Replace Andmore ID SSO with local login
fitme3070.pt delegated all authentication to hub.andmore.pt: views/auth/*
were bounce stubs, and because this domain is outside the .andmore.pt cookie
scope the real handoff was a one-time HTTPS ticket redeem. Bring identity back
in-house — passwords live in users.password_hash, which the SSO migration
never dropped.
Removed: config/sso.php, IDENTITY_MODE, every SSO_* constant and env key,
identity_is_federated() and the cookie/ticket paths in the auth views and the
public-site bootstrap. ANDMORE_ID_URL stays — it is still the hub /notify
endpoint for outbound email/SMS, which the reset mails ride on, and has
nothing to do with authentication now.
Added, ported from the fotografia.andmore.pt sibling rather than invented:
- auth_login() with transparent password_needs_rehash upgrades and the
last_login trail; auth_register_client(); auth_set_password(); the
single-use 2h reset tokens.
- Real login / register / forgot_password / reset_password pages on a new
anonymous shell (includes/auth_header.php). includes/header.php renders
the backoffice sidebar and a logout button, which is wrong for a visitor
who is not signed in yet.
- safe_return_path(), so a crafted ?return_to= cannot bounce a freshly
authenticated user off-site.
- Per-IP throttling on login, register and reset-request. Successes count
too, so a guessed password cannot be parlayed into stuffing the rest of
the user list from the same IP.
- views/user/set_password.php: admin override for anyone whose email is
undeliverable. Prefers mailing an invite link so the backoffice never
handles the password. A plain admin cannot act on a sysadmin, and nobody
can use it on themselves — self-service goes through profile.php, which
demands the current password so a hijacked session cannot lock the owner
out.
Accounts provisioned during the SSO era have password_hash NULL. They get in
via the reset email, or by registering again with the same address:
auth_register_client() claims a passwordless row, but only a plain `client`
one, so knowing a staff address does not let anyone self-assign the role.
users.andmore_id is deliberately left in place. No code reads it any more, but
it records which central identity each row was linked to.
Deployment: apply database/migration_20260913_local_auth.sql (password_resets
+ auth_attempts) in the SAME sysadmin session that pulls this commit — the
forgot-password flow needs that table, and after the pull a login requires a
local password.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
andreandClaude Opus 5 committed
1 parent
dc8a36e126
commit
aec7b47820
23 files changed
+1195
-710
No files matched your search
+36
-42
@@ -39,48 +39,42 @@ if ($alreadyDone) {
|
||||
}
|
||||
}
|
||||
|
||||
include __DIR__ . '/../../includes/header.php';
|
||||
$page_title = 'Configuração inicial';
|
||||
include __DIR__ . '/../../includes/auth_header.php';
|
||||
?>
|
||||
<div class="container" style="max-width:480px; margin-top:80px;">
|
||||
<div class="card shadow-sm">
|
||||
<div class="card-body p-4">
|
||||
<h3 class="mb-1">Configuração inicial</h3>
|
||||
<p class="text-muted small mb-4">Crie a conta de administrador. Elimine este ficheiro depois.</p>
|
||||
<p class="auth-sub">Crie a conta de administrador. Elimine este ficheiro depois.</p>
|
||||
|
||||
<?php if ($error): ?>
|
||||
<div class="alert alert-danger"><?= htmlspecialchars($error) ?></div>
|
||||
<?php endif; ?>
|
||||
<?php if ($success): ?>
|
||||
<div class="alert alert-success"><?= $success ?></div>
|
||||
<?php elseif (!$alreadyDone): ?>
|
||||
<form method="POST">
|
||||
<?= csrf_field() ?>
|
||||
<div class="mb-3">
|
||||
<label class="form-label" for="setup-name">Nome</label>
|
||||
<input type="text" id="setup-name" name="name" class="form-control" required
|
||||
autocomplete="name"
|
||||
value="<?= htmlspecialchars($_POST['name'] ?? '') ?>">
|
||||
</div>
|
||||
<div class="mb-3">
|
||||
<label class="form-label" for="setup-email">Email</label>
|
||||
<input type="email" id="setup-email" name="email" class="form-control" required
|
||||
autocomplete="email" inputmode="email"
|
||||
value="<?= htmlspecialchars($_POST['email'] ?? '') ?>">
|
||||
</div>
|
||||
<div class="mb-3">
|
||||
<label class="form-label" for="setup-password">Palavra-passe <span class="text-muted small">(mín. 8 caracteres)</span></label>
|
||||
<input type="password" id="setup-password" name="password" class="form-control" required minlength="8"
|
||||
autocomplete="new-password">
|
||||
</div>
|
||||
<div class="mb-4">
|
||||
<label class="form-label" for="setup-confirm">Confirmar palavra-passe</label>
|
||||
<input type="password" id="setup-confirm" name="confirm" class="form-control" required
|
||||
autocomplete="new-password">
|
||||
</div>
|
||||
<button type="submit" class="btn btn-primary w-100">Criar conta de administrador</button>
|
||||
</form>
|
||||
<?php endif; ?>
|
||||
</div>
|
||||
<?php if ($error): ?>
|
||||
<div class="alert alert-danger"><?= htmlspecialchars($error) ?></div>
|
||||
<?php endif; ?>
|
||||
<?php if ($success): ?>
|
||||
<div class="alert alert-success"><?= $success ?></div>
|
||||
<?php elseif (!$alreadyDone): ?>
|
||||
<form method="POST">
|
||||
<?= csrf_field() ?>
|
||||
<div class="mb-3">
|
||||
<label class="form-label" for="setup-name">Nome</label>
|
||||
<input type="text" id="setup-name" name="name" class="form-control" required
|
||||
autocomplete="name"
|
||||
value="<?= htmlspecialchars($_POST['name'] ?? '') ?>">
|
||||
</div>
|
||||
</div>
|
||||
<?php include __DIR__ . '/../../includes/footer.php'; ?>
|
||||
<div class="mb-3">
|
||||
<label class="form-label" for="setup-email">Email</label>
|
||||
<input type="email" id="setup-email" name="email" class="form-control" required
|
||||
autocomplete="email" inputmode="email"
|
||||
value="<?= htmlspecialchars($_POST['email'] ?? '') ?>">
|
||||
</div>
|
||||
<div class="mb-3">
|
||||
<label class="form-label" for="setup-password">Palavra-passe <span class="text-muted small">(mín. 8 caracteres)</span></label>
|
||||
<input type="password" id="setup-password" name="password" class="form-control" required minlength="8"
|
||||
autocomplete="new-password">
|
||||
</div>
|
||||
<div class="mb-4">
|
||||
<label class="form-label" for="setup-confirm">Confirmar palavra-passe</label>
|
||||
<input type="password" id="setup-confirm" name="confirm" class="form-control" required
|
||||
autocomplete="new-password">
|
||||
</div>
|
||||
<button type="submit" class="btn btn-primary w-100">Criar conta de administrador</button>
|
||||
</form>
|
||||
<?php endif; ?>
|
||||
<?php include __DIR__ . '/../../includes/auth_footer.php'; ?>
|
||||
Reference in new issue
Block a user