andre/fitme3070.pt
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Replace Andmore ID SSO with local login

Browse Source 
fitme3070.pt delegated all authentication to hub.andmore.pt: views/auth/*
were bounce stubs, and because this domain is outside the .andmore.pt cookie
scope the real handoff was a one-time HTTPS ticket redeem. Bring identity back
in-house — passwords live in users.password_hash, which the SSO migration
never dropped.

Removed: config/sso.php, IDENTITY_MODE, every SSO_* constant and env key,
identity_is_federated() and the cookie/ticket paths in the auth views and the
public-site bootstrap. ANDMORE_ID_URL stays — it is still the hub /notify
endpoint for outbound email/SMS, which the reset mails ride on, and has
nothing to do with authentication now.

Added, ported from the fotografia.andmore.pt sibling rather than invented:

  - auth_login() with transparent password_needs_rehash upgrades and the
    last_login trail; auth_register_client(); auth_set_password(); the
    single-use 2h reset tokens.
  - Real login / register / forgot_password / reset_password pages on a new
    anonymous shell (includes/auth_header.php). includes/header.php renders
    the backoffice sidebar and a logout button, which is wrong for a visitor
    who is not signed in yet.
  - safe_return_path(), so a crafted ?return_to= cannot bounce a freshly
    authenticated user off-site.
  - Per-IP throttling on login, register and reset-request. Successes count
    too, so a guessed password cannot be parlayed into stuffing the rest of
    the user list from the same IP.
  - views/user/set_password.php: admin override for anyone whose email is
    undeliverable. Prefers mailing an invite link so the backoffice never
    handles the password. A plain admin cannot act on a sysadmin, and nobody
    can use it on themselves — self-service goes through profile.php, which
    demands the current password so a hijacked session cannot lock the owner
    out.

Accounts provisioned during the SSO era have password_hash NULL. They get in
via the reset email, or by registering again with the same address:
auth_register_client() claims a passwordless row, but only a plain `client`
one, so knowing a staff address does not let anyone self-assign the role.

users.andmore_id is deliberately left in place. No code reads it any more, but
it records which central identity each row was linked to.

Deployment: apply database/migration_20260913_local_auth.sql (password_resets
+ auth_attempts) in the SAME sysadmin session that pulls this commit — the
forgot-password flow needs that table, and after the pull a login requires a
local password.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
andreandClaude Opus 5 committed 2026-09-13 21:00:57 +01:00
1 parent dc8a36e126
commit aec7b47820
23 files changed
+1195 -710
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

views/user/index.php
+14 -3
View File
@@ -4,7 +4,7 @@ require __DIR__ . '/../../config/functions.php';
$user = require_admin();
$users = $pdo->query(
"SELECT id, name, email, phone, role, is_active, andmore_id, last_login_at, last_login_ua
"SELECT id, name, email, phone, role, is_active, password_hash, last_login_at, last_login_ua
FROM users ORDER BY FIELD(role,'sysadmin','admin','staff','client'), name"
)->fetchAll(PDO::FETCH_ASSOC);
@@ -17,7 +17,7 @@ include __DIR__ . '/../../includes/header.php';
<table class="am-datatable table table-hover align-middle">
<thead><tr>
<th>Nome</th><th>Email</th><th>Perfil</th><th>Ativo</th>
<th>Andmore ID</th><th>Último acesso</th>
<th>Palavra-passe</th><th>Último acesso</th><th></th>
</tr></thead>
<tbody>
<?php foreach ($users as $u): ?>
@@ -26,13 +26,24 @@ include __DIR__ . '/../../includes/header.php';
<td><?= htmlspecialchars($u['email']) ?></td>
<td><span class="badge text-bg-secondary"><?= htmlspecialchars(role_label($u['role'])) ?></span></td>
<td><?= $u['is_active'] ? '<i class="bi bi-check-circle text-success"></i>' : '<i class="bi bi-x-circle text-muted"></i>' ?></td>
<td><?= $u['andmore_id'] ? (int) $u['andmore_id'] : '<span class="text-muted">—</span>' ?></td>
<td>
<?php if (!empty($u['password_hash'])): ?>
<i class="bi bi-key-fill text-success" title="Definida"></i>
<?php else: ?>
<span class="badge text-bg-warning-subtle text-warning-emphasis">Por definir</span>
<?php endif; ?>
</td>
<td class="small text-muted">
<?php if ($u['last_login_at']): ?>
<?= htmlspecialchars(format_date_pt($u['last_login_at'])) ?>
· <?= htmlspecialchars(parse_user_agent((string) $u['last_login_ua'])) ?>
<?php else: ?>—<?php endif; ?>
</td>
<td class="text-end">
<a class="btn btn-sm btn-outline-secondary"
href="<?= base_url('views/user/set_password.php?id=' . (int) $u['id']) ?>"
title="Gerir palavra-passe"><i class="bi bi-key"></i></a>
</td>
</tr>
<?php endforeach; ?>
</tbody>
views/user/profile.php
+69 -28
View File
@@ -3,24 +3,51 @@ require __DIR__ . '/../../config/db.php';
require __DIR__ . '/../../config/functions.php';
$user = require_login();
// Editable per-tenant fields only. Name/email are owned by Andmore ID and synced
// on login by sso_resolve_session(); the password is managed centrally.
$saved = false;
// Two forms on this page, told apart by the hidden `form` field: the contact
// details and the password change. Name and email are not self-editable — an
// admin changes those, so a client can't quietly take over another address.
$saved = false;
$pw_saved = false;
$pw_error = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
csrf_check();
$phone = trim($_POST['phone'] ?? '');
$address = trim($_POST['address'] ?? '');
$city = trim($_POST['city'] ?? '');
$postal_code = trim($_POST['postal_code'] ?? '');
$email_opt = isset($_POST['email_opt_out']) ? 1 : 0;
$sms_opt = isset($_POST['sms_opt_out']) ? 1 : 0;
$marketing = isset($_POST['marketing_consent']) ? 1 : 0;
$pdo->prepare(
"UPDATE users SET phone=?, address=?, city=?, postal_code=?,
email_opt_out=?, sms_opt_out=?, marketing_consent=?
WHERE id=?"
)->execute([$phone, $address, $city, $postal_code, $email_opt, $sms_opt, $marketing, $user['id']]);
$saved = true;
if (($_POST['form'] ?? '') === 'password') {
$current = $_POST['current_password'] ?? '';
$new = $_POST['new_password'] ?? '';
$confirm = $_POST['confirm_password'] ?? '';
// Re-authenticate against the stored hash: a hijacked session must not
// be enough to change the password and lock the owner out.
$row = db_get_user($pdo, (int) $user['id']);
if (!$row || empty($row['password_hash']) || !password_verify($current, $row['password_hash'])) {
$pw_error = 'A palavra-passe atual está incorreta.';
} elseif (strlen($new) < 8) {
$pw_error = 'A nova palavra-passe deve ter pelo menos 8 caracteres.';
} elseif ($new !== $confirm) {
$pw_error = 'As palavras-passe não coincidem.';
} else {
auth_set_password($pdo, (int) $user['id'], $new);
// Fresh session id on a credential change — see auth_set_session().
auth_set_session($row);
$pw_saved = true;
}
} else {
$phone = trim($_POST['phone'] ?? '');
$address = trim($_POST['address'] ?? '');
$city = trim($_POST['city'] ?? '');
$postal_code = trim($_POST['postal_code'] ?? '');
$email_opt = isset($_POST['email_opt_out']) ? 1 : 0;
$sms_opt = isset($_POST['sms_opt_out']) ? 1 : 0;
$marketing = isset($_POST['marketing_consent']) ? 1 : 0;
$pdo->prepare(
"UPDATE users SET phone=?, address=?, city=?, postal_code=?,
email_opt_out=?, sms_opt_out=?, marketing_consent=?
WHERE id=?"
)->execute([$phone, $address, $city, $postal_code, $email_opt, $sms_opt, $marketing, $user['id']]);
$saved = true;
}
}
$row = db_get_user($pdo, (int) $user['id']) ?? [];
@@ -33,22 +60,21 @@ include __DIR__ . '/../../includes/header.php';
<div class="card shadow-sm mb-3"><div class="card-body">
<div class="row mb-2"><div class="col-4 text-muted">Nome</div><div class="col-8"><?= htmlspecialchars($row['name'] ?? '') ?></div></div>
<div class="row mb-2"><div class="col-4 text-muted">Email</div><div class="col-8"><?= htmlspecialchars($row['email'] ?? '') ?></div></div>
<p class="text-muted small mb-0">Nome, email e palavra-passe são geridos no Andmore ID.
<a href="<?= htmlspecialchars(rtrim(ANDMORE_ID_URL, '/')) ?>/" target="_blank" rel="noopener">Gerir conta &rarr;</a>
</p>
<p class="text-muted small mb-0">Para alterar o nome ou o email, contacte-nos.</p>
</div></div>
<form method="POST" class="card shadow-sm"><div class="card-body">
<form method="POST" class="card shadow-sm mb-3"><div class="card-body">
<?= csrf_field() ?>
<div class="mb-3"><label class="form-label">Telefone</label>
<input class="form-control" name="phone" value="<?= htmlspecialchars($row['phone'] ?? '') ?>"></div>
<div class="mb-3"><label class="form-label">Morada</label>
<input class="form-control" name="address" value="<?= htmlspecialchars($row['address'] ?? '') ?>"></div>
<input type="hidden" name="form" value="details">
<div class="mb-3"><label class="form-label" for="pf-phone">Telefone</label>
<input class="form-control" id="pf-phone" name="phone" value="<?= htmlspecialchars($row['phone'] ?? '') ?>"></div>
<div class="mb-3"><label class="form-label" for="pf-address">Morada</label>
<input class="form-control" id="pf-address" name="address" value="<?= htmlspecialchars($row['address'] ?? '') ?>"></div>
<div class="row">
<div class="col-md-8 mb-3"><label class="form-label">Localidade</label>
<input class="form-control" name="city" value="<?= htmlspecialchars($row['city'] ?? '') ?>"></div>
<div class="col-md-4 mb-3"><label class="form-label">Código postal</label>
<input class="form-control" name="postal_code" value="<?= htmlspecialchars($row['postal_code'] ?? '') ?>"></div>
<div class="col-md-8 mb-3"><label class="form-label" for="pf-city">Localidade</label>
<input class="form-control" id="pf-city" name="city" value="<?= htmlspecialchars($row['city'] ?? '') ?>"></div>
<div class="col-md-4 mb-3"><label class="form-label" for="pf-postal">Código postal</label>
<input class="form-control" id="pf-postal" name="postal_code" value="<?= htmlspecialchars($row['postal_code'] ?? '') ?>"></div>
</div>
<div class="form-check"><input class="form-check-input" type="checkbox" name="email_opt_out" id="eo" <?= !empty($row['email_opt_out']) ? 'checked' : '' ?>>
<label class="form-check-label" for="eo">Não receber emails</label></div>
@@ -58,5 +84,20 @@ include __DIR__ . '/../../includes/header.php';
<label class="form-check-label" for="mc">Aceito comunicações de marketing</label></div>
<button class="btn btn-primary">Guardar</button>
</div></form>
<form method="POST" class="card shadow-sm"><div class="card-body">
<?= csrf_field() ?>
<input type="hidden" name="form" value="password">
<h2 class="h6 mb-3">Alterar palavra-passe</h2>
<?php if ($pw_saved): ?><div class="alert alert-success py-2 small">Palavra-passe alterada.</div><?php endif; ?>
<?php if ($pw_error): ?><div class="alert alert-danger py-2 small"><?= htmlspecialchars($pw_error) ?></div><?php endif; ?>
<div class="mb-3"><label class="form-label" for="pf-current">Palavra-passe atual</label>
<input type="password" class="form-control" id="pf-current" name="current_password" required autocomplete="current-password"></div>
<div class="mb-3"><label class="form-label" for="pf-new">Nova palavra-passe <span class="text-muted small">(mín. 8 caracteres)</span></label>
<input type="password" class="form-control" id="pf-new" name="new_password" required minlength="8" autocomplete="new-password"></div>
<div class="mb-3"><label class="form-label" for="pf-confirm">Confirmar nova palavra-passe</label>
<input type="password" class="form-control" id="pf-confirm" name="confirm_password" required autocomplete="new-password"></div>
<button class="btn btn-primary">Alterar palavra-passe</button>
</div></form>
</div>
<?php include __DIR__ . '/../../includes/footer.php'; ?>
views/user/set_password.php
+121
View File
@@ -0,0 +1,121 @@
<?php
// Admin override for a user's password — the way in for anyone whose email is
// wrong or undeliverable, and for the accounts carried over from the Andmore ID
// era that have no local password yet.
//
// Two actions:
// set — write a password the admin chose, and read it out once.
// invite — mail a single-use "define a sua palavra-passe" link instead, so
// the admin never handles the password at all. Preferred.
require __DIR__ . '/../../config/db.php';
require __DIR__ . '/../../config/functions.php';
$user = require_admin();
$target = db_get_user($pdo, (int) ($_GET['id'] ?? $_POST['id'] ?? 0));
if (!$target) {
header('Location: ' . base_url('views/user/index.php'));
exit;
}
// Guards. Self-service goes through profile.php, which demands the current
// password — routing it through here would let a hijacked admin session change
// the password without knowing the old one. And a plain admin must not be able
// to take over a sysadmin account; only a sysadmin can act on a sysadmin.
$is_self = ((int) $target['id'] === (int) $user['id']);
$blocked = '';
if ($is_self) {
$blocked = 'Para alterar a sua própria palavra-passe use O meu perfil.';
} elseif ($target['role'] === 'sysadmin' && !is_sysadmin()) {
$blocked = 'Apenas um administrador de sistema pode alterar a palavra-passe de outro administrador de sistema.';
}
$error = '';
$success = '';
$plain = ''; // shown once, only for the `set` action
if ($_SERVER['REQUEST_METHOD'] === 'POST' && $blocked === '') {
csrf_check();
$action = $_POST['action'] ?? '';
if ($action === 'invite') {
if (send_password_invite_email($pdo, $target)) {
$success = 'Email enviado para ' . $target['email'] . '. O link é válido durante 2 horas.';
} else {
$error = 'Não foi possível enviar o email. Verifique as definições de notificações e tente novamente.';
}
} elseif ($action === 'set') {
$password = $_POST['password'] ?? '';
$confirm = $_POST['confirm'] ?? '';
if (strlen($password) < 8) {
$error = 'A palavra-passe deve ter pelo menos 8 caracteres.';
} elseif ($password !== $confirm) {
$error = 'As palavras-passe não coincidem.';
} else {
auth_set_password($pdo, (int) $target['id'], $password);
$plain = $password;
$success = 'Palavra-passe definida.';
}
}
$target = db_get_user($pdo, (int) $target['id']) ?? $target;
}
$page_title = 'Palavra-passe';
include __DIR__ . '/../../includes/header.php';
?>
<div class="container" style="max-width:640px;">
<h1 class="h3 mb-1">Palavra-passe</h1>
<p class="text-muted mb-4">
<?= htmlspecialchars($target['name']) ?>
· <?= htmlspecialchars($target['email']) ?>
· <span class="badge text-bg-secondary"><?= htmlspecialchars(role_label($target['role'])) ?></span>
</p>
<?php if ($blocked): ?>
<div class="alert alert-warning"><?= htmlspecialchars($blocked) ?></div>
<a class="btn btn-outline-secondary" href="<?= base_url('views/user/index.php') ?>">Voltar</a>
<?php else: ?>
<?php if ($error): ?><div class="alert alert-danger"><?= htmlspecialchars($error) ?></div><?php endif; ?>
<?php if ($success): ?><div class="alert alert-success"><?= htmlspecialchars($success) ?></div><?php endif; ?>
<?php if ($plain !== ''): ?>
<div class="alert alert-warning">
Comunique-a por um canal seguro e peça que a altere no primeiro acesso.
Esta é a única vez que aparece:
<code class="d-block mt-2 fs-6"><?= htmlspecialchars($plain) ?></code>
</div>
<?php endif; ?>
<div class="card shadow-sm mb-3"><div class="card-body">
<h2 class="h6">Enviar link por email</h2>
<p class="text-muted small">
A pessoa define a própria palavra-passe. Ninguém no backoffice chega a conhecê-la.
<?php if (empty($target['password_hash'])): ?>
<br><strong>Esta conta ainda não tem palavra-passe definida.</strong>
<?php endif; ?>
</p>
<form method="POST">
<?= csrf_field() ?>
<input type="hidden" name="id" value="<?= (int) $target['id'] ?>">
<input type="hidden" name="action" value="invite">
<button class="btn btn-primary"><i class="bi bi-envelope me-1"></i>Enviar link</button>
</form>
</div></div>
<form method="POST" class="card shadow-sm"><div class="card-body">
<?= csrf_field() ?>
<input type="hidden" name="id" value="<?= (int) $target['id'] ?>">
<input type="hidden" name="action" value="set">
<h2 class="h6">Definir manualmente</h2>
<p class="text-muted small">Use apenas quando o email não for uma opção.</p>
<div class="mb-3"><label class="form-label" for="sp-password">Nova palavra-passe <span class="text-muted small">(mín. 8 caracteres)</span></label>
<input type="password" class="form-control" id="sp-password" name="password" required minlength="8" autocomplete="new-password"></div>
<div class="mb-3"><label class="form-label" for="sp-confirm">Confirmar</label>
<input type="password" class="form-control" id="sp-confirm" name="confirm" required autocomplete="new-password"></div>
<button class="btn btn-outline-primary">Definir palavra-passe</button>
<a class="btn btn-link" href="<?= base_url('views/user/index.php') ?>">Voltar</a>
</div></form>
<?php endif; ?>
</div>
<?php include __DIR__ . '/../../includes/footer.php'; ?>