andre/fitme3070.pt
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Replace Andmore ID SSO with local login

Browse Source 
fitme3070.pt delegated all authentication to hub.andmore.pt: views/auth/*
were bounce stubs, and because this domain is outside the .andmore.pt cookie
scope the real handoff was a one-time HTTPS ticket redeem. Bring identity back
in-house — passwords live in users.password_hash, which the SSO migration
never dropped.

Removed: config/sso.php, IDENTITY_MODE, every SSO_* constant and env key,
identity_is_federated() and the cookie/ticket paths in the auth views and the
public-site bootstrap. ANDMORE_ID_URL stays — it is still the hub /notify
endpoint for outbound email/SMS, which the reset mails ride on, and has
nothing to do with authentication now.

Added, ported from the fotografia.andmore.pt sibling rather than invented:

  - auth_login() with transparent password_needs_rehash upgrades and the
    last_login trail; auth_register_client(); auth_set_password(); the
    single-use 2h reset tokens.
  - Real login / register / forgot_password / reset_password pages on a new
    anonymous shell (includes/auth_header.php). includes/header.php renders
    the backoffice sidebar and a logout button, which is wrong for a visitor
    who is not signed in yet.
  - safe_return_path(), so a crafted ?return_to= cannot bounce a freshly
    authenticated user off-site.
  - Per-IP throttling on login, register and reset-request. Successes count
    too, so a guessed password cannot be parlayed into stuffing the rest of
    the user list from the same IP.
  - views/user/set_password.php: admin override for anyone whose email is
    undeliverable. Prefers mailing an invite link so the backoffice never
    handles the password. A plain admin cannot act on a sysadmin, and nobody
    can use it on themselves — self-service goes through profile.php, which
    demands the current password so a hijacked session cannot lock the owner
    out.

Accounts provisioned during the SSO era have password_hash NULL. They get in
via the reset email, or by registering again with the same address:
auth_register_client() claims a passwordless row, but only a plain `client`
one, so knowing a staff address does not let anyone self-assign the role.

users.andmore_id is deliberately left in place. No code reads it any more, but
it records which central identity each row was linked to.

Deployment: apply database/migration_20260913_local_auth.sql (password_resets
+ auth_attempts) in the SAME sysadmin session that pulls this commit — the
forgot-password flow needs that table, and after the pull a login requires a
local password.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
andreandClaude Opus 5 committed 2026-09-13 21:00:57 +01:00
1 parent dc8a36e126
commit aec7b47820
23 files changed
+1195 -710
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

config/auth.php
+27 -26
View File
@@ -1,29 +1,16 @@
<?php
// Auth guards — require functions.php (and session_start) before this file.
//
// This install owns its passwords: they live in `users.password_hash` and
// views/auth/login.php is a real form. There is no identity provider in front
// of the app.
function require_login(): array {
if (empty($_SESSION['user_id'])) {
if (identity_is_federated()) {
sso_resolve_session($GLOBALS['pdo']);
}
if (empty($_SESSION['user_id'])) {
if (SSO_REQUIRED) {
// Bounce through this platform's local login stub instead of
// sending id.andmore.pt's return_to straight at a protected
// page. The stub (views/auth/login.php) carries the
// ?from=sso loop-guard and loads the full functions.php
// bootstrap before calling sso_resolve_session().
$_rl_return = APP_BASE_URL . 'views/auth/login.php?from=sso';
$_rl_qs = '?return_to=' . urlencode($_rl_return)
. '&platform=' . urlencode(PLATFORM_SLUG);
header('Location: ' . ANDMORE_ID_URL . 'auth/login.php' . $_rl_qs);
} else {
$return = $_SERVER['REQUEST_URI'] ?? '';
$qs = $return ? ('?return_to=' . urlencode($return)) : '';
header('Location: ' . base_url('views/auth/login.php' . $qs));
}
exit;
}
$return = $_SERVER['REQUEST_URI'] ?? '';
$qs = $return ? ('?return_to=' . urlencode($return)) : '';
header('Location: ' . base_url('views/auth/login.php' . $qs));
exit;
}
return $_SESSION['user'];
}
@@ -134,9 +121,9 @@ function is_designer(): bool {
}
function auth_set_session(array $user): void {
// Rotate the session id on every privilege change (login, SSO resolve,
// Rotate the session id on every privilege change (login, registration,
// password reset). Defeats session fixation: an attacker who pre-seeded
// FOTO_SESS now ends up holding a dead id while the real user gets a fresh
// FIT_SESS now ends up holding a dead id while the real user gets a fresh
// one. The CSRF token is rotated alongside the session id.
if (session_status() === PHP_SESSION_ACTIVE) {
session_regenerate_id(true);
@@ -148,8 +135,22 @@ function auth_set_session(array $user): void {
'name' => $user['name'],
'email' => $user['email'],
'role' => $user['role'],
// Carried so sso_resolve_session() can detect when the am_sso cookie
// identifies a different person than the current local session.
'andmore_id' => isset($user['andmore_id']) ? (int) $user['andmore_id'] : null,
];
}
// Sanitises a ?return_to= value into a path safe to redirect to after login.
// Anything absolute, protocol-relative or backslash-prefixed is discarded so a
// crafted login link can't bounce the user off-site with a fresh session in hand.
function safe_return_path(?string $raw): string {
$raw = trim((string) $raw);
if ($raw === '' || $raw[0] !== '/') return '';
if (str_starts_with($raw, '//') || str_starts_with($raw, '/' . chr(92))) return '';
// REQUEST_URI includes the deployment base (e.g. /fitme3070.pt/…) while
// base_url() adds it back, so strip it to avoid doubling the prefix.
$base = parse_url(APP_BASE_URL, PHP_URL_PATH) ?: '/';
if ($base !== '/' && str_starts_with($raw, $base)) {
$raw = substr($raw, strlen($base));
}
return ltrim($raw, '/');
}