167 lines
4.4 KiB
PHP
167 lines
4.4 KiB
PHP
<?php
|
|
|
|
namespace manager;
|
|
|
|
use \manager\Repo;
|
|
|
|
|
|
|
|
|
|
class Authentification{
|
|
|
|
// Constantes
|
|
public static $config_path = 'f/json/modules/auth';
|
|
|
|
// Contiendra les erreurs
|
|
public $error;
|
|
|
|
|
|
|
|
|
|
/* INITIALISATION DU SYSTEME ET MISE A JOUR CONSTANTES D'AUTHENTIFICATION
|
|
*
|
|
*
|
|
*/
|
|
public static function check(){
|
|
/* (1) Initialisation
|
|
---------------------------------------------------------*/
|
|
if( !isset($_SESSION['AUTH']) ) $_SESSION['AUTH'] = [];
|
|
if( !isset($_SESSION['PERM']) ) $_SESSION['PERM'] = [];
|
|
|
|
|
|
/* (2) Gestion de AUTH (authentification)
|
|
---------------------------------------------------------*/
|
|
/* (1) Si Auth dans HEADER, on le récupère */
|
|
$AUTH = isset($_SERVER['PHP_AUTH_DIGEST']) ? $_SERVER['PHP_AUTH_DIGEST'] : '';
|
|
|
|
/* (2) Si Auth dans SESSION, on le récupère */
|
|
if( $AUTH == '' && isset($_SESSION['AUTH']) )
|
|
$AUTH = implode('', $_SESSION['AUTH']);
|
|
|
|
|
|
/* (3) Gestion de AUTH en fonction des tokens
|
|
---------------------------------------------------------*/
|
|
/* (1) Double authentification */
|
|
if( preg_match('/^([a-f0-9]{40})([a-f0-9]{40})$/', $AUTH, $match) )
|
|
$_SESSION['AUTH'] = [ $match[1], $match[2] ];
|
|
|
|
/* (2) Authentification unique */
|
|
else if( preg_match('/^[a-f0-9]{40}$/', $AUTH, $match) )
|
|
$_SESSION['AUTH'] = [ $match[0] ];
|
|
|
|
/* (3) Aucune authentification */
|
|
else
|
|
$_SESSION['AUTH'] = [];
|
|
|
|
|
|
/* (4) On vérifie l'authentification par BDD
|
|
---------------------------------------------------------*/
|
|
if( !self::deepCheck() )
|
|
$_SESSION['AUTH'] = [];
|
|
}
|
|
|
|
|
|
|
|
|
|
/* VERIFICATION DE L'AUTHENTIFICATION
|
|
*
|
|
*
|
|
*/
|
|
public static function deepCheck(){
|
|
/* [1] Si aucune authentification
|
|
=========================================================*/
|
|
if( self::auth() == 0 )
|
|
return false;
|
|
|
|
/* [2] Si authentification unique
|
|
=========================================================*/
|
|
if( self::auth() >= 1 ){
|
|
$checkRoot = new Repo('warehouse/getByToken', [ $_SESSION['AUTH'][0] ]);
|
|
|
|
// Si le token n'existe pas
|
|
if( count($checkRoot->answer()) < 1 )
|
|
return false;
|
|
}
|
|
|
|
/* [3] Si authentification double
|
|
=========================================================*/
|
|
if( self::auth() >= 2 ){
|
|
$checkBranch = new Repo('admin/getByToken', [ $_SESSION['AUTH'][1] ]);
|
|
|
|
// Si le token n'existe pas
|
|
if( count($checkBranch->answer()) < 1 )
|
|
return false;
|
|
}
|
|
|
|
/* [4] Si pas d'erreur d'authentification, on retourne TRUE
|
|
=========================================================*/
|
|
return true;
|
|
}
|
|
|
|
|
|
|
|
|
|
/* VERIFICATION DES ACCES EN FONCTION DE PERMISSIONS ATTENDUES
|
|
*
|
|
* @expected<array> Liste des permissions attendues
|
|
*
|
|
* @return status<Boolean> Si FALSE, pas la permission, sinon si
|
|
*
|
|
*/
|
|
public static function permission($expected){
|
|
/* [0] Mise à jour de l'authentification
|
|
=========================================================*/
|
|
self::check();
|
|
|
|
|
|
/* [1] Gestion de l'AUTH (authentification)
|
|
=========================================================*/
|
|
|
|
/* (1) Si entrepot requis, mais manquant
|
|
---------------------------------------------------------*/
|
|
if( in_array('warehouse', $expected) && self::auth() < 1 )
|
|
return false;
|
|
|
|
/* (2) Si admin requis, mais manquant
|
|
---------------------------------------------------------*/
|
|
if( in_array('admin', $expected) && self::auth() < 2 )
|
|
return false;
|
|
|
|
/* (3) On retire 'warehouse' et 'admin' de @expected
|
|
---------------------------------------------------------*/
|
|
$warehouseIndex = array_search('warehouse', $expected);
|
|
$adminIndex = array_search('admin', $expected);
|
|
if( is_int($warehouseIndex) ) unset($expected[$warehouseIndex]);
|
|
if( is_int($adminIndex) ) unset($expected[$adminIndex]);
|
|
|
|
|
|
/* [2] Gestion des permissions
|
|
=========================================================*/
|
|
foreach($expected as $permission)
|
|
// Si il manque au minimum une permission, on retourne FALSE
|
|
if( !in_array($permission, $_SESSION['PERM']) )
|
|
return false;
|
|
|
|
|
|
/* [3] Si on a toutes les permissions requises
|
|
=========================================================*/
|
|
return true;
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/* RENVOIE LE NIVEAU D'AUTHENTIFICATION
|
|
*
|
|
* @return auth<int> Niveau d'authentification (0 à 2)
|
|
*
|
|
*/
|
|
public static function auth(){
|
|
return !is_array($_SESSION['AUTH']) ? 0 : count($_SESSION['AUTH']);
|
|
}
|
|
|
|
}
|
|
|
|
?>
|