fitme3070.pt/views/auth/register.php

<?php
// Local self-registration for clients. Creates (or claims — see
// auth_register_client) a `client` row with a password and signs the person in.

require __DIR__ . '/../../config/db.php';
require_once __DIR__ . '/../../config/functions.php';

if (!empty($_SESSION['user_id'])) {
    header('Location: ' . base_url(post_login_destination($_SESSION['user']['role'] ?? '')));
    exit;
}

$error = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    csrf_check();

    // Tighter than login: each signup writes a row.
    if (!throttle_check($pdo, 'register', 3, 10)) {
        throttle_block('register form');
    }
    throttle_record($pdo, 'register');

    $name     = trim($_POST['name'] ?? '');
    $email    = trim($_POST['email'] ?? '');
    $phone    = trim($_POST['phone'] ?? '');
    $password = $_POST['password'] ?? '';
    $confirm  = $_POST['confirm'] ?? '';

    if ($name === '' || $email === '' || $password === '') {
        $error = 'Nome, email e palavra-passe são obrigatórios.';
    } elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        $error = 'Endereço de email inválido.';
    } elseif (strlen($password) < 8) {
        $error = 'A palavra-passe deve ter pelo menos 8 caracteres.';
    } elseif ($password !== $confirm) {
        $error = 'As palavras-passe não coincidem.';
    } elseif (empty($_POST['accept_terms'])) {
        $error = 'É necessário aceitar a política de privacidade.';
    } else {
        $res = auth_register_client($pdo, [
            'name'              => $name,
            'email'             => $email,
            'phone'             => $phone,
            'password'          => $password,
            'marketing_consent' => !empty($_POST['marketing_consent']),
        ]);
        if (isset($res['error'])) {
            $error = 'Já existe uma conta com esse email. Use "Esqueceu a palavra-passe?" para entrar.';
        } else {
            // Sign the new client straight in rather than bouncing them to the
            // login form with credentials they just typed.
            $user = db_get_user($pdo, (int) $res['id']);
            if ($user) {
                // auth_login() (shared) — same primitive views/auth/login.php
                // uses, so a fresh registration and a normal login leave the
                // session/audit trail in the same shape.
                auth_login($pdo, $user);
                header('Location: ' . base_url(post_login_destination($user['role'])));
                exit;
            }
            header('Location: ' . base_url('views/auth/login.php?registered=1'));
            exit;
        }
    }
}

$page_title = 'Criar conta';
include __DIR__ . '/../../includes/auth_header.php';
?>
<p class="auth-sub">Crie a sua conta de cliente.</p>

<?php if ($error): ?>
    <div class="alert alert-danger py-2 small"><?= htmlspecialchars($error) ?></div>
<?php endif; ?>

<form method="POST" novalidate>
    <?= csrf_field() ?>
    <div class="mb-3">
        <label class="form-label" for="reg-name">Nome</label>
        <input type="text" id="reg-name" name="name" class="form-control" required autofocus
               autocomplete="name" value="<?= htmlspecialchars($_POST['name'] ?? '') ?>">
    </div>
    <div class="mb-3">
        <label class="form-label" for="reg-email">Email</label>
        <input type="email" id="reg-email" name="email" class="form-control" required
               autocomplete="email" inputmode="email"
               value="<?= htmlspecialchars($_POST['email'] ?? '') ?>">
    </div>
    <div class="mb-3">
        <label class="form-label" for="reg-phone">Telefone <span class="text-muted small">(opcional)</span></label>
        <input type="tel" id="reg-phone" name="phone" class="form-control"
               autocomplete="tel" value="<?= htmlspecialchars($_POST['phone'] ?? '') ?>">
    </div>
    <div class="mb-3">
        <label class="form-label" for="reg-password">Palavra-passe <span class="text-muted small">(mín. 8 caracteres)</span></label>
        <div class="input-group">
            <input type="password" id="reg-password" name="password" class="form-control" required minlength="8"
                   autocomplete="new-password">
            <button class="btn btn-outline-secondary" type="button" tabindex="-1"
                    data-toggle-password="reg-password" aria-label="Mostrar palavra-passe">
                <i class="bi bi-eye"></i>
            </button>
        </div>
    </div>
    <div class="mb-3">
        <label class="form-label" for="reg-confirm">Confirmar palavra-passe</label>
        <input type="password" id="reg-confirm" name="confirm" class="form-control" required
               autocomplete="new-password">
    </div>
    <div class="form-check small mb-2">
        <input class="form-check-input" type="checkbox" name="accept_terms" id="reg-terms" value="1"
               <?= !empty($_POST['accept_terms']) ? 'checked' : '' ?>>
        <label class="form-check-label" for="reg-terms">
            Li e aceito a <a href="<?= htmlspecialchars(base_url('home/privacidade')) ?>" target="_blank" rel="noopener">política de privacidade</a>.
        </label>
    </div>
    <div class="form-check small mb-4">
        <input class="form-check-input" type="checkbox" name="marketing_consent" id="reg-marketing" value="1"
               <?= !empty($_POST['marketing_consent']) ? 'checked' : '' ?>>
        <label class="form-check-label" for="reg-marketing">Aceito receber comunicações de marketing.</label>
    </div>
    <button type="submit" class="btn btn-primary w-100">Criar conta</button>
</form>

<hr class="my-3">
<p class="text-center small mb-0 auth-foot">
    Já tem conta? <a href="<?= htmlspecialchars(base_url('views/auth/login.php')) ?>">Entrar</a>
</p>
<?php include __DIR__ . '/../../includes/auth_footer.php'; ?>