initial commit for rvr-nextgen

src/Cli/AddUserCommand.php

@@ -0,0 +1,50 @@
+<?php namespace RVR\Cli;
+
+use DateTime;
+use SokoWeb\PersistentData\PersistentDataManager;
+use RVR\PersistentData\Model\User;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+
+class AddUserCommand extends Command
+{
+    public function configure(): void
+    {
+        $this->setName('user:add')
+            ->setDescription('Adding of user.')
+            ->addArgument('email', InputArgument::REQUIRED, 'Email of user')
+            ->addArgument('password', InputArgument::REQUIRED, 'Password of user')
+            ->addArgument('type', InputArgument::OPTIONAL, 'Type of user');;
+    }
+
+    public function execute(InputInterface $input, OutputInterface $output): int
+    {
+        $user = new User();
+        $user->setEmail($input->getArgument('email'));
+        $user->setPlainPassword($input->getArgument('password'));
+        $user->setCreatedDate(new DateTime());
+
+        if ($input->hasArgument('type') && $input->getArgument('type') !== null) {
+            $user->setType($input->getArgument('type'));
+        }
+
+        try {
+            $pdm = new PersistentDataManager();
+            $pdm->saveToDb($user);
+        } catch (\Exception $e) {
+            $output->writeln('<error>Adding user failed!</error>');
+            $output->writeln('');
+
+            $output->writeln((string) $e);
+            $output->writeln('');
+
+            return 1;
+        }
+
+        $output->writeln('<info>User was successfully added!</info>');
+
+        return 0;
+    }
+}

src/Cli/LinkViewCommand.php

@@ -0,0 +1,69 @@
+<?php namespace RVR\Cli;
+
+use FilesystemIterator;
+use SokoWeb\View\Linker;
+use RecursiveDirectoryIterator;
+use RecursiveIteratorIterator;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+
+class LinkViewCommand extends Command
+{
+    public function configure(): void
+    {
+        $this->setName('view:link')
+            ->setDescription('Linking of views.')
+            ->addArgument('view', InputArgument::OPTIONAL, 'View file to be linked.');
+    }
+
+    public function execute(InputInterface $input, OutputInterface $output): int
+    {
+        $views = [];
+
+        $view = $input->getArgument('view');
+
+        if ($view !== null) {
+            $views[] = $view;
+        } else {
+            $folder = ROOT . '/views';
+            $folderLength = strlen($folder) + 1;
+
+            $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($folder, FilesystemIterator::SKIP_DOTS), RecursiveIteratorIterator::SELF_FIRST);
+
+            foreach ($iterator as $file) {
+                if ($file->isDir() || $file->getExtension() !== 'php') {
+                    continue;
+                }
+
+                $view = substr($file->getPath(), $folderLength) . '/' . $file->getBasename('.php');
+
+                if (strpos($view, 'templates') === 0 || strpos($view, 'tests') === 0) {
+                    continue;
+                }
+
+                $views[] = $view;
+            }
+        }
+
+        try {
+            foreach ($views as $view) {
+                $generator = new Linker($view);
+                $generator->generate();
+            }
+        } catch (\Exception $e) {
+            $output->writeln('<error>Linking view(s) failed!</error>');
+            $output->writeln('');
+
+            $output->writeln((string) $e);
+            $output->writeln('');
+
+            return 1;
+        }
+
+        $output->writeln('<info>View(s) successfully linked!</info>');
+
+        return 0;
+    }
+}

src/Cli/MaintainDatabaseCommand.php

@@ -0,0 +1,76 @@
+<?php namespace RVR\Cli;
+
+use DateTime;
+use SokoWeb\Database\Query\Modify;
+use SokoWeb\Database\Query\Select;
+use SokoWeb\Interfaces\Database\IResultSet;
+use SokoWeb\PersistentData\PersistentDataManager;
+use RVR\Repository\UserPasswordResetterRepository;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+
+class MaintainDatabaseCommand extends Command
+{
+    private PersistentDataManager $pdm;
+
+    private UserPasswordResetterRepository $userPasswordResetterRepository;
+
+    public function __construct()
+    {
+        parent::__construct();
+
+        $this->pdm = new PersistentDataManager();
+        $this->userPasswordResetterRepository = new UserPasswordResetterRepository();
+    }
+
+    public function configure(): void
+    {
+        $this->setName('db:maintain')
+            ->setDescription('Maintain database.');
+    }
+
+    public function execute(InputInterface $input, OutputInterface $output): int
+    {
+        try {
+            $this->deleteExpiredPasswordResetters();
+            $this->deleteExpiredSessions();
+        } catch (\Exception $e) {
+            $output->writeln('<error>Maintenance failed!</error>');
+            $output->writeln('');
+
+            $output->writeln((string) $e);
+            $output->writeln('');
+
+            return 1;
+        }
+
+        $output->writeln('<info>Maintenance was successful!</info>');
+        $output->writeln('');
+
+        return 0;
+    }
+
+    private function deleteExpiredPasswordResetters(): void
+    {
+        foreach ($this->userPasswordResetterRepository->getAllExpired() as $passwordResetter) {
+            $this->pdm->deleteFromDb($passwordResetter);
+        }
+    }
+
+    private function deleteExpiredSessions(): void
+    {
+        //TODO: model may be used for sessions too
+        $select = new Select(\Container::$dbConnection, 'sessions');
+        $select->columns(['id']);
+        $select->where('updated', '<', (new DateTime('-7 days'))->format('Y-m-d H:i:s'));
+
+        $result = $select->execute();
+
+        while ($session = $result->fetch(IResultSet::FETCH_ASSOC)) {
+            $modify = new Modify(\Container::$dbConnection, 'sessions');
+            $modify->setId($session['id']);
+            $modify->delete();
+        }
+    }
+}

src/Cli/MigrateDatabaseCommand.php

@@ -0,0 +1,122 @@
+<?php namespace RVR\Cli;
+
+use SokoWeb\Database\Query\Modify;
+use SokoWeb\Database\Query\Select;
+use SokoWeb\Interfaces\Database\IResultSet;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+
+class MigrateDatabaseCommand extends Command
+{
+    public function configure(): void
+    {
+        $this->setName('db:migrate')
+            ->setDescription('Migration of database changes.');
+    }
+
+    public function execute(InputInterface $input, OutputInterface $output): int
+    {
+        $db = \Container::$dbConnection;
+
+        $db->startTransaction();
+
+        $success = [];
+        try {
+            foreach ($this->readDir('structure') as $file) {
+                $db->multiQuery(file_get_contents($file));
+
+                $success[] = $this->saveToDB($file, 'structure');
+            }
+
+            foreach ($this->readDir('data') as $file) {
+                require $file;
+
+                $success[] = $this->saveToDB($file, 'data');
+            }
+        } catch (\Exception $e) {
+            $db->rollback();
+
+            $output->writeln('<error>Migration failed!</error>');
+            $output->writeln('');
+
+            $output->writeln((string) $e);
+            $output->writeln('');
+
+            return 1;
+        }
+
+        $db->commit();
+
+        $output->writeln('<info>Migration was successful!</info>');
+        $output->writeln('');
+
+        if (count($success) > 0) {
+            foreach ($success as $migration) {
+                $output->writeln($migration);
+            }
+
+            $output->writeln('');
+        }
+
+        return 0;
+    }
+
+    private function readDir(string $type): array
+    {
+        $done = [];
+
+        $migrationTableExists = \Container::$dbConnection->query('SELECT count(*)
+            FROM information_schema.tables
+            WHERE table_schema = \'' . $_ENV['DB_NAME'] . '\'
+            AND table_name = \'migrations\';')
+            ->fetch(IResultSet::FETCH_NUM)[0];
+
+        if ($migrationTableExists != 0) {
+            $select = new Select(\Container::$dbConnection, 'migrations');
+            $select->columns(['migration']);
+            $select->where('type', '=', $type);
+            $select->orderBy('migration');
+
+            $result = $select->execute();
+
+            while ($migration = $result->fetch(IResultSet::FETCH_ASSOC)) {
+                $done[] = $migration['migration'];
+            }
+        }
+
+        $path = ROOT . '/database/migrations/' . $type;
+        $dir = opendir($path);
+
+        if ($dir === false) {
+            throw new \Exception('Cannot open dir: ' . $path);
+        }
+
+        $files = [];
+        while ($file = readdir($dir)) {
+            $filePath = $path . '/' . $file;
+
+            if (!is_file($filePath) || in_array(pathinfo($file, PATHINFO_FILENAME), $done)) {
+                continue;
+            }
+
+            $files[] = $filePath;
+        }
+
+        natsort($files);
+
+        return $files;
+    }
+
+    private function saveToDB(string $file, string $type): string
+    {
+        $baseName = pathinfo($file, PATHINFO_FILENAME);
+
+        $modify = new Modify(\Container::$dbConnection, 'migrations');
+        $modify->set('migration', $baseName);
+        $modify->set('type', $type);
+        $modify->save();
+
+        return $baseName . ' (' . $type . ')';
+    }
+}

src/Controller/HomeController.php

@@ -0,0 +1,27 @@
+<?php namespace RVR\Controller;
+
+use SokoWeb\Interfaces\Authorization\ISecured;
+use SokoWeb\Interfaces\Request\IRequest;
+use SokoWeb\Interfaces\Response\IContent;
+use SokoWeb\Response\HtmlContent;
+use SokoWeb\Response\JsonContent;
+
+class HomeController implements ISecured
+{
+    private IRequest $request;
+
+    public function __construct(IRequest $request)
+    {
+        $this->request = $request;
+    }
+
+    public function authorize(): bool
+    {
+        return $this->request->user() !== null;
+    }
+
+    public function getIndex(): IContent
+    {
+        return new HtmlContent('index');
+    }
+}

src/Controller/LoginController.php

@@ -0,0 +1,302 @@
+<?php namespace RVR\Controller;
+
+use DateTime;
+use SokoWeb\Http\Request;
+use SokoWeb\Interfaces\Request\IRequest;
+use SokoWeb\Interfaces\Response\IContent;
+use SokoWeb\Interfaces\Response\IRedirect;
+use SokoWeb\Mailing\Mail;
+use SokoWeb\OAuth\GoogleOAuth;
+use RVR\PersistentData\Model\UserPasswordResetter;
+use SokoWeb\PersistentData\PersistentDataManager;
+use RVR\Repository\UserPasswordResetterRepository;
+use RVR\Repository\UserRepository;
+use SokoWeb\Response\HtmlContent;
+use SokoWeb\Response\JsonContent;
+use SokoWeb\Response\Redirect;
+use SokoWeb\Util\CaptchaValidator;
+use SokoWeb\Util\JwtParser;
+
+class LoginController
+{
+    private IRequest $request;
+
+    private PersistentDataManager $pdm;
+
+    private UserRepository $userRepository;
+
+    private UserPasswordResetterRepository $userPasswordResetterRepository;
+
+    public function __construct(IRequest $request)
+    {
+        $this->request = $request;
+        $this->pdm = new PersistentDataManager();
+        $this->userRepository = new UserRepository();
+        $this->userPasswordResetterRepository = new UserPasswordResetterRepository();
+    }
+
+    public function getLoginForm()
+    {
+        if ($this->request->user() !== null) {
+            return new Redirect(\Container::$routeCollection->getRoute('index')->generateLink(), IRedirect::TEMPORARY);
+        }
+
+        return new HtmlContent('login/login');
+    }
+
+    public function getGoogleLoginRedirect(): IRedirect
+    {
+        $state = bin2hex(random_bytes(16));
+        $nonce = bin2hex(random_bytes(16));
+
+        $this->request->session()->set('oauth_state', $state);
+        $this->request->session()->set('oauth_nonce', $nonce);
+
+        $oAuth = new GoogleOAuth(new Request());
+        $url = $oAuth->getDialogUrl(
+            $state,
+            $this->request->getBase() . '/' . \Container::$routeCollection->getRoute('login-google-action')->generateLink(),
+            $nonce
+        );
+
+        return new Redirect($url, IRedirect::TEMPORARY);
+    }
+
+    public function getRequestPasswordResetForm()
+    {
+        if ($this->request->user() !== null) {
+            return new Redirect(\Container::$routeCollection->getRoute('index')->generateLink(), IRedirect::TEMPORARY);
+        }
+
+        return new HtmlContent('login/password_reset_request', ['email' => $this->request->query('email')]);
+    }
+
+    public function getRequestPasswordResetSuccess(): IContent
+    {
+        return new HtmlContent('login/password_reset_request_success');
+    }
+
+    public function getResetPasswordForm()
+    {
+        if ($this->request->user() !== null) {
+            return new Redirect(\Container::$routeCollection->getRoute('index')->generateLink(), IRedirect::TEMPORARY);
+        }
+
+        $token = $this->request->query('token');
+        $resetter = $this->userPasswordResetterRepository->getByToken($token);
+
+        if ($resetter === null || $resetter->getExpiresDate() < new DateTime()) {
+            return new HtmlContent('login/reset_password', ['success' => false]);
+        }
+
+        $user = $this->userRepository->getById($resetter->getUserId());
+
+        return new HtmlContent('login/reset_password', ['success' => true, 'token' => $token, 'email' => $user->getEmail()]);
+    }
+
+    public function login(): IContent
+    {
+        if ($this->request->user() !== null) {
+            return new JsonContent(['success' => true]);
+        }
+
+        $user = $this->userRepository->getByEmail($this->request->post('email'));
+        if ($user === null || !$user->checkPassword($this->request->post('password'))) {
+            return new JsonContent([
+                'error' => [
+                    'errorText' => 'No user found with the given email address or the given password is wrong. You can <a href="/password/requestReset?email=' .
+                        urlencode($this->request->post('email')) . '" title="Request password reset">request password reset</a>!'
+                ]
+            ]);
+        }
+
+        $this->request->setUser($user);
+
+        return new JsonContent(['success' => true]);
+    }
+
+    public function loginWithGoogle()
+    {
+        $redirectUrl = $this->request->session()->get('redirect_after_login');
+        if ($redirectUrl === null) {
+            $redirectUrl = \Container::$routeCollection->getRoute('index')->generateLink();
+        }
+
+        if ($this->request->user() !== null) {
+            $this->request->session()->delete('redirect_after_login');
+            return new Redirect($redirectUrl, IRedirect::TEMPORARY);
+        }
+
+        if ($this->request->query('state') !== $this->request->session()->get('oauth_state')) {
+            return new HtmlContent('login/google_login');
+        }
+
+        $oAuth = new GoogleOAuth(new Request());
+        $tokenData = $oAuth->getToken(
+            $this->request->query('code'),
+            $this->request->getBase() . '/' . \Container::$routeCollection->getRoute('login-google-action')->generateLink()
+        );
+
+        if (!isset($tokenData['id_token'])) {
+            return new HtmlContent('login/google_login');
+        }
+
+        $jwtParser = new JwtParser($tokenData['id_token']);
+        $idToken = $jwtParser->getPayload();
+
+        if ($idToken['nonce'] !== $this->request->session()->get('oauth_nonce')) {
+            return new HtmlContent('login/google_login');
+        }
+
+        if (!$idToken['email_verified']) {
+            return new HtmlContent('login/google_login');
+        }
+
+        $user = $this->userRepository->getByGoogleSub($idToken['sub']);
+        if ($user === null) {
+            return new JsonContent([
+                'error' => [
+                    'errorText' => 'No user found for this Google account.'
+                ]
+            ]);
+        }
+
+        $this->request->setUser($user);
+
+        $this->request->session()->delete('redirect_after_login');
+        return new Redirect($redirectUrl, IRedirect::TEMPORARY);
+    }
+
+    public function logout(): IRedirect
+    {
+        $this->request->setUser(null);
+
+        return new Redirect(\Container::$routeCollection->getRoute('index')->generateLink(), IRedirect::TEMPORARY);
+    }
+
+    public function requestPasswordReset(): IContent
+    {
+        if ($this->request->user() !== null) {
+            return new JsonContent([
+                'redirect' => [
+                    'target' => '/' . \Container::$routeCollection->getRoute('home')->generateLink()
+                ]
+            ]);
+        }
+
+        if (!empty($_ENV['RECAPTCHA_SITEKEY'])) {
+            if (!$this->request->post('g-recaptcha-response')) {
+                return new JsonContent(['error' => ['errorText' => 'Please check "I\'m not a robot" in the reCAPTCHA box!']]);
+            }
+
+            $captchaValidator = new CaptchaValidator();
+            $captchaResponse = $captchaValidator->validate($this->request->post('g-recaptcha-response'));
+            if (!$captchaResponse['success']) {
+                return new JsonContent(['error' => ['errorText' => 'reCAPTCHA challenge failed. Please try again!']]);
+            }
+        }
+
+        $user = $this->userRepository->getByEmail($this->request->post('email'));
+        if ($user === null) {
+            return new JsonContent([
+                'error' => [
+                    'errorText' => 'No user found with the given email address.'
+                ]
+            ]);
+        }
+
+        $existingResetter = $this->userPasswordResetterRepository->getByUser($user);
+        if ($existingResetter !== null && $existingResetter->getExpiresDate() > new DateTime()) {
+            return new JsonContent([
+                'error' => [
+                    'errorText' => 'Password reset was recently requested for this account. Please check your email, or try again later!'
+                ]
+            ]);
+        }
+
+        $token = bin2hex(random_bytes(16));
+        $expires = new DateTime('+1 hour');
+
+        $passwordResetter = new UserPasswordResetter();
+        $passwordResetter->setUser($user);
+        $passwordResetter->setToken($token);
+        $passwordResetter->setExpiresDate($expires);
+
+        \Container::$dbConnection->startTransaction();
+
+        if ($existingResetter !== null) {
+            $this->pdm->deleteFromDb($existingResetter);
+        }
+
+        $this->pdm->saveToDb($passwordResetter);
+
+        \Container::$dbConnection->commit();
+
+        $this->sendPasswordResetEmail($user->getEmail(), $token, $expires);
+
+        return new JsonContent(['success' => true]);
+    }
+
+    public function resetPassword(): IContent
+    {
+        if ($this->request->user() !== null) {
+            return new JsonContent([
+                'redirect' => [
+                    'target' => '/' . \Container::$routeCollection->getRoute('home')->generateLink()
+                ]
+            ]);
+        }
+
+        $token = $this->request->query('token');
+        $resetter = $this->userPasswordResetterRepository->getByToken($token);
+
+        if ($resetter === null || $resetter->getExpiresDate() < new DateTime()) {
+            return new JsonContent([
+                'redirect' => [
+                    'target' => '/' . \Container::$routeCollection->getRoute('password-reset')->generateLink(['token' => $token])
+                ]
+            ]);
+        }
+
+        if (strlen($this->request->post('password')) < 6) {
+            return new JsonContent([
+                'error' => [
+                    'errorText' => 'The given password is too short. Please choose a password that is at least 6 characters long!'
+                ]
+            ]);
+        }
+
+        if ($this->request->post('password') !== $this->request->post('password_confirm')) {
+            return new JsonContent(['error' => ['errorText' => 'The given passwords do not match.']]);
+        }
+
+        \Container::$dbConnection->startTransaction();
+
+        $this->pdm->deleteFromDb($resetter);
+
+        $user = $this->userRepository->getById($resetter->getUserId());
+        $user->setPlainPassword($this->request->post('password'));
+
+        $this->pdm->saveToDb($user);
+
+        \Container::$dbConnection->commit();
+
+        $this->request->setUser($user);
+
+        return new JsonContent(['success' => true]);
+    }
+
+    private function sendPasswordResetEmail(string $email, string $token, DateTime $expires): void
+    {
+        $mail = new Mail();
+        $mail->addRecipient($email);
+        $mail->setSubject($_ENV['APP_NAME'] . ' - Password reset');
+        $mail->setBodyFromTemplate('password-reset', [
+            'EMAIL' => $email,
+            'RESET_LINK' => $this->request->getBase() . '/' .
+                \Container::$routeCollection->getRoute('password-reset')->generateLink(['token' => $token]),
+            'EXPIRES' => $expires->format('Y-m-d H:i T')
+        ]);
+        $mail->send();
+    }
+}

src/Controller/UserController.php

@@ -0,0 +1,174 @@
+<?php namespace RVR\Controller;
+
+use DateTime;
+use SokoWeb\Http\Request;
+use SokoWeb\Interfaces\Authorization\ISecured;
+use SokoWeb\Interfaces\Request\IRequest;
+use SokoWeb\Interfaces\Response\IContent;
+use SokoWeb\Interfaces\Response\IRedirect;
+use SokoWeb\OAuth\GoogleOAuth;
+use SokoWeb\PersistentData\PersistentDataManager;
+use RVR\PersistentData\Model\User;
+use SokoWeb\Response\HtmlContent;
+use SokoWeb\Response\JsonContent;
+use SokoWeb\Response\Redirect;
+use SokoWeb\Util\JwtParser;
+
+class UserController implements ISecured
+{
+    private IRequest $request;
+
+    private PersistentDataManager $pdm;
+
+    public function __construct(IRequest $request)
+    {
+        $this->request = $request;
+        $this->pdm = new PersistentDataManager();
+    }
+
+    public function authorize(): bool
+    {
+        return $this->request->user() !== null;
+    }
+
+    public function getAccount(): IContent
+    {
+        /**
+         * @var User $user
+         */
+        $user = $this->request->user();
+
+        return new HtmlContent('account/account', ['user' => $user->toArray()]);
+    }
+
+    public function getGoogleAuthenticateRedirect(): IRedirect
+    {
+        /**
+         * @var User $user
+         */
+        $user = $this->request->user();
+
+        $state = bin2hex(random_bytes(16));
+        $nonce = bin2hex(random_bytes(16));
+
+        $this->request->session()->set('oauth_state', $state);
+        $this->request->session()->set('oauth_nonce', $nonce);
+
+        $oAuth = new GoogleOAuth(new Request());
+
+        $url = $oAuth->getDialogUrl(
+            $state,
+            $this->request->getBase() . '/' . \Container::$routeCollection->getRoute('account.googleAuthenticate-action')->generateLink(),
+            $nonce,
+            $user->getEmail()
+        );
+
+        return new Redirect($url, IRedirect::TEMPORARY);
+    }
+
+    public function authenticateWithGoogle(): IContent
+    {
+        /**
+         * @var User $user
+         */
+        $user = $this->request->user();
+
+        if ($this->request->query('state') !== $this->request->session()->get('oauth_state')) {
+            return new HtmlContent('account/google_authenticate', ['success' => false]);
+        }
+
+        $oAuth = new GoogleOAuth(new Request());
+        $tokenData = $oAuth->getToken(
+            $this->request->query('code'),
+            $this->request->getBase() . '/' . \Container::$routeCollection->getRoute('account.googleAuthenticate-action')->generateLink()
+        );
+
+        if (!isset($tokenData['id_token'])) {
+            return new HtmlContent('account/google_authenticate', ['success' => false]);
+        }
+
+        $jwtParser = new JwtParser($tokenData['id_token']);
+        $idToken = $jwtParser->getPayload();
+
+        if ($idToken['nonce'] !== $this->request->session()->get('oauth_nonce')) {
+            return new HtmlContent('account/google_authenticate', ['success' => false]);
+        }
+
+        if ($idToken['sub'] !== $user->getGoogleSub()) {
+            return new HtmlContent('account/google_authenticate', [
+                'success' => false,
+                'errorText' => 'This Google account is not linked to your account.'
+            ]);
+        }
+
+        $authenticatedWithGoogleUntil = new DateTime('+45 seconds');
+        $this->request->session()->set('authenticated_with_google_until', $authenticatedWithGoogleUntil);
+
+        return new HtmlContent('account/google_authenticate', [
+            'success' => true,
+            'authenticatedWithGoogleUntil' => $authenticatedWithGoogleUntil
+        ]);
+    }
+
+    public function saveAccount(): IContent
+    {
+        /**
+         * @var User $user
+         */
+        $user = $this->request->user();
+
+        if (!$this->confirmUserIdentity(
+            $user,
+            $this->request->session()->get('authenticated_with_google_until'),
+            $this->request->post('password'),
+            $error
+        )) {
+            return new JsonContent(['error' => ['errorText' => $error]]);
+        }
+
+        if (strlen($this->request->post('password_new')) > 0) {
+            if (strlen($this->request->post('password_new')) < 6) {
+                return new JsonContent([
+                    'error' => [
+                        'errorText' => 'The given new password is too short. Please choose a password that is at least 6 characters long!'
+                    ]
+                ]);
+            }
+
+            if ($this->request->post('password_new') !== $this->request->post('password_new_confirm')) {
+                return new JsonContent([
+                    'error' => [
+                        'errorText' => 'The given new passwords do not match.'
+                    ]
+                ]);
+            }
+
+            $user->setPlainPassword($this->request->post('password_new'));
+        }
+
+        $this->pdm->saveToDb($user);
+
+        $this->request->session()->delete('authenticated_with_google_until');
+
+        return new JsonContent(['success' => true]);
+    }
+
+    private function confirmUserIdentity(User $user, ?DateTime $authenticatedWithGoogleUntil, ?string $password, ?string &$error): bool
+    {
+        if ($authenticatedWithGoogleUntil !== null && $authenticatedWithGoogleUntil > new DateTime()) {
+            return true;
+        }
+
+        if ($password !== null) {
+            if ($user->checkPassword($password)) {
+                return true;
+            }
+
+            $error = 'The given current password is wrong.';
+            return false;
+        }
+
+        $error = 'Could not confirm your identity. Please try again!';
+        return false;
+    }
+}

src/PersistentData/Model/User.php

@@ -0,0 +1,122 @@
+<?php namespace RVR\PersistentData\Model;
+
+use DateTime;
+use SokoWeb\PersistentData\Model\Model;
+use SokoWeb\Interfaces\Authentication\IUser;
+
+class User extends Model implements IUser
+{
+    protected static string $table = 'users';
+
+    protected static array $fields = ['email', 'password', 'type', 'google_sub', 'created'];
+
+    private static array $types = ['user', 'admin'];
+
+    private string $email = '';
+
+    private ?string $password = null;
+
+    private string $type = 'user';
+
+    private ?string $googleSub = null;
+
+    private DateTime $created;
+
+    public function setEmail(string $email): void
+    {
+        $this->email = $email;
+    }
+
+    public function setPassword(?string $hashedPassword): void
+    {
+        $this->password = $hashedPassword;
+    }
+
+    public function setPlainPassword(string $plainPassword): void
+    {
+        $this->password = password_hash($plainPassword, PASSWORD_BCRYPT);
+    }
+
+    public function setType(string $type): void
+    {
+        if (in_array($type, self::$types)) {
+            $this->type = $type;
+        }
+    }
+
+    public function setGoogleSub(?string $googleSub): void
+    {
+        $this->googleSub = $googleSub;
+    }
+
+    public function setCreatedDate(DateTime $created): void
+    {
+        $this->created = $created;
+    }
+
+    public function setCreated(string $created): void
+    {
+        $this->created = new DateTime($created);
+    }
+
+    public function getEmail(): string
+    {
+        return $this->email;
+    }
+
+    public function getPassword(): ?string
+    {
+        return $this->password;
+    }
+
+    public function getType(): string
+    {
+        return $this->type;
+    }
+
+    public function getGoogleSub(): ?string
+    {
+        return $this->googleSub;
+    }
+
+    public function getCreatedDate(): DateTime
+    {
+        return $this->created;
+    }
+
+    public function getCreated(): string
+    {
+        return $this->created->format('Y-m-d H:i:s');
+    }
+
+    public function hasPermission(int $permission): bool
+    {
+        switch ($permission) {
+            case IUser::PERMISSION_NORMAL:
+                return true;
+            case IUser::PERMISSION_ADMIN:
+                return $this->type === 'admin';
+            default:
+                throw new \Exception('Permission does not exist: ' . $permission);
+        }
+    }
+
+    public function getUniqueId()
+    {
+        return $this->id;
+    }
+
+    public function getDisplayName(): string
+    {
+        return $this->email;
+    }
+
+    public function checkPassword(string $password): bool
+    {
+        if ($this->password === null) {
+            return false;
+        }
+
+        return password_verify($password, $this->password);
+    }
+}

src/PersistentData/Model/UserPasswordResetter.php

@@ -0,0 +1,71 @@
+<?php namespace RVR\PersistentData\Model;
+
+use DateTime;
+use SokoWeb\PersistentData\Model\Model;
+
+class UserPasswordResetter extends Model
+{
+    protected static string $table = 'user_password_resetters';
+
+    protected static array $fields = ['user_id', 'token', 'expires'];
+
+    protected static array $relations = ['user' => User::class];
+
+    private ?User $user = null;
+
+    private ?int $userId = null;
+
+    private string $token = '';
+
+    private DateTime $expires;
+
+    public function setUser(User $user): void
+    {
+        $this->user = $user;
+    }
+
+    public function setUserId(int $userId): void
+    {
+        $this->userId = $userId;
+    }
+
+    public function setToken(string $token): void
+    {
+        $this->token = $token;
+    }
+
+    public function setExpiresDate(DateTime $expires): void
+    {
+        $this->expires = $expires;
+    }
+
+    public function setExpires(string $expires): void
+    {
+        $this->expires = new DateTime($expires);
+    }
+
+    public function getUser(): ?User
+    {
+        return $this->user;
+    }
+
+    public function getUserId(): ?int
+    {
+        return $this->userId;
+    }
+
+    public function getToken(): string
+    {
+        return $this->token;
+    }
+
+    public function getExpiresDate(): DateTime
+    {
+        return $this->expires;
+    }
+
+    public function getExpires(): string
+    {
+        return $this->expires->format('Y-m-d H:i:s');
+    }
+}

src/Repository/UserPasswordResetterRepository.php

@@ -0,0 +1,47 @@
+<?php namespace RVR\Repository;
+
+use DateTime;
+use Generator;
+use SokoWeb\Database\Query\Select;
+use RVR\PersistentData\Model\User;
+use RVR\PersistentData\Model\UserPasswordResetter;
+use SokoWeb\PersistentData\PersistentDataManager;
+
+class UserPasswordResetterRepository
+{
+    private PersistentDataManager $pdm;
+
+    public function __construct()
+    {
+        $this->pdm = new PersistentDataManager();
+    }
+
+    public function getById(int $userConfirmationId): ?UserPasswordResetter
+    {
+        return $this->pdm->selectFromDbById($userConfirmationId, UserPasswordResetter::class);
+    }
+
+    public function getByToken(string $token): ?UserPasswordResetter
+    {
+        $select = new Select(\Container::$dbConnection);
+        $select->where('token', '=', $token);
+
+        return $this->pdm->selectFromDb($select, UserPasswordResetter::class);
+    }
+
+    public function getByUser(User $user): ?UserPasswordResetter
+    {
+        $select = new Select(\Container::$dbConnection);
+        $select->where('user_id', '=', $user->getId());
+
+        return $this->pdm->selectFromDb($select, UserPasswordResetter::class);
+    }
+
+    public function getAllExpired(): Generator
+    {
+        $select = new Select(\Container::$dbConnection);
+        $select->where('expires', '<', (new DateTime())->format('Y-m-d H:i:s'));
+
+        yield from $this->pdm->selectMultipleFromDb($select, UserPasswordResetter::class);
+    }
+}

src/Repository/UserRepository.php

@@ -0,0 +1,37 @@
+<?php namespace RVR\Repository;
+
+use SokoWeb\Interfaces\Repository\IUserRepository;
+use SokoWeb\Database\Query\Select;
+use RVR\PersistentData\Model\User;
+use SokoWeb\PersistentData\PersistentDataManager;
+
+class UserRepository implements IUserRepository
+{
+    private PersistentDataManager $pdm;
+
+    public function __construct()
+    {
+        $this->pdm = new PersistentDataManager();
+    }
+
+    public function getById(int $userId): ?User
+    {
+        return $this->pdm->selectFromDbById($userId, User::class);
+    }
+
+    public function getByEmail(string $email): ?User
+    {
+        $select = new Select(\Container::$dbConnection);
+        $select->where('email', '=', $email);
+
+        return $this->pdm->selectFromDb($select, User::class);
+    }
+
+    public function getByGoogleSub(string $sub): ?User
+    {
+        $select = new Select(\Container::$dbConnection);
+        $select->where('google_sub', '=', $sub);
+
+        return $this->pdm->selectFromDb($select, User::class);
+    }
+}