274 lines
7.3 KiB
PHP
274 lines
7.3 KiB
PHP
|
<?php
|
||
|
|
|
||
|
|
namespace api\core;
|
||
|
|
|
||
|
|
use \error\core\Error;
|
||
|
|
use \error\core\Err;
|
||
|
|
use \api\core\AuthSystem;
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
class AuthSystemDefault implements AuthSystem{
|
||
|
|
|
||
|
|
public function __construct(){
|
||
|
|
self::check();
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
/* INITIALISATION DU SYSTEME ET MISE A JOUR CONSTANTES D'AUTHENTIFICATION
|
||
|
|
*
|
||
|
|
*
|
||
|
|
*/
|
||
|
|
public static function check(){
|
||
|
|
/* (1) Initialisation
|
||
|
|
---------------------------------------------------------*/
|
||
|
|
if( !isset($_SESSION['AUTH']) ) $_SESSION['AUTH'] = [];
|
||
|
|
if( !isset($_SESSION['USER']) ) $_SESSION['USER'] = [];
|
||
|
|
if( !isset($_SESSION['ADMIN']) ) $_SESSION['ADMIN'] = [];
|
||
|
|
|
||
|
|
|
||
|
|
/* (2) Gestion de AUTH (authentification)
|
||
|
|
---------------------------------------------------------*/
|
||
|
|
/* (1) Si Auth dans HEADER, on le récupère */
|
||
|
|
$AUTH = isset($_SERVER['PHP_AUTH_DIGEST']) ? $_SERVER['PHP_AUTH_DIGEST'] : '';
|
||
|
|
|
||
|
|
/* (2) Si Auth dans SESSION, on le récupère */
|
||
|
|
if( $AUTH == '' && isset($_SESSION['AUTH']) )
|
||
|
|
$AUTH = implode('', $_SESSION['AUTH']);
|
||
|
|
|
||
|
|
|
||
|
|
/* (3) Gestion de AUTH en fonction des tokens
|
||
|
|
---------------------------------------------------------*/
|
||
|
|
/* (1) Token Authentication: ADMIN */
|
||
|
|
if( preg_match('/^(u[a-f0-9]{128})$/', $AUTH, $match) )
|
||
|
|
$_SESSION['AUTH'] = [ 'token' => $match[1], 'type' => 'user' ];
|
||
|
|
|
||
|
|
/* (2) Token Authentication: USER */
|
||
|
|
elseif( preg_match('/^(a[a-f0-9]{128})$/', $AUTH, $match) )
|
||
|
|
$_SESSION['AUTH'] = [ 'token' => $match[1], 'type' => 'admin' ];
|
||
|
|
|
||
|
|
/* (2) Aucune authentification */
|
||
|
|
else{
|
||
|
|
$_SESSION['AUTH'] = [];
|
||
|
|
$_SESSION['USER'] = [];
|
||
|
|
$_SESSION['ADMIN'] = [];
|
||
|
|
}
|
||
|
|
|
||
|
|
/* (4) On vérifie l'authentification par BDD
|
||
|
|
---------------------------------------------------------*/
|
||
|
|
if( !self::deepCheck() ){
|
||
|
|
$_SESSION['AUTH'] = [];
|
||
|
|
$_SESSION['USER'] = [];
|
||
|
|
$_SESSION['ADMIN'] = [];
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
/* VERIFICATION DE L'AUTHENTIFICATION
|
||
|
|
*
|
||
|
|
*
|
||
|
|
*/
|
||
|
|
private static function deepCheck(){
|
||
|
|
|
||
|
|
/* [1] Si aucune authentification
|
||
|
|
=========================================================*/
|
||
|
|
if( self::auth_level() == 0 )
|
||
|
|
return false;
|
||
|
|
|
||
|
|
|
||
|
|
/* [2] Si authentification token -> ADMIN
|
||
|
|
=========================================================*/
|
||
|
|
if( self::auth_level() >= 1 ){
|
||
|
|
|
||
|
|
$checkRoot = new Repo('warehouse/getByToken', [ $_SESSION['AUTH'][0] ]);
|
||
|
|
|
||
|
|
/* (1) Si le token n'existe pas, on retourne une erreur */
|
||
|
|
if( $checkRoot->answer() == false )
|
||
|
|
return false;
|
||
|
|
|
||
|
|
/* (2) On met à jour les informations de l'entrepot */
|
||
|
|
$_SESSION['WAREHOUSE'] = [
|
||
|
|
'id' => (int) $checkRoot->answer()[0]['id_warehouse'],
|
||
|
|
'name' => $checkRoot->answer()[0]['name'],
|
||
|
|
'theme' => '#'.$checkRoot->answer()[0]['theme']
|
||
|
|
];
|
||
|
|
|
||
|
|
/* (3) On récupère les modules de l'entrepot */
|
||
|
|
$getModules = new Repo('warehouse/getModules', [ $_SESSION['WAREHOUSE']['id'] ]);
|
||
|
|
|
||
|
|
$_SESSION['WAREHOUSE']['modules'] = $getModules->answer();
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
/* [3] Si authentification token -> USER
|
||
|
|
=========================================================*/
|
||
|
|
if( self::auth_level() == 2 ){
|
||
|
|
|
||
|
|
$checkBranch = new Repo('admin/getByToken', [ $_SESSION['WAREHOUSE']['id'], $_SESSION['AUTH'][1] ]);
|
||
|
|
|
||
|
|
/* (1) Si le token n'existe pas, on retourne une erreur */
|
||
|
|
if( $checkBranch->answer() == false )
|
||
|
|
return false;
|
||
|
|
|
||
|
|
/* (2) On met à jour les informations de l'administrateur */
|
||
|
|
$_SESSION['ADMIN'] = [
|
||
|
|
'id' => (int) $checkBranch->answer()['id_admin'],
|
||
|
|
'username' => $checkBranch->answer()['username'],
|
||
|
|
'mail' => $checkBranch->answer()['mail']
|
||
|
|
];
|
||
|
|
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
/* [4] Si authentification triple -> WAREHOUSE + SATS_token + SATS_nexttoken
|
||
|
|
=========================================================*/
|
||
|
|
if( self::auth_level() == 3 ){
|
||
|
|
|
||
|
|
|
||
|
|
$checkBranch = new Repo('machine/checkToken', [ $_SESSION['WAREHOUSE']['id'], $_SESSION['AUTH'][1], $_SESSION['AUTH'][2] ]);
|
||
|
|
|
||
|
|
/* (1) Si le token n'est pas valide, on retourne une erreur */
|
||
|
|
if( $checkBranch->answer() === false )
|
||
|
|
return false;
|
||
|
|
|
||
|
|
/* (2) On met à jour les informations de l'administrateur */
|
||
|
|
$_SESSION['SATS'] = [
|
||
|
|
'id' => (int) $checkBranch->answer()
|
||
|
|
];
|
||
|
|
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
/* [5] Si pas d'erreur d'authentification, on retourne TRUE
|
||
|
|
=========================================================*/
|
||
|
|
return true;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
/* VERIFICATION DES ACCES EN FONCTION DE PERMISSIONS ATTENDUES
|
||
|
|
*
|
||
|
|
* @module<String> Module concerné
|
||
|
|
* @expected<array> Liste de listes de combinaisons de permissions attendues
|
||
|
|
*
|
||
|
|
* @return error<Error> Si FALSE, pas la permission, sinon si
|
||
|
|
*
|
||
|
|
*/
|
||
|
|
public static function permission($module, $expected){
|
||
|
|
|
||
|
|
$error_propag = [];
|
||
|
|
|
||
|
|
/* [1] Check format -> if not array of array(s) -> ERROR
|
||
|
|
=========================================================*/
|
||
|
|
/* (1) If not array -> ERROR */
|
||
|
|
if( !is_array($expected) )
|
||
|
|
return new Error(Err::FormatError);
|
||
|
|
|
||
|
|
/* (2) If not array of array(s) -> ERROR */
|
||
|
|
foreach($expected as $permissions)
|
||
|
|
if( !is_array($permissions) )
|
||
|
|
return new Error(Err::FormatError);
|
||
|
|
|
||
|
|
|
||
|
|
/* [2] Foreach each set of permission
|
||
|
|
=========================================================*/
|
||
|
|
foreach($expected as $permission_group){
|
||
|
|
|
||
|
|
/* If granted -> don't go further */
|
||
|
|
$error_propag[]= self::check_permission_group($module, $permission_group);
|
||
|
|
|
||
|
|
if( $error_propag[count($error_propag)-1] == Err::Success )
|
||
|
|
return new Error(Err::Success);
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
/* [3] By default return `PermissionError`
|
||
|
|
=========================================================*/
|
||
|
|
if( count($error_propag) > 0 )
|
||
|
|
return new Error($error_propag[count($error_propag)-1]);
|
||
|
|
|
||
|
|
return new Error(Err::PermissionError);
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
/* VERIFICATION DES ACCES EN FONCTION DE PERMISSIONS ATTENDUES
|
||
|
|
*
|
||
|
|
* @module<String> Module concerné
|
||
|
|
* @expected<array> Liste des permissions attendues
|
||
|
|
*
|
||
|
|
* @return error<int> Err:: error constants
|
||
|
|
*
|
||
|
|
*/
|
||
|
|
private static function check_permission_group($module, $expected){
|
||
|
|
|
||
|
|
|
||
|
|
/* [1] Gestion de l'AUTH (authentification)
|
||
|
|
=========================================================*/
|
||
|
|
|
||
|
|
/* (1) Si entrepot requis, mais manquant
|
||
|
|
---------------------------------------------------------*/
|
||
|
|
if( in_array('admin', $expected) && ( self::auth_level() < 2 || !isset($_SESSION['ADMIN']['id']) ) )
|
||
|
|
return Err::PermissionError;
|
||
|
|
|
||
|
|
/* (2) Si admin requis, mais manquant
|
||
|
|
---------------------------------------------------------*/
|
||
|
|
if( in_array('user', $expected) && ( self::auth_level() < 1 || !isset($_SESSION['USER']['id']) ) )
|
||
|
|
return Err::PermissionError;
|
||
|
|
|
||
|
|
|
||
|
|
/* [2] Gestion des permissions
|
||
|
|
=========================================================*/
|
||
|
|
|
||
|
|
/* (1) Vérification de toutes les permissions requises */
|
||
|
|
foreach($expected as $permission)
|
||
|
|
// Si il manque au minimum une permission, on retourne FALSE
|
||
|
|
if( !in_array($permission, $_SESSION['PERM']) )
|
||
|
|
return Err::PermissionError;
|
||
|
|
|
||
|
|
|
||
|
|
/* [4] Si on a toutes les permissions requises
|
||
|
|
=========================================================*/
|
||
|
|
return Err::Success;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
/* RENVOIE LE NIVEAU D'AUTHENTIFICATION
|
||
|
|
*
|
||
|
|
* @return auth<int> Niveau d'authentification (0 à 2)
|
||
|
|
*
|
||
|
|
*/
|
||
|
|
public static function auth_level(){
|
||
|
|
|
||
|
|
/* (1) Not set */
|
||
|
|
if( !is_array($_SESSION['AUTH']) || !isset($_SESSION['AUTH']['type']) )
|
||
|
|
return 0;
|
||
|
|
|
||
|
|
/* (2) Admin / User */
|
||
|
|
return ($_SESSION['AUTH']['type'] == 'admin') ? 2 : 1;
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
?>
|