fitme3070.pt/config/auth.php

<?php
// Auth guards — require functions.php (and session_start) before this file.
//
// This install owns its passwords: they live in `users.password_hash` and
// views/auth/login.php is a real form. There is no identity provider in front
// of the app.

function require_login(): array {
    if (empty($_SESSION['user_id'])) {
        $return = $_SERVER['REQUEST_URI'] ?? '';
        $qs     = $return ? ('?return_to=' . urlencode($return)) : '';
        header('Location: ' . base_url('views/auth/login.php' . $qs));
        exit;
    }
    return $_SESSION['user'];
}

// ─── Role ladder ─────────────────────────────────────────────────────────────
//   sysadmin — super-admin (backups, platform update, app_base_url).
//   admin    — full staff access except those three sysadmin-only items.
//   staff    — works only on items assigned to them (e.g. sessions where
//              photographer_id = users.id). Cannot manage other users,
//              templates, settings, etc.
//   client   — portal-only.
// is_admin()/require_admin() = sysadmin OR admin. is_staff()/require_staff()
// also includes the plain `staff` role.

// Resolves the dashboard path for a given role. Used by index.php, the auth
// pages, and require_admin()'s bounce fallback so all four agree on routing.
function post_login_destination(string $role): string {
    return match ($role) {
        'sysadmin', 'admin' => 'views/admin/dashboard.php',
        'staff'             => 'views/staff/dashboard.php',
        'client'            => 'views/user/dashboard.php',
        default             => 'index.php',
    };
}

// Accepts sysadmin + admin only. Plain staff and clients are bounced to the
// dashboard appropriate for their role (avoids redirect loops when an admin-
// only page bounces a staff user).
function require_admin(): array {
    $user = require_login();
    if (!in_array($user['role'], ['sysadmin', 'admin'])) {
        header('Location: ' . base_url(post_login_destination($user['role'] ?? '')));
        exit;
    }
    return $user;
}

// Accepts sysadmin + admin + staff — anyone who can act on assignments.
// Clients are redirected to the public index.
function require_staff(): array {
    $user = require_login();
    if (!in_array($user['role'], ['sysadmin', 'admin', 'staff'])) {
        header('Location: ' . base_url('index.php'));
        exit;
    }
    return $user;
}

// Ownership guard for staff-scoped pages (edit/update_status/send_email/etc).
// Sysadmin and admin pass for any session. Plain staff only pass when the
// session's photographer_id matches their user id. Mismatches bounce back to
// the role-appropriate sessions list.
function require_session_ownership(array $session): array {
    $user = require_staff();
    if (in_array($user['role'], ['sysadmin', 'admin'], true)) return $user;
    if ((int) ($session['photographer_id'] ?? 0) !== (int) $user['id']) {
        header('Location: ' . base_url('views/sessions/index.php'));
        exit;
    }
    return $user;
}

// Sysadmin-only pages (backups, platform update, sensitive settings).
// Plain admins are sent back to their dashboard.
function require_sysadmin(): array {
    $user = require_login();
    if ($user['role'] !== 'sysadmin') {
        header('Location: ' . base_url(post_login_destination($user['role'] ?? '')));
        exit;
    }
    return $user;
}

function current_user(): ?array {
    return $_SESSION['user'] ?? null;
}

// True for sysadmin + admin (NOT plain staff).
function is_admin(): bool {
    return in_array(current_user()['role'] ?? '', ['sysadmin', 'admin']);
}

// True for any backoffice user (sysadmin + admin + staff). Use this to show
// a UI element that any non-client backoffice user should see.
function is_staff(): bool {
    return in_array(current_user()['role'] ?? '', ['sysadmin', 'admin', 'staff']);
}

function is_sysadmin(): bool {
    return (current_user()['role'] ?? '') === 'sysadmin';
}

// True for plain admins (not sysadmin, not staff). Useful for "hide from
// sysadmin" edge cases; most code wants is_admin() or is_sysadmin().
function is_admin_role(): bool {
    return (current_user()['role'] ?? '') === 'admin';
}

// True for plain staff only — the assignment-only role. Used to scope queries
// to "photographer_id = me" instead of returning all sessions.
function is_staff_role(): bool {
    return (current_user()['role'] ?? '') === 'staff';
}

// Back-compat shim: every is_designer() caller now means "is plain admin".
function is_designer(): bool {
    return is_admin_role();
}

function auth_set_session(array $user): void {
    // Rotate the session id on every privilege change (login, registration,
    // password reset). Defeats session fixation: an attacker who pre-seeded
    // FIT_SESS now ends up holding a dead id while the real user gets a fresh
    // one. The CSRF token is rotated alongside the session id.
    if (session_status() === PHP_SESSION_ACTIVE) {
        session_regenerate_id(true);
        unset($_SESSION['csrf_token']);
    }
    $_SESSION['user_id'] = $user['id'];
    $_SESSION['user']    = [
        'id'          => $user['id'],
        'name'        => $user['name'],
        'email'       => $user['email'],
        'role'        => $user['role'],
    ];
}

// Sanitises a ?return_to= value into a path safe to redirect to after login.
// Anything absolute, protocol-relative or backslash-prefixed is discarded so a
// crafted login link can't bounce the user off-site with a fresh session in hand.
function safe_return_path(?string $raw): string {
    $raw = trim((string) $raw);
    if ($raw === '' || $raw[0] !== '/') return '';
    if (str_starts_with($raw, '//') || str_starts_with($raw, '/' . chr(92))) return '';

    // REQUEST_URI includes the deployment base (e.g. /fitme3070.pt/…) while
    // base_url() adds it back, so strip it to avoid doubling the prefix.
    $base = parse_url(APP_BASE_URL, PHP_URL_PATH) ?: '/';
    if ($base !== '/' && str_starts_with($raw, $base)) {
        $raw = substr($raw, strlen($base));
    }
    return ltrim($raw, '/');
}