5d87e4975c
Problem: Frontend JS bundle used credentials:'same-origin' which dropped cookies on cross-domain requests. Login worked (200) but the subsequent /auth/me check returned 401, leaving the user stuck on the login screen. Fix: - AuthController now sets a dtp_jwt HttpOnly cookie on login/refresh - Cookie uses Domain=.fahrschultermin.de (shared between frontend and api subdomain), Secure, SameSite=Lax, Max-Age=8h - JwtMiddleware reads JWT from Authorization header OR cookie - Added AuthController::me() endpoint (was missing, caused 500) - Logout endpoint clears the cookie - Frontend index.php patches fetch() to use credentials:'include' for all /api/v1/* calls
52 lines
1.3 KiB
PHP
Executable File
52 lines
1.3 KiB
PHP
Executable File
<?php
|
|
/**
|
|
* fahrschuldesk API Bootstrap
|
|
*/
|
|
|
|
declare(strict_types=1);
|
|
|
|
// Error reporting
|
|
error_reporting(E_ALL);
|
|
ini_set('display_errors', '0');
|
|
ini_set('log_errors', '1');
|
|
|
|
// Base paths
|
|
define('ROOT_PATH', dirname(__DIR__));
|
|
define('STORAGE_PATH', ROOT_PATH . '/storage');
|
|
define('CONFIG_PATH', ROOT_PATH . '/config');
|
|
|
|
// Load Composer autoloader
|
|
require ROOT_PATH . '/vendor/autoload.php';
|
|
|
|
// Load configuration
|
|
$config = require CONFIG_PATH . '/app.php';
|
|
|
|
// Create DI container
|
|
$container = new \DI\Container();
|
|
|
|
// Database connection
|
|
$container->set('db', function () use ($config) {
|
|
$dsn = sprintf(
|
|
'pgsql:host=%s;port=%d;dbname=%s',
|
|
$config['db']['host'],
|
|
$config['db']['port'],
|
|
$config['db']['database']
|
|
);
|
|
|
|
try {
|
|
$pdo = new PDO($dsn, $config['db']['username'], $config['db']['password'], [
|
|
PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
|
|
PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
|
|
PDO::ATTR_EMULATE_PREPARES => false,
|
|
]);
|
|
return $pdo;
|
|
} catch (PDOException $e) {
|
|
throw new \RuntimeException('Database connection failed: ' . $e->getMessage());
|
|
}
|
|
});
|
|
|
|
// JWT Secret
|
|
$container->set('jwt_secret', $config['jwt']['secret']);
|
|
|
|
// Return container
|
|
return $container; |