Initial import of fitme3070.pt platform

Plain-PHP fleet platform with id.andmore.pt SSO. Wires shared/platform-tools
as a submodule (platform_update, backups, git/migration tools) like the other
platforms.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

config/auth.php

@@ -0,0 +1,155 @@
+<?php
+// Auth guards — require functions.php (and session_start) before this file.
+
+function require_login(): array {
+    if (empty($_SESSION['user_id'])) {
+        if (identity_is_federated()) {
+            sso_resolve_session($GLOBALS['pdo']);
+        }
+        if (empty($_SESSION['user_id'])) {
+            if (SSO_REQUIRED) {
+                // Bounce through this platform's local login stub instead of
+                // sending id.andmore.pt's return_to straight at a protected
+                // page. The stub (views/auth/login.php) carries the
+                // ?from=sso loop-guard and loads the full functions.php
+                // bootstrap before calling sso_resolve_session().
+                $_rl_return = APP_BASE_URL . 'views/auth/login.php?from=sso';
+                $_rl_qs     = '?return_to=' . urlencode($_rl_return)
+                            . '&platform='  . urlencode(PLATFORM_SLUG);
+                header('Location: ' . ANDMORE_ID_URL . 'auth/login.php' . $_rl_qs);
+            } else {
+                $return = $_SERVER['REQUEST_URI'] ?? '';
+                $qs     = $return ? ('?return_to=' . urlencode($return)) : '';
+                header('Location: ' . base_url('views/auth/login.php' . $qs));
+            }
+            exit;
+        }
+    }
+    return $_SESSION['user'];
+}
+
+// ─── Role ladder ─────────────────────────────────────────────────────────────
+//   sysadmin — super-admin (backups, platform update, app_base_url).
+//   admin    — full staff access except those three sysadmin-only items.
+//   staff    — works only on items assigned to them (e.g. sessions where
+//              photographer_id = users.id). Cannot manage other users,
+//              templates, settings, etc.
+//   client   — portal-only.
+// is_admin()/require_admin() = sysadmin OR admin. is_staff()/require_staff()
+// also includes the plain `staff` role.
+
+// Resolves the dashboard path for a given role. Used by index.php, the auth
+// pages, and require_admin()'s bounce fallback so all four agree on routing.
+function post_login_destination(string $role): string {
+    return match ($role) {
+        'sysadmin', 'admin' => 'views/admin/dashboard.php',
+        'staff'             => 'views/staff/dashboard.php',
+        'client'            => 'views/user/dashboard.php',
+        default             => 'index.php',
+    };
+}
+
+// Accepts sysadmin + admin only. Plain staff and clients are bounced to the
+// dashboard appropriate for their role (avoids redirect loops when an admin-
+// only page bounces a staff user).
+function require_admin(): array {
+    $user = require_login();
+    if (!in_array($user['role'], ['sysadmin', 'admin'])) {
+        header('Location: ' . base_url(post_login_destination($user['role'] ?? '')));
+        exit;
+    }
+    return $user;
+}
+
+// Accepts sysadmin + admin + staff — anyone who can act on assignments.
+// Clients are redirected to the public index.
+function require_staff(): array {
+    $user = require_login();
+    if (!in_array($user['role'], ['sysadmin', 'admin', 'staff'])) {
+        header('Location: ' . base_url('index.php'));
+        exit;
+    }
+    return $user;
+}
+
+// Ownership guard for staff-scoped pages (edit/update_status/send_email/etc).
+// Sysadmin and admin pass for any session. Plain staff only pass when the
+// session's photographer_id matches their user id. Mismatches bounce back to
+// the role-appropriate sessions list.
+function require_session_ownership(array $session): array {
+    $user = require_staff();
+    if (in_array($user['role'], ['sysadmin', 'admin'], true)) return $user;
+    if ((int) ($session['photographer_id'] ?? 0) !== (int) $user['id']) {
+        header('Location: ' . base_url('views/sessions/index.php'));
+        exit;
+    }
+    return $user;
+}
+
+// Sysadmin-only pages (backups, platform update, sensitive settings).
+// Plain admins are sent back to their dashboard.
+function require_sysadmin(): array {
+    $user = require_login();
+    if ($user['role'] !== 'sysadmin') {
+        header('Location: ' . base_url(post_login_destination($user['role'] ?? '')));
+        exit;
+    }
+    return $user;
+}
+
+function current_user(): ?array {
+    return $_SESSION['user'] ?? null;
+}
+
+// True for sysadmin + admin (NOT plain staff).
+function is_admin(): bool {
+    return in_array(current_user()['role'] ?? '', ['sysadmin', 'admin']);
+}
+
+// True for any backoffice user (sysadmin + admin + staff). Use this to show
+// a UI element that any non-client backoffice user should see.
+function is_staff(): bool {
+    return in_array(current_user()['role'] ?? '', ['sysadmin', 'admin', 'staff']);
+}
+
+function is_sysadmin(): bool {
+    return (current_user()['role'] ?? '') === 'sysadmin';
+}
+
+// True for plain admins (not sysadmin, not staff). Useful for "hide from
+// sysadmin" edge cases; most code wants is_admin() or is_sysadmin().
+function is_admin_role(): bool {
+    return (current_user()['role'] ?? '') === 'admin';
+}
+
+// True for plain staff only — the assignment-only role. Used to scope queries
+// to "photographer_id = me" instead of returning all sessions.
+function is_staff_role(): bool {
+    return (current_user()['role'] ?? '') === 'staff';
+}
+
+// Back-compat shim: every is_designer() caller now means "is plain admin".
+function is_designer(): bool {
+    return is_admin_role();
+}
+
+function auth_set_session(array $user): void {
+    // Rotate the session id on every privilege change (login, SSO resolve,
+    // password reset). Defeats session fixation: an attacker who pre-seeded
+    // FOTO_SESS now ends up holding a dead id while the real user gets a fresh
+    // one. The CSRF token is rotated alongside the session id.
+    if (session_status() === PHP_SESSION_ACTIVE) {
+        session_regenerate_id(true);
+        unset($_SESSION['csrf_token']);
+    }
+    $_SESSION['user_id'] = $user['id'];
+    $_SESSION['user']    = [
+        'id'          => $user['id'],
+        'name'        => $user['name'],
+        'email'       => $user['email'],
+        'role'        => $user['role'],
+        // Carried so sso_resolve_session() can detect when the am_sso cookie
+        // identifies a different person than the current local session.
+        'andmore_id'  => isset($user['andmore_id']) ? (int) $user['andmore_id'] : null,
+    ];
+}