98 lines
3.2 KiB
PHP
98 lines
3.2 KiB
PHP
<?php
|
||
declare(strict_types=1);
|
||
|
||
/**
|
||
* Who is asking. The browser sends the session cookie; the check tools log in the same way and
|
||
* send the same cookie, so there is exactly one way into the API.
|
||
*/
|
||
final class Auth
|
||
{
|
||
public function __construct(
|
||
private readonly UserStore $users,
|
||
private readonly SessionStore $sessions,
|
||
) {}
|
||
|
||
/** The signed-in user, or null when nobody is. */
|
||
public function user(): ?string
|
||
{
|
||
$token = (string) ($_COOKIE[SessionStore::COOKIE] ?? '');
|
||
return $token === '' ? null : $this->sessions->user($token);
|
||
}
|
||
|
||
/** The signed-in user, or a 401 answer – every route but `auth/*` goes through here. */
|
||
public function require(): string
|
||
{
|
||
$user = $this->user();
|
||
if ($user === null) {
|
||
Response::error('Sign in first', 401);
|
||
}
|
||
return $user;
|
||
}
|
||
|
||
/** Checks the pair, starts a session and sets the cookie. Null when the pair is wrong. */
|
||
public function logIn(string $username, string $password): ?string
|
||
{
|
||
$name = $this->users->verify($username, $password);
|
||
if ($name === null) {
|
||
return null;
|
||
}
|
||
$this->setCookie($this->sessions->create($name), time() + SessionStore::LIFETIME_SECONDS);
|
||
return $name;
|
||
}
|
||
|
||
public function logOut(): void
|
||
{
|
||
$token = $this->token();
|
||
if ($token !== '') {
|
||
$this->sessions->destroy($token);
|
||
}
|
||
$this->setCookie('', time() - 3600);
|
||
}
|
||
|
||
/**
|
||
* Sets a new password for `$user`, who has to type the old one again: a session alone is not
|
||
* enough, or somebody else's open tab would be all it takes to take an account over.
|
||
*
|
||
* Every other login of the account ends with it – a session that was started with the old
|
||
* password has no business outliving it. The one asking keeps theirs.
|
||
*
|
||
* @return bool False when the current password does not match; the caller answers 401 then.
|
||
*/
|
||
public function changePassword(string $user, string $current, string $new): bool
|
||
{
|
||
if ($this->users->verify($user, $current) === null) {
|
||
return false;
|
||
}
|
||
$this->users->put($user, $new);
|
||
$this->sessions->destroyAllFor($user, $this->token());
|
||
return true;
|
||
}
|
||
|
||
private function token(): string
|
||
{
|
||
return (string) ($_COOKIE[SessionStore::COOKIE] ?? '');
|
||
}
|
||
|
||
private function setCookie(string $value, int $expires): void
|
||
{
|
||
setcookie(SessionStore::COOKIE, $value, [
|
||
'expires' => $expires,
|
||
'path' => self::basePath(),
|
||
'httponly' => true,
|
||
'samesite' => 'Lax',
|
||
'secure' => ($_SERVER['HTTPS'] ?? '') !== '',
|
||
]);
|
||
}
|
||
|
||
/**
|
||
* The path the editor is served under (`/game-maker/`), read off the script rather than
|
||
* written down: the same checkout answers under a different prefix in CI.
|
||
*/
|
||
private static function basePath(): string
|
||
{
|
||
$script = (string) ($_SERVER['SCRIPT_NAME'] ?? '/game-maker/api/index.php');
|
||
$base = dirname(dirname($script));
|
||
return $base === '/' || $base === '\\' || $base === '.' ? '/' : $base . '/';
|
||
}
|
||
}
|