andre/fitme3070.pt
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial import of fitme3070.pt platform

Browse Source 
Plain-PHP fleet platform with id.andmore.pt SSO. Wires shared/platform-tools
as a submodule (platform_update, backups, git/migration tools) like the other
platforms.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
andreandClaude Opus 4.8 committed 2026-06-12 10:44:58 +01:00
commit e68d357177
2330 files changed
+215968
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

config/sso.php
+286
View File
@@ -0,0 +1,286 @@
<?php
// Identity / SSO integration with id.andmore.pt.
//
// Two modes, picked by IDENTITY_MODE in .env:
//
// standalone — every function in this file is a no-op (returns null/false).
// Local users.id is the only identity that matters.
// federated — register/login flows on this install also write to the central
// andmore_id DB so users.andmore_id is always populated. The
// am_sso cookie is issued by this install so the user lands
// already-logged-in on any other .andmore.pt platform.
//
// Direct DB access is used rather than HTTP for now — easier and matches how
// sso_resolve_session() already works. Swap to an HTTP API later if the
// platforms stop sharing a DB host.
// SSO_COOKIE_NAME is defined in config/config.php (defaults to 'am_sso',
// override via env so prod and dev can coexist on the same parent domain).
// Cached central-DB connection — federated calls reuse it within a request.
function _sso_open_pdo(): ?PDO {
static $cached = null;
if ($cached !== null) return $cached ?: null; // false sentinel = tried and failed
if (!identity_is_federated()) { $cached = false; return null; }
$host = env('SSO_DB_HOST') ?: env('DB_HOST', '127.0.0.1');
$port = (int) (env('SSO_DB_PORT') ?: env('DB_PORT', 3306));
$name = env('SSO_DB_NAME', '');
$user = env('SSO_DB_USER') ?: env('DB_USER', 'root');
$pass = env('SSO_DB_PASS') ?: env('DB_PASS', '');
if (!$name) { $cached = false; return null; }
try {
$cached = new PDO(
"mysql:host={$host};port={$port};dbname={$name};charset=utf8mb4",
$user, $pass,
[
PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
]
);
return $cached;
} catch (PDOException $e) {
error_log('[sso] DB connection failed: ' . $e->getMessage());
$cached = false;
return null;
}
}
// Called by require_login() (and login.php / register.php) before any
// redirect-to-login fallback. When a valid am_sso cookie is present it
// makes sure the local PHP session reflects that exact identity:
// - same andmore_id as the cookie → no-op (fast path).
// - different andmore_id (or no andmore_id) → clear the local session and
// re-provision from the SSO row so a stale Ana-Paula-style login doesn't
// mask the real federated user.
// No-op in standalone mode (the parent-domain cookie wouldn't reach this
// install anyway).
function sso_resolve_session(PDO $pdo): void {
if (!identity_is_federated()) return;
$token = $_COOKIE[SSO_COOKIE_NAME] ?? '';
if (strlen($token) !== 64 || !ctype_xdigit($token)) return;
$ssoPdo = _sso_open_pdo();
if (!$ssoPdo) return;
try {
$stmt = $ssoPdo->prepare("
SELECT s.user_id, u.email, u.name, u.phone, u.is_active
FROM sso_sessions s
JOIN users u ON u.id = s.user_id
WHERE s.token = ?
AND s.expires_at > NOW()
AND u.is_active = 1
LIMIT 1
");
$stmt->execute([$token]);
$ssoRow = $stmt->fetch();
} catch (PDOException $e) {
error_log('[sso] token lookup failed: ' . $e->getMessage());
return;
}
if (!$ssoRow) return;
$canonicalId = (int) $ssoRow['user_id'];
$email = strtolower(trim((string) $ssoRow['email']));
// If a local session is already set, decide whether to keep it or replace.
if (!empty($_SESSION['user_id'])) {
$sessionAndmoreId = (int) ($_SESSION['user']['andmore_id'] ?? 0);
if ($sessionAndmoreId === $canonicalId) {
return; // Same person — keep the existing session.
}
// Either: (a) session is for an unrelated andmore_id (user switched
// identities at id.andmore.pt), or (b) session is for a local-only
// user that never got linked. In both cases the SSO cookie reflects
// the real intent — clear the stale identity bits and re-provision.
unset($_SESSION['user_id'], $_SESSION['user']);
}
// ─── Find or create the local row ────────────────────────────────────
// Lookup order: andmore_id (fast, set on prior logins) → email (canonical
// identity per the SSO-only model). The email branch claims any matching
// row regardless of password_hash — the central platform vouches for the
// email so there is no "another person owns this address" scenario to
// worry about. UNIQUE(email) on the users table guarantees at most one
// match.
$stmt = $pdo->prepare("SELECT * FROM users WHERE andmore_id = ? LIMIT 1");
$stmt->execute([$canonicalId]);
$user = $stmt->fetch();
if (!$user) {
$stmt = $pdo->prepare("SELECT * FROM users WHERE email = ? LIMIT 1");
$stmt->execute([$email]);
$user = $stmt->fetch();
if (!$user) {
// No local row yet — provision a fresh client row stamped with
// andmore_id. Role default = client; staff promotion happens by
// an admin editing the row later.
try {
$pdo->prepare("
INSERT INTO users (name, email, phone, role, andmore_id, is_active)
VALUES (?, ?, ?, 'client', ?, 1)
")->execute([
(string) $ssoRow['name'],
$email,
$ssoRow['phone'] ?: null,
$canonicalId,
]);
} catch (PDOException $e) {
error_log('[sso] provisioning insert failed: ' . $e->getMessage());
return;
}
$stmt = $pdo->prepare("SELECT * FROM users WHERE andmore_id = ? LIMIT 1");
$stmt->execute([$canonicalId]);
$user = $stmt->fetch();
}
}
if (!$user || !$user['is_active']) return;
// ─── Sync per-tenant row with central data ───────────────────────────
// Stamp the link if missing, refresh name/phone when the central record
// has a newer value. Local role is preserved — id.andmore.pt does not
// know about per-tenant roles.
$patch = [];
if (empty($user['andmore_id']) || (int) $user['andmore_id'] !== $canonicalId) {
$patch['andmore_id'] = $canonicalId;
}
if (!empty($ssoRow['name']) && $ssoRow['name'] !== $user['name']) {
$patch['name'] = (string) $ssoRow['name'];
}
if (!empty($ssoRow['phone']) && $ssoRow['phone'] !== ($user['phone'] ?? '')) {
$patch['phone'] = (string) $ssoRow['phone'];
}
if ($patch) {
$set = implode(', ', array_map(fn ($k) => "$k = ?", array_keys($patch)));
$pdo->prepare("UPDATE users SET $set WHERE id = ?")
->execute([...array_values($patch), (int) $user['id']]);
$user = array_merge($user, $patch);
}
$ip = $_SERVER['REMOTE_ADDR'] ?? null;
$ua = substr($_SERVER['HTTP_USER_AGENT'] ?? '', 0, 512) ?: null;
$pdo->prepare("UPDATE users SET last_login_at = NOW(), last_login_ip = ?, last_login_ua = ? WHERE id = ?")
->execute([$ip, $ua, $user['id']]);
auth_set_session($user);
}
// ─── Upstream sync (federated mode) ──────────────────────────────────────────
//
// Only the admin-vouched immediate link + the cookie issuer remain. The older
// two-phase verify-email flow (request_link / redeem_pending / has_pending)
// was used by the local register/login pages, which were removed when the
// platform became SSO-only. sso_resolve_session() does the email-match work
// directly now — no token round-trip needed.
// Admin-vouched immediate link. Used by auth_create_admin() / auth_create_staff()
// when a sysadmin/admin creates a backoffice user on this satellite. Instead of
// the verify-email round-trip, we trust the admin's vouching: the password the
// admin set on the local form is also written to the central row so the new
// person can immediately use SSO on any sibling .andmore.pt platform.
//
// - No central row for this email → create central row WITH the password
// (admin-set, email_verified_at stamped).
// - Passwordless central row exists → claim it AND set the password.
// - Passworded central row exists → refuse with 'andmore_email_taken'.
// An admin can't silently reset
// someone else's Andmore ID.
//
// Outcomes:
// ['canonical_id' => int] ok — stamp this on the local row
// ['error' => 'andmore_email_taken'] central row exists with a password
// ['error' => 'unavailable'] central DB unreachable
// ['error' => 'standalone'] IDENTITY_MODE != federated
function identity_upstream_link_immediate(string $email, string $name, ?string $phone, ?string $password = null): array {
if (!identity_is_federated()) return ['error' => 'standalone'];
$ssoPdo = _sso_open_pdo();
if (!$ssoPdo) return ['error' => 'unavailable'];
$email = strtolower(trim($email));
$hash = ($password !== null && $password !== '')
? password_hash($password, PASSWORD_DEFAULT)
: null;
try {
$stmt = $ssoPdo->prepare("SELECT id, password_hash FROM users WHERE email = ? LIMIT 1");
$stmt->execute([$email]);
$row = $stmt->fetch();
if ($row) {
if (!empty($row['password_hash'])) {
return ['error' => 'andmore_email_taken'];
}
// Passwordless placeholder — claim it AND set the admin-vouched password.
if ($hash !== null) {
$ssoPdo->prepare("
UPDATE users
SET name = COALESCE(NULLIF(?, ''), name),
phone = COALESCE(NULLIF(?, ''), phone),
password_hash = ?,
email_verified_at = COALESCE(email_verified_at, NOW())
WHERE id = ?
")->execute([$name, (string) $phone, $hash, (int) $row['id']]);
}
return ['canonical_id' => (int) $row['id']];
}
$ssoPdo->prepare("
INSERT INTO users (name, email, phone, password_hash, email_verified_at)
VALUES (?, ?, ?, ?, ?)
")->execute([
$name,
$email,
$phone,
$hash,
$hash !== null ? date('Y-m-d H:i:s') : null,
]);
return ['canonical_id' => (int) $ssoPdo->lastInsertId()];
} catch (PDOException $e) {
error_log('[sso] upstream link-immediate failed: ' . $e->getMessage());
return ['error' => 'unavailable'];
}
}
// Issue an am_sso cookie scoped to the parent domain by inserting a row into
// the central sso_sessions table. Lets the user land already-logged-in on any
// other .andmore.pt platform. No-op when standalone or when SSO_COOKIE_DOMAIN
// isn't set.
function identity_upstream_issue_cookie(int $canonicalUserId): void {
if (!identity_is_federated() || SSO_COOKIE_DOMAIN === '') return;
$ssoPdo = _sso_open_pdo();
if (!$ssoPdo) return;
try {
$token = bin2hex(random_bytes(32));
$ttl = max(1, SSO_SESSION_TTL_DAYS) * 86400;
$ip = $_SERVER['REMOTE_ADDR'] ?? null;
$ua = substr($_SERVER['HTTP_USER_AGENT'] ?? '', 0, 512) ?: null;
$ssoPdo->prepare("
INSERT INTO sso_sessions (token, user_id, expires_at, ip, ua, last_seen_at)
VALUES (?, ?, DATE_ADD(NOW(), INTERVAL ? SECOND), ?, ?, NOW())
")->execute([$token, $canonicalUserId, $ttl, $ip, $ua]);
setcookie(SSO_COOKIE_NAME, $token, [
'expires' => time() + $ttl,
'path' => '/',
'domain' => SSO_COOKIE_DOMAIN,
// request_is_https() respects X-Forwarded-Proto when TRUSTED_PROXY=true
// — needed so the Secure flag isn't dropped behind nginx/Cloudflare.
'secure' => request_is_https(),
'httponly' => true,
'samesite' => 'Lax',
]);
} catch (PDOException $e) {
error_log('[sso] upstream cookie issue failed: ' . $e->getMessage());
}
}