5d87e4975c
Problem: Frontend JS bundle used credentials:'same-origin' which dropped cookies on cross-domain requests. Login worked (200) but the subsequent /auth/me check returned 401, leaving the user stuck on the login screen. Fix: - AuthController now sets a dtp_jwt HttpOnly cookie on login/refresh - Cookie uses Domain=.fahrschultermin.de (shared between frontend and api subdomain), Secure, SameSite=Lax, Max-Age=8h - JwtMiddleware reads JWT from Authorization header OR cookie - Added AuthController::me() endpoint (was missing, caused 500) - Logout endpoint clears the cookie - Frontend index.php patches fetch() to use credentials:'include' for all /api/v1/* calls
104 lines
3.5 KiB
PHP
Executable File
104 lines
3.5 KiB
PHP
Executable File
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Repositories;
|
|
|
|
final class AppointmentRequestRepository extends BaseRepository
|
|
{
|
|
public function create(
|
|
int $studentUserId,
|
|
int $instructorId,
|
|
int $lessonTypeId,
|
|
string $start,
|
|
string $end,
|
|
string $notes = ''
|
|
): array {
|
|
$stmt = $this->db->prepare(
|
|
'INSERT INTO appointment_requests
|
|
(student_user_id, instructor_id, lesson_type_id, requested_start, requested_end, notes)
|
|
VALUES (:student_user_id, :instructor_id, :lesson_type_id, :start, :end, :notes)
|
|
RETURNING *'
|
|
);
|
|
$stmt->execute([
|
|
'student_user_id' => $studentUserId,
|
|
'instructor_id' => $instructorId,
|
|
'lesson_type_id' => $lessonTypeId,
|
|
'start' => $start,
|
|
'end' => $end,
|
|
'notes' => $notes,
|
|
]);
|
|
return $stmt->fetch();
|
|
}
|
|
|
|
public function findById(int $id): ?array
|
|
{
|
|
$stmt = $this->db->prepare('SELECT * FROM appointment_requests WHERE id = :id');
|
|
$stmt->execute(['id' => $id]);
|
|
$result = $stmt->fetch();
|
|
return $result ?: null;
|
|
}
|
|
|
|
public function getPendingForInstructor(int $instructorId): array
|
|
{
|
|
$stmt = $this->db->prepare(
|
|
'SELECT ar.*,
|
|
u.first_name AS student_first_name, u.last_name AS student_last_name,
|
|
lt.name AS lesson_type_name, lt.category
|
|
FROM appointment_requests ar
|
|
JOIN users u ON u.id = ar.student_user_id
|
|
JOIN lesson_types lt ON lt.id = ar.lesson_type_id
|
|
WHERE ar.instructor_id = :instructor_id AND ar.status = \'pending\'
|
|
ORDER BY ar.requested_start ASC'
|
|
);
|
|
$stmt->execute(['instructor_id' => $instructorId]);
|
|
return $stmt->fetchAll();
|
|
}
|
|
|
|
public function getForStudent(int $studentUserId): array
|
|
{
|
|
$stmt = $this->db->prepare(
|
|
'SELECT ar.*, lt.name AS lesson_type_name
|
|
FROM appointment_requests ar
|
|
JOIN lesson_types lt ON lt.id = ar.lesson_type_id
|
|
WHERE ar.student_user_id = :student_user_id
|
|
ORDER BY ar.requested_start DESC'
|
|
);
|
|
$stmt->execute(['student_user_id' => $studentUserId]);
|
|
return $stmt->fetchAll();
|
|
}
|
|
|
|
public function confirm(int $id, int $responseBy, int $appointmentId): bool
|
|
{
|
|
$stmt = $this->db->prepare(
|
|
'UPDATE appointment_requests
|
|
SET status = \'confirmed\', responded_at = NOW(), response_by = :response_by,
|
|
confirmed_appointment_id = :appointment_id
|
|
WHERE id = :id AND status = \'pending\'
|
|
RETURNING id'
|
|
);
|
|
$stmt->execute(['id' => $id, 'response_by' => $responseBy, 'appointment_id' => $appointmentId]);
|
|
return (bool) $stmt->fetch();
|
|
}
|
|
|
|
public function reject(int $id, int $responseBy): bool
|
|
{
|
|
$stmt = $this->db->prepare(
|
|
'UPDATE appointment_requests
|
|
SET status = \'rejected\', responded_at = NOW(), response_by = :response_by
|
|
WHERE id = :id AND status = \'pending\'
|
|
RETURNING id'
|
|
);
|
|
$stmt->execute(['id' => $id, 'response_by' => $responseBy]);
|
|
return (bool) $stmt->fetch();
|
|
}
|
|
|
|
public function cancel(int $id): bool
|
|
{
|
|
$stmt = $this->db->prepare(
|
|
'UPDATE appointment_requests SET status = \'cancelled\' WHERE id = :id RETURNING id'
|
|
);
|
|
$stmt->execute(['id' => $id]);
|
|
return (bool) $stmt->fetch();
|
|
}
|
|
} |