andreandClaude Opus 5
aec7b47820
fitme3070.pt delegated all authentication to hub.andmore.pt: views/auth/*
were bounce stubs, and because this domain is outside the .andmore.pt cookie
scope the real handoff was a one-time HTTPS ticket redeem. Bring identity back
in-house — passwords live in users.password_hash, which the SSO migration
never dropped.
Removed: config/sso.php, IDENTITY_MODE, every SSO_* constant and env key,
identity_is_federated() and the cookie/ticket paths in the auth views and the
public-site bootstrap. ANDMORE_ID_URL stays — it is still the hub /notify
endpoint for outbound email/SMS, which the reset mails ride on, and has
nothing to do with authentication now.
Added, ported from the fotografia.andmore.pt sibling rather than invented:
- auth_login() with transparent password_needs_rehash upgrades and the
last_login trail; auth_register_client(); auth_set_password(); the
single-use 2h reset tokens.
- Real login / register / forgot_password / reset_password pages on a new
anonymous shell (includes/auth_header.php). includes/header.php renders
the backoffice sidebar and a logout button, which is wrong for a visitor
who is not signed in yet.
- safe_return_path(), so a crafted ?return_to= cannot bounce a freshly
authenticated user off-site.
- Per-IP throttling on login, register and reset-request. Successes count
too, so a guessed password cannot be parlayed into stuffing the rest of
the user list from the same IP.
- views/user/set_password.php: admin override for anyone whose email is
undeliverable. Prefers mailing an invite link so the backoffice never
handles the password. A plain admin cannot act on a sysadmin, and nobody
can use it on themselves — self-service goes through profile.php, which
demands the current password so a hijacked session cannot lock the owner
out.
Accounts provisioned during the SSO era have password_hash NULL. They get in
via the reset email, or by registering again with the same address:
auth_register_client() claims a passwordless row, but only a plain `client`
one, so knowing a staff address does not let anyone self-assign the role.
users.andmore_id is deliberately left in place. No code reads it any more, but
it records which central identity each row was linked to.
Deployment: apply database/migration_20260913_local_auth.sql (password_resets
+ auth_attempts) in the SAME sysadmin session that pulls this commit — the
forgot-password flow needs that table, and after the pull a login requires a
local password.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
41 lines
2.6 KiB
PHP
41 lines
2.6 KiB
PHP
<?php
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
// Static, secret-bearing configuration. Operational settings (APP_NAME, base
|
|
// URL, email-from headers, reminder_hours, Nextcloud URL/token, logo filenames)
|
|
// live in the `system_settings` table — see config/functions_settings.php and
|
|
// views/sysadmin/system_settings.php. Only credentials and tokens stay here so
|
|
// DB dumps never expose them.
|
|
//
|
|
// Values come from the .env file (loaded by config/db.php via config/env.php
|
|
// before this file runs). The fallback in each env() call keeps the platform
|
|
// running if .env is missing — never put real production secrets as defaults.
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
// ─── Environment ──────────────────────────────────────────────────────────────
|
|
define('APP_ENV', env('APP_ENV', 'prod'));
|
|
// Email/SMS delivery — including the dev redirect/print safety net — now lives at
|
|
// id.andmore.pt (/notify). See config/functions_notify_client.php. NOTIFY_API_KEY
|
|
// (in .env) authenticates this app to the central service.
|
|
|
|
if (APP_ENV !== 'prod') {
|
|
ini_set('display_errors', '1');
|
|
ini_set('display_startup_errors', '1');
|
|
error_reporting(E_ALL);
|
|
} else {
|
|
ini_set('display_errors', '0');
|
|
error_reporting(E_ALL); // still catch everything, just don't echo it
|
|
}
|
|
|
|
require_once __DIR__ . '/error_handler.php';
|
|
|
|
// ─── Andmore hub (notifications only) ────────────────────────────────────────
|
|
// This install owns its own identity: passwords live in `users.password_hash`
|
|
// and views/auth/login.php is a real form (see config/auth.php). The former
|
|
// Andmore ID / SSO delegation — config/sso.php, the am_sso cookie, the central
|
|
// sso_sessions table and the one-time ticket redeem — was removed.
|
|
//
|
|
// ANDMORE_ID_URL survives because outbound email/SMS is still centralized at
|
|
// the hub's /notify endpoint; see config/functions_notify_client.php. It has
|
|
// nothing to do with authentication anymore.
|
|
define('ANDMORE_ID_URL', rtrim(env('ANDMORE_ID_URL', 'https://hub.andmore.pt'), '/') . '/');
|