Rebuild OMSORG Connect from scratch: login-only milestone

New omsorgWeb/mitarbeiter-app/ replaces the legacy PHP app for now with just the login flow, built fresh instead of incrementally refactored. Reuses the already-working omsorgCore JWT auth pattern (login, silent refresh, session-stored token pair, /api/auth/me for role+permissions) but drops everything legacy carried alongside it: no local MySQL user cache, no admin/user-management endpoints, no admin UI. Employee/user management stays exclusive to OMSORG Desktop per architecture decision - Connect only ever acts on the current user's own session. logout.php additionally revokes the refresh token server-side via omsorgcore_logout(), which the legacy version never did. Verified end-to-end against a running omsorgCore instance: login, dashboard via /api/auth/me, logout + token revocation, unauth redirect, and wrong-credential error handling. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-07 14:32:55 +02:00
parent b6c1389c55
commit ee74ed65f5
11 changed files with 502 additions and 0 deletions
@@ -0,0 +1,137 @@
+<?php
+// Auth läuft vollständig über omsorgCore (siehe omsorgCoreClient.php) - kein lokaler
+// Credential-Check, keine lokale users-Tabelle. Alles, was eine Seite über den eingeloggten
+// Nutzer wissen muss, kommt aus $_SESSION['omsorgcore_profile'] (befüllt von /api/auth/me:
+// username, firstName, lastName, email, phoneNumber, role, permissions).
+require_once __DIR__ . '/omsorgCoreClient.php';
+
+$secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off')
+    || (($_SERVER['SERVER_PORT'] ?? null) == 443);
+session_set_cookie_params([
+    'lifetime' => 0,
+    'path'     => '/',
+    'httponly' => true,
+    'secure'   => $secure,
+    'samesite' => 'Lax',
+]);
+session_name('OMSORG_FELIX_APP');
+session_start();
+
+function _omsorgcore_config(): array {
+    static $config = null;
+    if ($config === null) {
+        $config = require __DIR__ . '/config.php';
+    }
+    return $config;
+}
+
+// Stellt sicher, dass $_SESSION['omsorgcore_access_token'] gültig ist - erneuert bei Bedarf still
+// über den Refresh-Token (Server-seitig, der Browser bekommt nie einen Token zu sehen).
+function _ensure_fresh_token(): bool {
+    if (empty($_SESSION['omsorgcore_access_token']) || empty($_SESSION['omsorgcore_refresh_token'])) {
+        return false;
+    }
+
+    $expiresAt = $_SESSION['omsorgcore_access_expires_at'] ?? null;
+    $stillValid = $expiresAt && strtotime($expiresAt) > time() + 30; // 30s Puffer
+    if ($stillValid) {
+        return true;
+    }
+
+    $result = omsorgcore_refresh(_omsorgcore_config(), $_SESSION['omsorgcore_refresh_token']);
+    if (!$result['ok']) {
+        _clear_omsorgcore_session();
+        return false;
+    }
+
+    _apply_token_pair($result['data']);
+    return true;
+}
+
+function _apply_token_pair(array $data): void {
+    $_SESSION['omsorgcore_access_token']         = $data['accessToken'];
+    $_SESSION['omsorgcore_refresh_token']        = $data['refreshToken'];
+    $_SESSION['omsorgcore_access_expires_at']    = $data['expiresAt'];
+    // Noch nicht verdrahtet (kein change-password.php in diesem Milestone) - Flag wird aber
+    // schon gesetzt, damit das Nachziehen später keine Änderung an Login/Session-Core braucht.
+    $_SESSION['omsorgcore_must_change_password'] = !empty($data['mustChangePassword']);
+}
+
+function _clear_omsorgcore_session(): void {
+    unset(
+        $_SESSION['omsorgcore_access_token'],
+        $_SESSION['omsorgcore_refresh_token'],
+        $_SESSION['omsorgcore_access_expires_at'],
+        $_SESSION['omsorgcore_must_change_password'],
+        $_SESSION['omsorgcore_profile']
+    );
+}
+
+// Lädt/cached /api/auth/me in der Session (Username/Rolle/Rechte). Wird nach Login und bei
+// jedem is_logged_in()-Aufruf ohne gültigen Cache erneuert.
+function _refresh_profile(): bool {
+    $result = omsorgcore_me(_omsorgcore_config(), $_SESSION['omsorgcore_access_token']);
+    if (!$result['ok']) {
+        return false;
+    }
+
+    $_SESSION['omsorgcore_profile'] = $result['data'];
+    return true;
+}
+
+function is_logged_in(): bool {
+    if (!_ensure_fresh_token()) {
+        return false;
+    }
+    if (empty($_SESSION['omsorgcore_profile'])) {
+        return _refresh_profile();
+    }
+    return true;
+}
+
+function require_login(): void {
+    if (!is_logged_in()) {
+        header('Location: ../index.php');
+        exit;
+    }
+    if ($_SERVER['REQUEST_METHOD'] === 'POST' && !empty($_POST)) {
+        verify_csrf();
+    }
+}
+
+function csrf_token(): string {
+    if (empty($_SESSION['csrf_token'])) {
+        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+    }
+    return $_SESSION['csrf_token'];
+}
+
+function csrf_field(): string {
+    return '<input type="hidden" name="csrf_token" value="' . csrf_token() . '">';
+}
+
+function verify_csrf(): void {
+    $token = $_POST['csrf_token'] ?? '';
+    if (!hash_equals(csrf_token(), $token)) {
+        http_response_code(403);
+        exit('Ungültige Anfrage.');
+    }
+}
+
+function current_username(): string {
+    return $_SESSION['omsorgcore_profile']['username'] ?? '';
+}
+
+function current_name(): string {
+    $profile = $_SESSION['omsorgcore_profile'] ?? [];
+    $name = trim(($profile['firstName'] ?? '') . ' ' . ($profile['lastName'] ?? ''));
+    return $name !== '' ? $name : current_username();
+}
+
+function current_role(): string {
+    return $_SESSION['omsorgcore_profile']['role'] ?? '';
+}
+
+function e(string $s): string {
+    return htmlspecialchars($s, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+}