Files
Hermes Agent 5d87e4975c Add HttpOnly cookie auth for cross-domain SPA login
Problem: Frontend JS bundle used credentials:'same-origin' which
dropped cookies on cross-domain requests. Login worked (200) but
the subsequent /auth/me check returned 401, leaving the user stuck
on the login screen.

Fix:
- AuthController now sets a dtp_jwt HttpOnly cookie on login/refresh
- Cookie uses Domain=.fahrschultermin.de (shared between frontend
  and api subdomain), Secure, SameSite=Lax, Max-Age=8h
- JwtMiddleware reads JWT from Authorization header OR cookie
- Added AuthController::me() endpoint (was missing, caused 500)
- Logout endpoint clears the cookie
- Frontend index.php patches fetch() to use credentials:'include'
  for all /api/v1/* calls
2026-06-04 20:33:31 +02:00

87 lines
2.1 KiB
PHP
Executable File

<?php
/**
* Migration Runner
*
* Run: php bin/migrate.php
*/
declare(strict_types=1);
require __DIR__ . '/../vendor/autoload.php';
// Load config
$config = require __DIR__ . '/../config/app.php';
echo "fahrschuldesk Migration Runner\n";
echo "==============================\n\n";
// Database connection
$dsn = sprintf(
'pgsql:host=%s;port=%d;dbname=%s',
$config['db']['host'],
$config['db']['port'],
$config['db']['database']
);
try {
$pdo = new PDO($dsn, $config['db']['username'], $config['db']['password'], [
PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
]);
echo "✓ Connected to database\n\n";
} catch (PDOException $e) {
echo "✗ Database connection failed: " . $e->getMessage() . "\n";
exit(1);
}
// Get all migration files
$migrationsPath = __DIR__ . '/../database/migrations';
$files = glob($migrationsPath . '/*.sql');
if (empty($files)) {
echo "No migration files found.\n";
exit(0);
}
sort($files);
echo "Found " . count($files) . " migration(s)\n\n";
// Create migrations table if not exists
$pdo->exec("
CREATE TABLE IF NOT EXISTS migrations (
id SERIAL PRIMARY KEY,
name VARCHAR(255) NOT NULL UNIQUE,
executed_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP
)
");
// Get executed migrations
$executed = $pdo->query("SELECT name FROM migrations")->fetchAll(PDO::FETCH_COLUMN);
// Run pending migrations
foreach ($files as $file) {
$filename = basename($file);
if (in_array($filename, $executed)) {
echo "{$filename} (already executed, skipping)\n";
continue;
}
echo "→ Running: {$filename}\n";
try {
$sql = file_get_contents($file);
$pdo->exec($sql);
$stmt = $pdo->prepare("INSERT INTO migrations (name) VALUES (:name)");
$stmt->execute(['name' => $filename]);
echo "{$filename} completed\n";
} catch (PDOException $e) {
echo "{$filename} failed: " . $e->getMessage() . "\n";
exit(1);
}
}
echo "\n==============================\n";
echo "All migrations completed!\n";