andreandClaude Opus 5
aec7b47820
fitme3070.pt delegated all authentication to hub.andmore.pt: views/auth/*
were bounce stubs, and because this domain is outside the .andmore.pt cookie
scope the real handoff was a one-time HTTPS ticket redeem. Bring identity back
in-house — passwords live in users.password_hash, which the SSO migration
never dropped.
Removed: config/sso.php, IDENTITY_MODE, every SSO_* constant and env key,
identity_is_federated() and the cookie/ticket paths in the auth views and the
public-site bootstrap. ANDMORE_ID_URL stays — it is still the hub /notify
endpoint for outbound email/SMS, which the reset mails ride on, and has
nothing to do with authentication now.
Added, ported from the fotografia.andmore.pt sibling rather than invented:
- auth_login() with transparent password_needs_rehash upgrades and the
last_login trail; auth_register_client(); auth_set_password(); the
single-use 2h reset tokens.
- Real login / register / forgot_password / reset_password pages on a new
anonymous shell (includes/auth_header.php). includes/header.php renders
the backoffice sidebar and a logout button, which is wrong for a visitor
who is not signed in yet.
- safe_return_path(), so a crafted ?return_to= cannot bounce a freshly
authenticated user off-site.
- Per-IP throttling on login, register and reset-request. Successes count
too, so a guessed password cannot be parlayed into stuffing the rest of
the user list from the same IP.
- views/user/set_password.php: admin override for anyone whose email is
undeliverable. Prefers mailing an invite link so the backoffice never
handles the password. A plain admin cannot act on a sysadmin, and nobody
can use it on themselves — self-service goes through profile.php, which
demands the current password so a hijacked session cannot lock the owner
out.
Accounts provisioned during the SSO era have password_hash NULL. They get in
via the reset email, or by registering again with the same address:
auth_register_client() claims a passwordless row, but only a plain `client`
one, so knowing a staff address does not let anyone self-assign the role.
users.andmore_id is deliberately left in place. No code reads it any more, but
it records which central identity each row was linked to.
Deployment: apply database/migration_20260913_local_auth.sql (password_resets
+ auth_attempts) in the SAME sysadmin session that pulls this commit — the
forgot-password flow needs that table, and after the pull a login requires a
local password.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
53 lines
3.0 KiB
Bash
53 lines
3.0 KiB
Bash
# ─── Environment ────────────────────────────────────────────────────────────
|
|
# 'dev' enables error display. 'prod' is silent.
|
|
APP_ENV=dev
|
|
|
|
# Public base URL used by base_url() helpers and email links.
|
|
APP_BASE_URL=https://fitme3070.pt/
|
|
|
|
# ─── Branding ───────────────────────────────────────────────────────────────
|
|
# Selects assets/css/branding-<BRAND>.css for both the backoffice header and
|
|
# the public site head. Files are committed; falls back to `fitme3070`.
|
|
BRAND=fitme3070
|
|
|
|
# ─── Database (local fitme3070) ─────────────────────────────────────────────
|
|
DB_HOST=127.0.0.1
|
|
DB_PORT=3306
|
|
DB_NAME=fitme3070
|
|
DB_USER=root
|
|
DB_PASS=
|
|
|
|
# ─── Notifications (email + SMS) ─────────────────────────────────────────────
|
|
# Delivery is centralized at id.andmore.pt (/notify). This app does not send
|
|
# mail/SMS itself. Auth + endpoint are ANDMORE_ID_URL + NOTIFY_API_KEY below.
|
|
|
|
# ─── Backup ─────────────────────────────────────────────────────────────────
|
|
BACKUP_TOKEN=replace_me
|
|
BACKUP_KEEP_DAYS=7
|
|
|
|
# ─── Andmore hub (notifications only) ────────────────────────────────────────
|
|
# This install owns its own login: passwords live in users.password_hash and
|
|
# views/auth/login.php is a real form. The Andmore ID / SSO delegation was
|
|
# removed — no IDENTITY_MODE, no SSO_* keys, no central sso_sessions table.
|
|
#
|
|
# ANDMORE_ID_URL stays only because outbound email/SMS is still relayed through
|
|
# the hub's /notify endpoint (see NOTIFY_API_KEY below).
|
|
ANDMORE_ID_URL=https://hub.andmore.pt/
|
|
|
|
# ─── Notificações centralizadas (id.andmore.pt /notify) ──────────────────────
|
|
# App key for POST {ANDMORE_ID_URL}notify/send. Minted on id.andmore.pt →
|
|
# Notificações → Chaves de app.
|
|
NOTIFY_API_KEY=
|
|
|
|
# ─── Hub social content endpoint (api/hub-content.php) ─────────────────────────
|
|
# Shared secret the hub social-post generator signs its pull requests with.
|
|
# Generated on id.andmore.pt → Plataformas → fitme3070 → "Gerar segredo de
|
|
# conteúdo", and registered there as this platform's content_secret with the
|
|
# content_endpoint pointing at {APP_BASE_URL}api/hub-content.php. Empty disables
|
|
# the endpoint (503).
|
|
HUB_CONTENT_SECRET=
|
|
|
|
# ─── Git HTTP authentication (views/sysadmin/platform_update.php) ──────────────
|
|
GIT_HTTP_USERNAME=
|
|
GIT_HTTP_TOKEN=
|