5d87e4975c
Problem: Frontend JS bundle used credentials:'same-origin' which dropped cookies on cross-domain requests. Login worked (200) but the subsequent /auth/me check returned 401, leaving the user stuck on the login screen. Fix: - AuthController now sets a dtp_jwt HttpOnly cookie on login/refresh - Cookie uses Domain=.fahrschultermin.de (shared between frontend and api subdomain), Secure, SameSite=Lax, Max-Age=8h - JwtMiddleware reads JWT from Authorization header OR cookie - Added AuthController::me() endpoint (was missing, caused 500) - Logout endpoint clears the cookie - Frontend index.php patches fetch() to use credentials:'include' for all /api/v1/* calls
56 lines
1.8 KiB
PHP
Executable File
56 lines
1.8 KiB
PHP
Executable File
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Repositories;
|
|
|
|
final class PrivateAppointmentRepository extends BaseRepository
|
|
{
|
|
public function getForInstructor(int $instructorId): array
|
|
{
|
|
$stmt = $this->db->prepare(
|
|
'SELECT * FROM private_appointments
|
|
WHERE instructor_id = :instructor_id
|
|
ORDER BY date ASC, time_from ASC'
|
|
);
|
|
$stmt->execute(['instructor_id' => $instructorId]);
|
|
return $stmt->fetchAll();
|
|
}
|
|
|
|
public function getForInstructorInRange(int $instructorId, string $from, string $to): array
|
|
{
|
|
$stmt = $this->db->prepare(
|
|
'SELECT * FROM private_appointments
|
|
WHERE instructor_id = :instructor_id
|
|
AND date >= :from AND date <= :to
|
|
ORDER BY date ASC, time_from ASC'
|
|
);
|
|
$stmt->execute(['instructor_id' => $instructorId, 'from' => $from, 'to' => $to]);
|
|
return $stmt->fetchAll();
|
|
}
|
|
|
|
public function create(int $instructorId, string $title, string $date, string $timeFrom, string $timeTo, string $color = '#9ca3af'): array
|
|
{
|
|
$stmt = $this->db->prepare(
|
|
'INSERT INTO private_appointments (instructor_id, title, date, time_from, time_to, color)
|
|
VALUES (:instructor_id, :title, :date, :time_from, :time_to, :color)
|
|
RETURNING *'
|
|
);
|
|
$stmt->execute([
|
|
'instructor_id' => $instructorId,
|
|
'title' => $title,
|
|
'date' => $date,
|
|
'time_from' => $timeFrom,
|
|
'time_to' => $timeTo,
|
|
'color' => $color,
|
|
]);
|
|
return $stmt->fetch();
|
|
}
|
|
|
|
public function delete(int $id): bool
|
|
{
|
|
$stmt = $this->db->prepare('DELETE FROM private_appointments WHERE id = :id RETURNING id');
|
|
$stmt->execute(['id' => $id]);
|
|
return (bool) $stmt->fetch();
|
|
}
|
|
} |