Rebuild OMSORG Connect from scratch: login-only milestone
New omsorgWeb/mitarbeiter-app/ replaces the legacy PHP app for now with just the login flow, built fresh instead of incrementally refactored. Reuses the already-working omsorgCore JWT auth pattern (login, silent refresh, session-stored token pair, /api/auth/me for role+permissions) but drops everything legacy carried alongside it: no local MySQL user cache, no admin/user-management endpoints, no admin UI. Employee/user management stays exclusive to OMSORG Desktop per architecture decision - Connect only ever acts on the current user's own session. logout.php additionally revokes the refresh token server-side via omsorgcore_logout(), which the legacy version never did. Verified end-to-end against a running omsorgCore instance: login, dashboard via /api/auth/me, logout + token revocation, unauth redirect, and wrong-credential error handling. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Felix Kemmler
co-authored by
Claude Sonnet 5
Claude Sonnet 5
parent
b6c1389c55
commit
ee74ed65f5
@@ -0,0 +1 @@
|
||||
Require all denied
|
||||
@@ -0,0 +1,137 @@
|
||||
<?php
|
||||
// Auth läuft vollständig über omsorgCore (siehe omsorgCoreClient.php) - kein lokaler
|
||||
// Credential-Check, keine lokale users-Tabelle. Alles, was eine Seite über den eingeloggten
|
||||
// Nutzer wissen muss, kommt aus $_SESSION['omsorgcore_profile'] (befüllt von /api/auth/me:
|
||||
// username, firstName, lastName, email, phoneNumber, role, permissions).
|
||||
require_once __DIR__ . '/omsorgCoreClient.php';
|
||||
|
||||
$secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off')
|
||||
|| (($_SERVER['SERVER_PORT'] ?? null) == 443);
|
||||
session_set_cookie_params([
|
||||
'lifetime' => 0,
|
||||
'path' => '/',
|
||||
'httponly' => true,
|
||||
'secure' => $secure,
|
||||
'samesite' => 'Lax',
|
||||
]);
|
||||
session_name('OMSORG_FELIX_APP');
|
||||
session_start();
|
||||
|
||||
function _omsorgcore_config(): array {
|
||||
static $config = null;
|
||||
if ($config === null) {
|
||||
$config = require __DIR__ . '/config.php';
|
||||
}
|
||||
return $config;
|
||||
}
|
||||
|
||||
// Stellt sicher, dass $_SESSION['omsorgcore_access_token'] gültig ist - erneuert bei Bedarf still
|
||||
// über den Refresh-Token (Server-seitig, der Browser bekommt nie einen Token zu sehen).
|
||||
function _ensure_fresh_token(): bool {
|
||||
if (empty($_SESSION['omsorgcore_access_token']) || empty($_SESSION['omsorgcore_refresh_token'])) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$expiresAt = $_SESSION['omsorgcore_access_expires_at'] ?? null;
|
||||
$stillValid = $expiresAt && strtotime($expiresAt) > time() + 30; // 30s Puffer
|
||||
if ($stillValid) {
|
||||
return true;
|
||||
}
|
||||
|
||||
$result = omsorgcore_refresh(_omsorgcore_config(), $_SESSION['omsorgcore_refresh_token']);
|
||||
if (!$result['ok']) {
|
||||
_clear_omsorgcore_session();
|
||||
return false;
|
||||
}
|
||||
|
||||
_apply_token_pair($result['data']);
|
||||
return true;
|
||||
}
|
||||
|
||||
function _apply_token_pair(array $data): void {
|
||||
$_SESSION['omsorgcore_access_token'] = $data['accessToken'];
|
||||
$_SESSION['omsorgcore_refresh_token'] = $data['refreshToken'];
|
||||
$_SESSION['omsorgcore_access_expires_at'] = $data['expiresAt'];
|
||||
// Noch nicht verdrahtet (kein change-password.php in diesem Milestone) - Flag wird aber
|
||||
// schon gesetzt, damit das Nachziehen später keine Änderung an Login/Session-Core braucht.
|
||||
$_SESSION['omsorgcore_must_change_password'] = !empty($data['mustChangePassword']);
|
||||
}
|
||||
|
||||
function _clear_omsorgcore_session(): void {
|
||||
unset(
|
||||
$_SESSION['omsorgcore_access_token'],
|
||||
$_SESSION['omsorgcore_refresh_token'],
|
||||
$_SESSION['omsorgcore_access_expires_at'],
|
||||
$_SESSION['omsorgcore_must_change_password'],
|
||||
$_SESSION['omsorgcore_profile']
|
||||
);
|
||||
}
|
||||
|
||||
// Lädt/cached /api/auth/me in der Session (Username/Rolle/Rechte). Wird nach Login und bei
|
||||
// jedem is_logged_in()-Aufruf ohne gültigen Cache erneuert.
|
||||
function _refresh_profile(): bool {
|
||||
$result = omsorgcore_me(_omsorgcore_config(), $_SESSION['omsorgcore_access_token']);
|
||||
if (!$result['ok']) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$_SESSION['omsorgcore_profile'] = $result['data'];
|
||||
return true;
|
||||
}
|
||||
|
||||
function is_logged_in(): bool {
|
||||
if (!_ensure_fresh_token()) {
|
||||
return false;
|
||||
}
|
||||
if (empty($_SESSION['omsorgcore_profile'])) {
|
||||
return _refresh_profile();
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
function require_login(): void {
|
||||
if (!is_logged_in()) {
|
||||
header('Location: ../index.php');
|
||||
exit;
|
||||
}
|
||||
if ($_SERVER['REQUEST_METHOD'] === 'POST' && !empty($_POST)) {
|
||||
verify_csrf();
|
||||
}
|
||||
}
|
||||
|
||||
function csrf_token(): string {
|
||||
if (empty($_SESSION['csrf_token'])) {
|
||||
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
|
||||
}
|
||||
return $_SESSION['csrf_token'];
|
||||
}
|
||||
|
||||
function csrf_field(): string {
|
||||
return '<input type="hidden" name="csrf_token" value="' . csrf_token() . '">';
|
||||
}
|
||||
|
||||
function verify_csrf(): void {
|
||||
$token = $_POST['csrf_token'] ?? '';
|
||||
if (!hash_equals(csrf_token(), $token)) {
|
||||
http_response_code(403);
|
||||
exit('Ungültige Anfrage.');
|
||||
}
|
||||
}
|
||||
|
||||
function current_username(): string {
|
||||
return $_SESSION['omsorgcore_profile']['username'] ?? '';
|
||||
}
|
||||
|
||||
function current_name(): string {
|
||||
$profile = $_SESSION['omsorgcore_profile'] ?? [];
|
||||
$name = trim(($profile['firstName'] ?? '') . ' ' . ($profile['lastName'] ?? ''));
|
||||
return $name !== '' ? $name : current_username();
|
||||
}
|
||||
|
||||
function current_role(): string {
|
||||
return $_SESSION['omsorgcore_profile']['role'] ?? '';
|
||||
}
|
||||
|
||||
function e(string $s): string {
|
||||
return htmlspecialchars($s, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
|
||||
}
|
||||
@@ -0,0 +1,7 @@
|
||||
<?php
|
||||
// Vorlage: nach config.secret.php kopieren und mit echten Werten füllen.
|
||||
// config.secret.php niemals ins Repo/Backup geben.
|
||||
return [
|
||||
// Produktiv auf die echte omsorgCore-URL überschreiben (Default in config.php ist localhost, nur für lokale Entwicklung):
|
||||
// 'omsorg_core_url' => 'https://core.omsorg-pflegedienste.de',
|
||||
];
|
||||
@@ -0,0 +1,59 @@
|
||||
<?php
|
||||
// Minimale Hülle für dieses Milestone - nur Dashboard im Nav, keine Admin-Sichtbarkeit
|
||||
// (Connect hat kategorisch keine Admin-Oberfläche, siehe CLAUDE.md).
|
||||
function layout_start(string $title): void {
|
||||
$name = current_name();
|
||||
?>
|
||||
<!DOCTYPE html>
|
||||
<html lang="de">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width,initial-scale=1">
|
||||
<title><?= e($title) ?></title>
|
||||
<link rel="stylesheet" href="../app.css">
|
||||
<meta name="csrf-token" content="<?= csrf_token() ?>">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
<div class="dashboard-layout">
|
||||
|
||||
<aside class="sidebar glass">
|
||||
<div class="sidebar-brand">
|
||||
<img src="../assets/omsorg-wordmark-new.png" alt="OMSORG">
|
||||
<span class="sidebar-app-name">Mitarbeiter-App</span>
|
||||
</div>
|
||||
|
||||
<div class="sidebar-user">
|
||||
<div class="sidebar-avatar"><?= e(mb_substr($name, 0, 1)) ?></div>
|
||||
<div>
|
||||
<b><?= e($name) ?></b>
|
||||
<small><?= e(current_role()) ?></small>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<nav class="sidebar-nav">
|
||||
<a href="dashboard.php" class="active">
|
||||
<span class="nav-icon">⊞</span><span class="nav-label"> Dashboard</span>
|
||||
</a>
|
||||
</nav>
|
||||
|
||||
<div class="sidebar-footer">
|
||||
<a href="../actions/logout.php" class="sidebar-logout">Abmelden</a>
|
||||
</div>
|
||||
</aside>
|
||||
|
||||
<main class="main-content">
|
||||
<div class="main-inner">
|
||||
<?php
|
||||
}
|
||||
|
||||
function layout_end(): void {
|
||||
?>
|
||||
</div>
|
||||
</main>
|
||||
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
<?php
|
||||
}
|
||||
@@ -0,0 +1,66 @@
|
||||
<?php
|
||||
// Einzige Stelle, die HTTP-Details von omsorgCore kennt (Basis-URL, Header, JSON-(De)Kodierung) -
|
||||
// analog zu httpClient.cjs/authClient.cjs in omsorgapp. Alle Aufrufer bekommen ein einheitliches
|
||||
// Ergebnis-Array: ['ok' => bool, 'status' => int, 'data' => array|null].
|
||||
//
|
||||
// Nur Auth-Endpunkte - Connect verwaltet keine anderen Nutzer/Rollen/Mitarbeiter (das bleibt
|
||||
// OMSORG Desktop vorbehalten), deshalb fehlen hier bewusst omsorgcore_users_*/roles_*/employees_*.
|
||||
|
||||
function omsorgcore_request(array $config, string $method, string $path, ?array $body = null, ?string $accessToken = null): array
|
||||
{
|
||||
$url = rtrim($config['omsorg_core_url'], '/') . $path;
|
||||
|
||||
$headers = ['Content-Type: application/json'];
|
||||
if ($accessToken !== null) {
|
||||
$headers[] = 'Authorization: Bearer ' . $accessToken;
|
||||
}
|
||||
|
||||
$ch = curl_init($url);
|
||||
curl_setopt_array($ch, [
|
||||
CURLOPT_CUSTOMREQUEST => $method,
|
||||
CURLOPT_HTTPHEADER => $headers,
|
||||
CURLOPT_RETURNTRANSFER => true,
|
||||
CURLOPT_TIMEOUT => 15,
|
||||
CURLOPT_POSTFIELDS => $body !== null ? json_encode($body) : null,
|
||||
]);
|
||||
|
||||
$responseBody = curl_exec($ch);
|
||||
if ($responseBody === false) {
|
||||
$error = curl_error($ch);
|
||||
curl_close($ch);
|
||||
return ['ok' => false, 'status' => 0, 'data' => null, 'error' => $error];
|
||||
}
|
||||
|
||||
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
|
||||
curl_close($ch);
|
||||
|
||||
$data = null;
|
||||
if ($responseBody !== '') {
|
||||
$decoded = json_decode($responseBody, true);
|
||||
$data = json_last_error() === JSON_ERROR_NONE ? $decoded : null;
|
||||
}
|
||||
|
||||
return ['ok' => $status >= 200 && $status < 300, 'status' => $status, 'data' => $data];
|
||||
}
|
||||
|
||||
// --- Auth ---
|
||||
|
||||
function omsorgcore_login(array $config, string $username, string $password): array
|
||||
{
|
||||
return omsorgcore_request($config, 'POST', '/api/auth/login', ['username' => $username, 'password' => $password]);
|
||||
}
|
||||
|
||||
function omsorgcore_refresh(array $config, string $refreshToken): array
|
||||
{
|
||||
return omsorgcore_request($config, 'POST', '/api/auth/refresh', ['refreshToken' => $refreshToken]);
|
||||
}
|
||||
|
||||
function omsorgcore_logout(array $config, string $refreshToken): array
|
||||
{
|
||||
return omsorgcore_request($config, 'POST', '/api/auth/logout', ['refreshToken' => $refreshToken]);
|
||||
}
|
||||
|
||||
function omsorgcore_me(array $config, string $accessToken): array
|
||||
{
|
||||
return omsorgcore_request($config, 'GET', '/api/auth/me', null, $accessToken);
|
||||
}
|
||||
Reference in New Issue
Block a user