) ($_SESSION['user']['id'] ?? 0);
|
|
if ($userId > 0) {
|
|
$this->rememberMeService->rememberUser($userId);
|
|
}
|
|
}
|
|
Router::redirect($successTarget);
|
|
}
|
|
|
|
public function register(array $data): array
|
|
{
|
|
$email = trim((string) ($data['email'] ?? ''));
|
|
$result = $this->userAccountService->register($data);
|
|
if (!($result['ok'] ?? false)) {
|
|
return $result;
|
|
}
|
|
|
|
// Get the created user to send verification email
|
|
$createdUser = $this->userReadRepository->findByEmail($email);
|
|
if ($createdUser && isset($createdUser['id'])) {
|
|
$userId = (int) $createdUser['id'];
|
|
$this->emailVerificationService->sendVerification($userId);
|
|
}
|
|
|
|
// Don't login - user needs to verify email first
|
|
return ['ok' => true, 'email' => $email, 'needs_verification' => true];
|
|
}
|
|
|
|
public function logout(): void
|
|
{
|
|
$actorUserId = (int) ($_SESSION['user']['id'] ?? 0);
|
|
$actorTenantId = (int) ($_SESSION['current_tenant']['id'] ?? 0);
|
|
$this->rememberMeService->forgetCurrentUser();
|
|
Auth::logout();
|
|
$this->recordAuthEvent('auth.logout', 'success', [
|
|
'actor_user_id' => $actorUserId > 0 ? $actorUserId : null,
|
|
'actor_tenant_id' => $actorTenantId > 0 ? $actorTenantId : null,
|
|
]);
|
|
}
|
|
|
|
public function logoutAndRedirect(string $target = 'login'): void
|
|
{
|
|
$this->logout();
|
|
Router::redirect($target);
|
|
}
|
|
|
|
private function recordAuthEvent(string $eventType, string $outcome, array $context = []): void
|
|
{
|
|
$this->systemAuditService->record($eventType, $outcome, $context);
|
|
}
|
|
|
|
public function refreshSessionAuthState(int $userId): array
|
|
{
|
|
if ($userId <= 0) {
|
|
return [
|
|
'ok' => false,
|
|
'logout_required' => true,
|
|
'reason' => 'user_missing',
|
|
];
|
|
}
|
|
|
|
$snapshot = $this->userReadRepository->findAuthzSnapshot($userId);
|
|
if (!$snapshot) {
|
|
return [
|
|
'ok' => false,
|
|
'logout_required' => true,
|
|
'reason' => 'user_not_found',
|
|
];
|
|
}
|
|
|
|
if ((int) ($snapshot['active'] ?? 0) !== 1) {
|
|
return [
|
|
'ok' => false,
|
|
'logout_required' => true,
|
|
'reason' => 'inactive',
|
|
];
|
|
}
|
|
|
|
$sessionVersion = (int) ($_SESSION['user']['authz_version'] ?? 0);
|
|
$dbVersion = max(1, (int) ($snapshot['authz_version'] ?? 1));
|
|
$refreshed = false;
|
|
|
|
if ($sessionVersion !== $dbVersion) {
|
|
$user = $this->userReadRepository->find($userId);
|
|
if (!$user || (int) ($user['active'] ?? 0) !== 1) {
|
|
return [
|
|
'ok' => false,
|
|
'logout_required' => true,
|
|
'reason' => 'inactive',
|
|
];
|
|
}
|
|
|
|
$_SESSION['user'] = $user;
|
|
$this->permissionGateway->warmUserPermissions($userId, true);
|
|
$this->loadTenantDataIntoSession($userId);
|
|
$refreshed = true;
|
|
}
|
|
|
|
if (!empty($_SESSION['no_active_tenant'])) {
|
|
return [
|
|
'ok' => false,
|
|
'logout_required' => true,
|
|
'reason' => 'no_active_tenant',
|
|
'refreshed' => $refreshed,
|
|
];
|
|
}
|
|
|
|
return [
|
|
'ok' => true,
|
|
'logout_required' => false,
|
|
'refreshed' => $refreshed,
|
|
];
|
|
}
|
|
|
|
public function loadTenantDataIntoSession(int $userId): void
|
|
{
|
|
if ($userId <= 0) {
|
|
return;
|
|
}
|
|
|
|
// Load available tenants first
|
|
$availableTenants = $this->userTenantContextService->getAvailableTenants($userId);
|
|
$_SESSION['available_tenants'] = $availableTenants;
|
|
$_SESSION['available_departments_by_tenant'] = $this->userTenantContextService->getAvailableDepartmentsByTenant($userId);
|
|
$_SESSION['address_book_saved_filters'] = $this->savedFilterGateway->listAddressBookFilters($userId);
|
|
|
|
if (!$availableTenants) {
|
|
$_SESSION['no_active_tenant'] = true;
|
|
unset($_SESSION['current_tenant']);
|
|
return;
|
|
}
|
|
$_SESSION['no_active_tenant'] = false;
|
|
|
|
// Load current tenant (with fallback to first available)
|
|
$currentTenant = $this->userTenantContextService->getCurrentTenant($userId);
|
|
if (!$currentTenant) {
|
|
// Fallback: use first available tenant
|
|
$currentTenant = $availableTenants[0];
|
|
}
|
|
if ($currentTenant) {
|
|
$_SESSION['current_tenant'] = $currentTenant;
|
|
}
|
|
}
|
|
}
|