5d87e4975c
Problem: Frontend JS bundle used credentials:'same-origin' which dropped cookies on cross-domain requests. Login worked (200) but the subsequent /auth/me check returned 401, leaving the user stuck on the login screen. Fix: - AuthController now sets a dtp_jwt HttpOnly cookie on login/refresh - Cookie uses Domain=.fahrschultermin.de (shared between frontend and api subdomain), Secure, SameSite=Lax, Max-Age=8h - JwtMiddleware reads JWT from Authorization header OR cookie - Added AuthController::me() endpoint (was missing, caused 500) - Logout endpoint clears the cookie - Frontend index.php patches fetch() to use credentials:'include' for all /api/v1/* calls
50 lines
1.3 KiB
PHP
Executable File
50 lines
1.3 KiB
PHP
Executable File
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Controllers;
|
|
|
|
use App\Repositories\UserRepository;
|
|
use App\Support\Auth;
|
|
use App\Support\Request;
|
|
use App\Support\Response;
|
|
|
|
final class AuthController
|
|
{
|
|
public function login(Request $request): void
|
|
{
|
|
$payload = $request->input();
|
|
$user = (new UserRepository())->findByEmail(trim((string) ($payload['email'] ?? '')));
|
|
|
|
if ($user === null || !password_verify((string) ($payload['password'] ?? ''), $user['password_hash'])) {
|
|
Response::json(['message' => 'Ungueltige Zugangsdaten'], 422);
|
|
}
|
|
|
|
if (!(int) $user['is_active'] || ((int) ($user['tenant_is_active'] ?? 1) !== 1 && $user['role'] !== 'superadmin')) {
|
|
Response::json(['message' => 'Benutzer oder Mandant ist deaktiviert'], 403);
|
|
}
|
|
|
|
$_SESSION['user_id'] = (int) $user['id'];
|
|
|
|
Response::json(['user' => $this->sanitizeUser($user)]);
|
|
}
|
|
|
|
public function logout(): void
|
|
{
|
|
session_destroy();
|
|
Response::noContent();
|
|
}
|
|
|
|
public function me(): void
|
|
{
|
|
$user = Auth::user();
|
|
Response::json(['user' => $user ? $this->sanitizeUser($user) : null]);
|
|
}
|
|
|
|
private function sanitizeUser(array $user): array
|
|
{
|
|
unset($user['password_hash']);
|
|
return $user;
|
|
}
|
|
}
|