SWAMPy

✎ CARVE FLESH

EDITING: Auth.php

<?php
declare(strict_types=1);

namespace KimahApi;

final class Auth
{
    public static function login(string $email, string $password): void
    {
        $ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
        $key = hash('sha256', strtolower($email) . '|' . $ip);
        $attempts = $_SESSION['login_attempts'][$key] ?? ['count' => 0, 'at' => time()];
        if (time() - $attempts['at'] > 900) $attempts = ['count' => 0, 'at' => time()];
        if ($attempts['count'] >= 8) Response::json(['error' => 'Too many login attempts'], 429);

$stmt = Database::connection()->prepare('SELECT * FROM admin_users WHERE email = ? AND is_active = 1 LIMIT 1');
        $stmt->execute([strtolower(trim($email))]);
        $user = $stmt->fetch();
        if (!$user || !password_verify($password, $user['password_hash'])) {
            $_SESSION['login_attempts'][$key] = ['count' => $attempts['count'] + 1, 'at' => $attempts['at']];
            Response::json(['error' => 'Invalid email or password'], 401);
        }

unset($_SESSION['login_attempts'][$key]);
        session_regenerate_id(true);
        $_SESSION['admin_user'] = ['id' => (int) $user['id'], 'email' => $user['email'], 'role' => $user['role']];
        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
        Database::connection()->prepare('UPDATE admin_users SET last_login_at = NOW() WHERE id = ?')->execute([$user['id']]);
    }

public static function user(): ?array
    {
        return $_SESSION['admin_user'] ?? null;
    }

public static function requireAdmin(?string $role = null): array
    {
        $user = self::user();
        if (!$user) Response::json(['error' => 'Authentication required'], 401);
        if ($role === 'owner' && $user['role'] !== 'owner') Response::json(['error' => 'Owner role required'], 403);
        self::csrf();
        return $user;
    }

public static function csrf(): void
    {
        if (in_array($_SERVER['REQUEST_METHOD'] ?? 'GET', ['GET', 'HEAD', 'OPTIONS'], true)) return;
        $token = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
        if (!$token || !hash_equals($_SESSION['csrf_token'] ?? '', $token)) {
            Response::json(['error' => 'Invalid CSRF token'], 403);
        }
    }

public static function logout(): void
    {
        $_SESSION = [];
        if (ini_get('session.use_cookies')) {
            $params = session_get_cookie_params();
            setcookie(session_name(), '', time() - 42000, $params['path'], '', (bool) $params['secure'], (bool) $params['httponly']);
        }
        session_destroy();
    }
}

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📄 Auth.php	PHP	2.5 KB	2026-08-31 14:56	EDIT
📄 bootstrap.php	PHP	2.1 KB	2026-09-01 07:58	EDIT
📄 Database.php	PHP	1 KB	2026-08-31 22:07	EDIT
📄 Response.php	PHP	474 B	2026-08-31 14:56	EDIT