5d87e4975c
Problem: Frontend JS bundle used credentials:'same-origin' which dropped cookies on cross-domain requests. Login worked (200) but the subsequent /auth/me check returned 401, leaving the user stuck on the login screen. Fix: - AuthController now sets a dtp_jwt HttpOnly cookie on login/refresh - Cookie uses Domain=.fahrschultermin.de (shared between frontend and api subdomain), Secure, SameSite=Lax, Max-Age=8h - JwtMiddleware reads JWT from Authorization header OR cookie - Added AuthController::me() endpoint (was missing, caused 500) - Logout endpoint clears the cookie - Frontend index.php patches fetch() to use credentials:'include' for all /api/v1/* calls
53 lines
1.7 KiB
PHP
Executable File
53 lines
1.7 KiB
PHP
Executable File
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Repositories;
|
|
|
|
final class WorkTimesheetRepository extends BaseRepository
|
|
{
|
|
/**
|
|
* Hole alle Appointments eines Fahrlehrers im Zeitraum mit lesson_type Info.
|
|
* Alle Categories zählen als Arbeitszeit.
|
|
*/
|
|
public function getAppointmentsForInstructor(int $tenantId, int $instructorId, string $from, string $to): array
|
|
{
|
|
$sql = 'SELECT
|
|
a.id,
|
|
a.start_at,
|
|
a.end_at,
|
|
a.units,
|
|
lt.name AS lesson_type_name,
|
|
lt.category AS lesson_type_category,
|
|
lt.default_duration
|
|
FROM appointments a
|
|
JOIN lesson_types lt ON lt.id = a.lesson_type_id
|
|
WHERE a.tenant_id = :tenant_id
|
|
AND a.instructor_id = :instructor_id
|
|
AND a.start_at >= :from
|
|
AND a.start_at < :to
|
|
AND a.status != \'cancelled\'
|
|
AND lt.category != \'private\'
|
|
ORDER BY a.start_at ASC';
|
|
|
|
$statement = $this->db->prepare($sql);
|
|
$statement->execute([
|
|
'tenant_id' => $tenantId,
|
|
'instructor_id' => $instructorId,
|
|
'from' => $from . ' 00:00:00',
|
|
'to' => $to . ' 23:59:59',
|
|
]);
|
|
|
|
return $statement->fetchAll();
|
|
}
|
|
|
|
public function getInstructor(int $tenantId, int $instructorId): ?array
|
|
{
|
|
$statement = $this->db->prepare(
|
|
'SELECT id, first_name, last_name FROM instructors WHERE tenant_id = :tenant_id AND id = :id'
|
|
);
|
|
$statement->execute(['tenant_id' => $tenantId, 'id' => $instructorId]);
|
|
|
|
return $statement->fetch() ?: null;
|
|
}
|
|
} |