andreandClaude Opus 5
aec7b47820
fitme3070.pt delegated all authentication to hub.andmore.pt: views/auth/*
were bounce stubs, and because this domain is outside the .andmore.pt cookie
scope the real handoff was a one-time HTTPS ticket redeem. Bring identity back
in-house — passwords live in users.password_hash, which the SSO migration
never dropped.
Removed: config/sso.php, IDENTITY_MODE, every SSO_* constant and env key,
identity_is_federated() and the cookie/ticket paths in the auth views and the
public-site bootstrap. ANDMORE_ID_URL stays — it is still the hub /notify
endpoint for outbound email/SMS, which the reset mails ride on, and has
nothing to do with authentication now.
Added, ported from the fotografia.andmore.pt sibling rather than invented:
- auth_login() with transparent password_needs_rehash upgrades and the
last_login trail; auth_register_client(); auth_set_password(); the
single-use 2h reset tokens.
- Real login / register / forgot_password / reset_password pages on a new
anonymous shell (includes/auth_header.php). includes/header.php renders
the backoffice sidebar and a logout button, which is wrong for a visitor
who is not signed in yet.
- safe_return_path(), so a crafted ?return_to= cannot bounce a freshly
authenticated user off-site.
- Per-IP throttling on login, register and reset-request. Successes count
too, so a guessed password cannot be parlayed into stuffing the rest of
the user list from the same IP.
- views/user/set_password.php: admin override for anyone whose email is
undeliverable. Prefers mailing an invite link so the backoffice never
handles the password. A plain admin cannot act on a sysadmin, and nobody
can use it on themselves — self-service goes through profile.php, which
demands the current password so a hijacked session cannot lock the owner
out.
Accounts provisioned during the SSO era have password_hash NULL. They get in
via the reset email, or by registering again with the same address:
auth_register_client() claims a passwordless row, but only a plain `client`
one, so knowing a staff address does not let anyone self-assign the role.
users.andmore_id is deliberately left in place. No code reads it any more, but
it records which central identity each row was linked to.
Deployment: apply database/migration_20260913_local_auth.sql (password_resets
+ auth_attempts) in the SAME sysadmin session that pulls this commit — the
forgot-password flow needs that table, and after the pull a login requires a
local password.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
55 lines
2.5 KiB
PHP
55 lines
2.5 KiB
PHP
<?php
|
|
require __DIR__ . '/../../config/db.php';
|
|
require __DIR__ . '/../../config/functions.php';
|
|
$user = require_admin();
|
|
|
|
$users = $pdo->query(
|
|
"SELECT id, name, email, phone, role, is_active, password_hash, last_login_at, last_login_ua
|
|
FROM users ORDER BY FIELD(role,'sysadmin','admin','staff','client'), name"
|
|
)->fetchAll(PDO::FETCH_ASSOC);
|
|
|
|
include __DIR__ . '/../../includes/header.php';
|
|
?>
|
|
<div class="container">
|
|
<h1 class="h3 mb-4">Utilizadores</h1>
|
|
<div class="card shadow-sm"><div class="card-body">
|
|
<div class="table-responsive">
|
|
<table class="am-datatable table table-hover align-middle">
|
|
<thead><tr>
|
|
<th>Nome</th><th>Email</th><th>Perfil</th><th>Ativo</th>
|
|
<th>Palavra-passe</th><th>Último acesso</th><th></th>
|
|
</tr></thead>
|
|
<tbody>
|
|
<?php foreach ($users as $u): ?>
|
|
<tr>
|
|
<td><?= htmlspecialchars($u['name']) ?></td>
|
|
<td><?= htmlspecialchars($u['email']) ?></td>
|
|
<td><span class="badge text-bg-secondary"><?= htmlspecialchars(role_label($u['role'])) ?></span></td>
|
|
<td><?= $u['is_active'] ? '<i class="bi bi-check-circle text-success"></i>' : '<i class="bi bi-x-circle text-muted"></i>' ?></td>
|
|
<td>
|
|
<?php if (!empty($u['password_hash'])): ?>
|
|
<i class="bi bi-key-fill text-success" title="Definida"></i>
|
|
<?php else: ?>
|
|
<span class="badge text-bg-warning-subtle text-warning-emphasis">Por definir</span>
|
|
<?php endif; ?>
|
|
</td>
|
|
<td class="small text-muted">
|
|
<?php if ($u['last_login_at']): ?>
|
|
<?= htmlspecialchars(format_date_pt($u['last_login_at'])) ?>
|
|
· <?= htmlspecialchars(parse_user_agent((string) $u['last_login_ua'])) ?>
|
|
<?php else: ?>—<?php endif; ?>
|
|
</td>
|
|
<td class="text-end">
|
|
<a class="btn btn-sm btn-outline-secondary"
|
|
href="<?= base_url('views/user/set_password.php?id=' . (int) $u['id']) ?>"
|
|
title="Gerir palavra-passe"><i class="bi bi-key"></i></a>
|
|
</td>
|
|
</tr>
|
|
<?php endforeach; ?>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</div></div>
|
|
</div>
|
|
<?php include __DIR__ . '/../../includes/footer.php'; ?>
|