Merge pull request 'feature/start-using-authentication-required-interface' (!22) from feature/start-using-authentication-required-interface into master

Reviewed-on: #22

composer.json

@@ -10,7 +10,7 @@
     }
   ],
   "require": {
-    "esoko/soko-web": "0.1",
+    "esoko/soko-web": "0.3",
     "firebase/php-jwt": "^6.4"
   },
   "require-dev": {

composer.lock

@@ -4,15 +4,15 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "f2dcf297a4a619bc5edfe7b4fac0836e",
+    "content-hash": "64c21f0e5181bd39d8977af72e2aeddc",
     "packages": [
         {
             "name": "esoko/soko-web",
-            "version": "v0.1",
+            "version": "v0.3",
             "source": {
                 "type": "git",
                 "url": "https://git.esoko.eu/esoko/soko-web.git",
-                "reference": "a17a88e9d44e42cef3d996fc66b4dd1134b85def"
+                "reference": "014a5480967c03c00dda5ee34c7eaf4be224b96e"
             },
             "require": {
                 "phpmailer/phpmailer": "^6.8",
@@ -33,7 +33,7 @@
                 "GNU GPL 3.0"
             ],
             "description": "Lightweight web framework",
-            "time": "2023-04-07T17:32:15+00:00"
+            "time": "2023-04-16T14:54:22+00:00"
         },
         {
             "name": "firebase/php-jwt",

public/index.php

@@ -1,7 +1,12 @@
 <?php
 
 use SokoWeb\Interfaces\Response\IRedirect;
+use SokoWeb\Interfaces\Response\IContent;
+use SokoWeb\Interfaces\Authentication\IAuthenticationRequired;
+use SokoWeb\Interfaces\Authorization\ISecured;
 use SokoWeb\Response\Redirect;
+use SokoWeb\Response\HtmlContent;
+use SokoWeb\Response\JsonContent;
 
 require '../web.php';
 
@@ -22,13 +27,11 @@ if ($match !== null) {
     $handler = $route->getHandler();
     $controller = new $handler[0](Container::$request);
 
-    if ($controller instanceof SokoWeb\Interfaces\Authorization\ISecured) {
+    if (
-        $authorized = $controller->authorize();
+        $controller instanceof IAuthenticationRequired &&
-    } else {
+        $controller->isAuthenticationRequired() &&
-        $authorized = true;
+        Container::$request->user() === null
-    }
+    ) {
-
-    if (!$authorized) {
         Container::$request->session()->set('redirect_after_login', substr($_SERVER['REQUEST_URI'], strlen('/')));
         $response = new Redirect(Container::$routeCollection->getRoute('login')->generateLink(), IRedirect::TEMPORARY);
         header('Location: ' . $response->getUrl(), true, $response->getHttpCode());
@@ -36,23 +39,28 @@ if ($match !== null) {
     }
 
     if ($method === 'post' && !in_array($url, $antiCsrfTokenExceptions) && Container::$request->post('anti_csrf_token') !== Container::$request->session()->get('anti_csrf_token')) {
-        $content = new SokoWeb\Response\JsonContent(['error' => 'no_valid_anti_csrf_token']);
+        $content = new JsonContent(['error' => 'no_valid_anti_csrf_token']);
         header('Content-Type: text/html; charset=UTF-8', true, 403);
         $content->render();
         return;
     }
 
+    if (
+        !($controller instanceof ISecured) ||
+        $controller->authorize()
+    ) {
         $response = call_user_func([$controller, $handler[1]]);
-    if ($response instanceof SokoWeb\Interfaces\Response\IContent) {
+        if ($response instanceof IContent) {
             header('Content-Type: ' . $response->getContentType() . '; charset=UTF-8');
             $response->render();
             return;
-    } elseif ($response instanceof SokoWeb\Interfaces\Response\IRedirect) {
+        } elseif ($response instanceof IRedirect) {
             header('Location: ' . $response->getUrl(), true, $response->getHttpCode());
             return;
         }
     }
+}
 
-$content = new SokoWeb\Response\HtmlContent('error/404');
+$content = new HtmlContent('error/404');
 header('Content-Type: text/html; charset=UTF-8', true, 404);
 $content->render();

public/static/js/account/account.js

@@ -3,7 +3,7 @@ var Account = {
     countdown: null,
 
     openGoogleAuthenticate: function () {
-        window.open('/account/googleAuthenticate', 'googleAuthenticate', 'height=600,width=600')
+        window.open(googleAuthenticateUrl, 'googleAuthenticate', 'height=600,width=600')
     },
 
     authenticatedWithGoogleCallback: function (authenticatedWithGoogleUntil) {

src/Controller/CommunityController.php

@@ -7,14 +7,14 @@ use RVR\PersistentData\Model\User;
 use RVR\Repository\CommunityRepository;
 use RVR\Repository\CommunityMemberRepository;
 use RVR\Repository\UserRepository;
-use SokoWeb\Interfaces\Authorization\ISecured;
+use SokoWeb\Interfaces\Authentication\IAuthenticationRequired;
 use SokoWeb\Interfaces\Request\IRequest;
 use SokoWeb\Interfaces\Response\IContent;
 use SokoWeb\PersistentData\PersistentDataManager;
 use SokoWeb\Response\HtmlContent;
 use SokoWeb\Response\JsonContent;
 
-class CommunityController implements ISecured
+class CommunityController implements IAuthenticationRequired
 {
     private IRequest $request;
 
@@ -35,9 +35,9 @@ class CommunityController implements ISecured
         $this->communityMemberRepository = new CommunityMemberRepository();
     }
 
-    public function authorize(): bool
+    public function isAuthenticationRequired(): bool
     {
-        return $this->request->user() !== null;
+        return true;
     }
 
     public function getCommunityHome(): ?IContent

src/Controller/HomeController.php

@@ -2,12 +2,12 @@
 
 use RVR\PersistentData\Model\User;
 use RVR\Repository\CommunityMemberRepository;
-use SokoWeb\Interfaces\Authorization\ISecured;
+use SokoWeb\Interfaces\Authentication\IAuthenticationRequired;
 use SokoWeb\Interfaces\Request\IRequest;
 use SokoWeb\Interfaces\Response\IContent;
 use SokoWeb\Response\HtmlContent;
 
-class HomeController implements ISecured
+class HomeController implements IAuthenticationRequired
 {
     private IRequest $request;
 
@@ -19,9 +19,9 @@ class HomeController implements ISecured
         $this->communityMemberRepository = new CommunityMemberRepository();
     }
 
-    public function authorize(): bool
+    public function isAuthenticationRequired(): bool
     {
-        return $this->request->user() !== null;
+        return true;
     }
 
     public function getHome(): IContent

src/Controller/LoginController.php

@@ -37,7 +37,7 @@ class LoginController
         $this->userPasswordResetterRepository = new UserPasswordResetterRepository();
         $this->redirectUrl = $this->request->session()->has('redirect_after_login') ?
             $this->request->session()->get('redirect_after_login') :
-            \Container::$routeCollection->getRoute('index')->generateLink();
+            \Container::$routeCollection->getRoute('home')->generateLink();
     }
 
     public function getLoginForm()
@@ -113,8 +113,8 @@ class LoginController
         if ($user === null || !$user->checkPassword($this->request->post('password'))) {
             return new JsonContent([
                 'error' => [
-                    'errorText' => 'No user found with the given email address / username or the given password is wrong. You can <a href="/password/requestReset?email=' .
+                    'errorText' => 'No user found with the given email address / username or the given password is wrong. You can <a href="' .
-                        urlencode($this->request->post('email')) . '" title="Request password reset">request password reset</a>!'
+                        \Container::$routeCollection->getRoute('password-requestReset')->generateLink(['email' => $this->request->post('email')]) . '" title="Request password reset">request password reset</a>!'
                 ]
             ]);
         }
@@ -127,7 +127,7 @@ class LoginController
 
     public function loginWithGoogle()
     {
-        $defaultError = 'Authentication with Google failed. Please <a href="/login/google" title="Login with Google">try again</a>!';
+        $defaultError = 'Authentication with Google failed. Please <a href="' . \Container::$routeCollection->getRoute('login-google')->generateLink() . '" title="Login with Google">try again</a>!';
 
         if ($this->request->user() !== null) {
             $this->deleteRedirectUrl();
@@ -174,7 +174,7 @@ class LoginController
     {
         $this->request->setUser(null);
 
-        return new Redirect(\Container::$routeCollection->getRoute('index')->generateLink(), IRedirect::TEMPORARY);
+        return new Redirect(\Container::$routeCollection->getRoute('home')->generateLink(), IRedirect::TEMPORARY);
     }
 
     public function requestPasswordReset(): IContent

src/Controller/OAuthAuthController.php

@@ -4,14 +4,14 @@ use DateTime;
 use RVR\PersistentData\Model\OAuthToken;
 use RVR\PersistentData\Model\User;
 use RVR\Repository\OAuthClientRepository;
-use SokoWeb\Interfaces\Authorization\ISecured;
+use SokoWeb\Interfaces\Authentication\IAuthenticationRequired;
 use SokoWeb\Interfaces\Request\IRequest;
 use SokoWeb\Interfaces\Response\IRedirect;
 use SokoWeb\Response\Redirect;
 use SokoWeb\PersistentData\PersistentDataManager;
 use SokoWeb\Response\HtmlContent;
 
-class OAuthAuthController implements ISecured
+class OAuthAuthController implements IAuthenticationRequired
 {
     private IRequest $request;
 
@@ -26,9 +26,9 @@ class OAuthAuthController implements ISecured
         $this->oAuthClientRepository = new OAuthClientRepository();
     }
 
-    public function authorize(): bool
+    public function isAuthenticationRequired(): bool
     {
-        return $this->request->user() !== null;
+        return true;
     }
 
     public function auth()

src/Controller/OAuthController.php

@@ -80,16 +80,14 @@ class OAuthController
 
     public function getUserInfo() : IContent
     {
-        //TODO: headers should be set by soko-web
+        $authorization = $this->request->header('Authorization');
-        $headers = getallheaders();
+        if ($authorization === null) {
-
-        if (!isset($headers['Authorization'])) {
             return new JsonContent([
                 'error' => 'No Authorization header was sent.'
             ]);
         }
 
-        $accessToken = substr($headers['Authorization'], strlen('Bearer '));
+        $accessToken = substr($authorization, strlen('Bearer '));
         $token = $this->oAuthTokenRepository->getByAccessToken($accessToken);
 
         if ($token === null || $token->getExpiresDate() < new DateTime()) {
@@ -110,10 +108,10 @@ class OAuthController
     {
         return new JsonContent([
             'issuer' => $_ENV['APP_URL'],
-            'authorization_endpoint' => $this->request->getBase() . '/oauth/auth',
+            'authorization_endpoint' => $this->request->getBase() . '/' . \Container::$routeCollection->getRoute('oauth-auth')->generateLink(),
-            'token_endpoint' => $this->request->getBase() . '/oauth/token',
+            'token_endpoint' => $this->request->getBase() . '/' . \Container::$routeCollection->getRoute('oauth-token')->generateLink(),
-            'userinfo_endpoint' => $this->request->getBase() . '/oauth/userinfo',
+            'userinfo_endpoint' => $this->request->getBase() . '/' . \Container::$routeCollection->getRoute('oauth-userinfo')->generateLink(),
-            'jwks_uri' => $this->request->getBase() . '/oauth/certs',
+            'jwks_uri' => $this->request->getBase() . '/' . \Container::$routeCollection->getRoute('oauth-certs')->generateLink(),
             'response_types_supported' =>
             [
                 'code',

src/Controller/UserController.php

@@ -2,7 +2,7 @@
 
 use DateTime;
 use SokoWeb\Http\Request;
-use SokoWeb\Interfaces\Authorization\ISecured;
+use SokoWeb\Interfaces\Authentication\IAuthenticationRequired;
 use SokoWeb\Interfaces\Request\IRequest;
 use SokoWeb\Interfaces\Response\IContent;
 use SokoWeb\Interfaces\Response\IRedirect;
@@ -15,7 +15,7 @@ use SokoWeb\Response\Redirect;
 use SokoWeb\Util\JwtParser;
 use RVR\Repository\UserRepository;
 
-class UserController implements ISecured
+class UserController implements IAuthenticationRequired
 {
     private IRequest $request;
 
@@ -30,9 +30,9 @@ class UserController implements ISecured
         $this->userRepository = new UserRepository();
     }
 
-    public function authorize(): bool
+    public function isAuthenticationRequired(): bool
     {
-        return $this->request->user() !== null;
+        return true;
     }
 
     public function getAccount(): IContent

src/Controller/UserSearchController.php

@@ -1,12 +1,12 @@
 <?php namespace RVR\Controller;
 
 use RVR\Repository\UserRepository;
-use SokoWeb\Interfaces\Authorization\ISecured;
+use SokoWeb\Interfaces\Authentication\IAuthenticationRequired;
 use SokoWeb\Interfaces\Request\IRequest;
 use SokoWeb\Interfaces\Response\IContent;
 use SokoWeb\Response\JsonContent;
 
-class UserSearchController implements ISecured
+class UserSearchController implements IAuthenticationRequired
 {
     private IRequest $request;
 
@@ -18,9 +18,9 @@ class UserSearchController implements ISecured
         $this->userRepository = new UserRepository();
     }
 
-    public function authorize(): bool
+    public function isAuthenticationRequired(): bool
     {
-        return $this->request->user() !== null;
+        return true;
     }
 
     public function searchUser(): IContent

views/account/account.php

@@ -5,7 +5,7 @@
 @section(main)
     <h2>Account</h2>
     <div class="box">
-        <form id="accountForm" action="/account" method="post" data-reload-on-success="true" data-observe-inputs="email,username,password_new,password_new_confirm,nickname,phone,id_number">
+        <form id="accountForm" action="/<?= Container::$routeCollection->getRoute('account-action')->generateLink() ?>" method="post" data-reload-on-success="true" data-observe-inputs="email,username,password_new,password_new_confirm,nickname,phone,id_number">
             <?php if ($user['password'] !== null && $user['google_sub'] !== null): ?>
                 <p class="justify small">Please confirm your identity with your password or with Google to modify your account.</p>
                 <div class="inputWithButton">
@@ -39,3 +39,9 @@
         </form>
     </div>
 @endsection
+
+@section(pageScript)
+<script>
+    var googleAuthenticateUrl = '/<?= Container::$routeCollection->getRoute('account.googleAuthenticate')->generateLink() ?>';
+</script>
+@endsection

views/login/login.php

@@ -3,17 +3,17 @@
 @section(main)
     <h2>Login</h2>
     <div class="box">
-        <form id="loginForm" action="/login" method="post" data-redirect-on-success="<?= $redirectUrl ?>">
+        <form id="loginForm" action="/<?= Container::$routeCollection->getRoute('login-action')->generateLink() ?>" method="post" data-redirect-on-success="<?= $redirectUrl ?>">
             <input type="text" class="text big fullWidth" name="email" placeholder="Email address / Username" required autofocus>
             <input type="password"  class="text big fullWidth marginTop" name="password" placeholder="Password" required minlength="6">
             <p id="loginFormError" class="formError justify marginTop"></p>
             <div class="right marginTop">
                 <button type="submit">Login</button>
             </div>
-            <p class="center marginTop"><a href="/password/requestReset" title="Request password reset">Forgot your password?</a></p>
+            <p class="center marginTop"><a href="/<?= Container::$routeCollection->getRoute('password-requestReset')->generateLink() ?>" title="Request password reset">Forgot your password?</a></p>
             <hr>
             <div class="center">
-                <a class="button yellow" href="/login/google" title="Login with Google">Login with Google</a>
+                <a class="button yellow" href="/<?= Container::$routeCollection->getRoute('login-google')->generateLink() ?>" title="Login with Google">Login with Google</a>
             </div>
         </form>
     </div>

views/login/password_reset_request.php

@@ -5,7 +5,7 @@
 @section(main)
     <h2>Request password reset</h2>
     <div class="box">
-        <form id="passwordResetForm" action="/password/requestReset" method="post" data-redirect-on-success="/password/requestReset/success">
+        <form id="passwordResetForm" action="/<?= Container::$routeCollection->getRoute('password-requestReset-action')->generateLink() ?>" method="post" data-redirect-on-success="/<?= Container::$routeCollection->getRoute('password-requestReset.success')->generateLink() ?>">
             <input type="email" class="text big fullWidth" name="email" placeholder="Email address" value="<?= isset($email) ? $email : '' ?>" required autofocus>
             <?php if (!empty($_ENV['RECAPTCHA_SITEKEY'])): ?>
                 <div class="marginTop">

views/login/reset_password.php

@@ -4,7 +4,7 @@
     <h2>Reset password</h2>
     <div class="box">
         <?php if ($success) : ?>
-            <form id="resetPasswordForm" action="/password/reset/<?= $token ?>" method="post" data-redirect-on-success="<?= $redirectUrl ?>">
+            <form id="resetPasswordForm" action="/<?= Container::$routeCollection->getRoute('password-reset.action')->generateLink(['token' => $token]) ?>"" method="post" data-redirect-on-success="<?= $redirectUrl ?>">
                 <input type="email" class="text big fullWidth" name="email" placeholder="Email address" value="<?= $email ?>" disabled>
                 <input type="password" class="text big fullWidth marginTop" name="password" placeholder="Password" required minlength="6" autofocus>
                 <input type="password" class="text big fullWidth marginTop" name="password_confirm" placeholder="Password confirmation" required minlength="6">
@@ -14,7 +14,7 @@
                 </div>
             </form>
         <?php else: ?>
-            <p class="error justify">Confirming your identity failed. Please check the link you entered, or retry <a href="/password/requestReset" title="Request password reset">requesting password reset</a>!</p>
+            <p class="error justify">Confirming your identity failed. Please check the link you entered, or retry <a href="/<?= Container::$routeCollection->getRoute('password-requestReset')->generateLink() ?>" title="Request password reset">requesting password reset</a>!</p>
         <?php endif; ?>
     </div>
 @endsection

views/templates/layout_normal.php

@@ -10,14 +10,14 @@
     </h1>
     <p>
         <?php if (Container::$request->user()) : ?>
-            <span><a href="/account" title="Account">
+            <span><a href="/<?= Container::$routeCollection->getRoute('account')->generateLink() ?>" title="Account">
                 <?php /* Copyright (c) 2019 The Bootstrap Authors. License can be found in 'USED_SOFTWARE' in section 'Bootstrap Icons'. */ ?>
                 <svg class="inline" width="1em" height="1em" viewBox="0 0 16 16" fill="currentColor" xmlns="http://www.w3.org/2000/svg">
                     <path fill-rule="evenodd" d="M3 14s-1 0-1-1 1-4 6-4 6 3 6 4-1 1-1 1H3zm5-6a3 3 0 1 0 0-6 3 3 0 0 0 0 6z"/>
                 </svg><!--
              --><?= Container::$request->user()->getDisplayName() ?><!--
             --></a></span><!--
-            --><span><a href="/logout" title="Logout">Logout</a></span>
+            --><span><a href="/<?= Container::$routeCollection->getRoute('logout')->generateLink() ?>" title="Logout">Logout</a></span>
         <?php endif; ?>
     </p>
 </header>

web.php

@@ -86,6 +86,7 @@ Container::$request = new SokoWeb\Request\Request(
     $_SERVER['REQUEST_SCHEME'] . '://' . $_SERVER['HTTP_HOST'],
     $_GET,
     $_POST,
+    getallheaders(),
     $_SESSION,
     new RVR\Repository\UserRepository()
 );