project-manager/src/Http/Controllers/AuthController.php

<?php

declare(strict_types=1);

namespace App\Http\Controllers;

use App\Auth\SessionPayload;
use App\Exception\ValidationException;
use App\Mail\EmailVerifier;
use App\Mail\MailException;
use App\Repository\UserRepository;
use App\Support\EmailAllowlist;
use Psr\Http\Message\ResponseInterface as Response;
use Psr\Http\Message\ServerRequestInterface as Request;

/**
 * Passwordless auth: there is no register/login pair. An email address is
 * turned into an account (if it isn't one already) and sent a magic link;
 * opening that link is what actually signs the caller in.
 */
final class AuthController extends Controller
{
    private const EMAIL_MAX = 255;

    public function __construct(
        private readonly UserRepository $users,
        private readonly SessionPayload $session,
        private readonly EmailVerifier $verifier,
        private readonly bool $allowRegistration,
        private readonly EmailAllowlist $emailAllowlist,
    ) {
    }

    /**
     * POST /api/auth/magic-link  (public)
     *
     * Emails a one-time sign-in link for the given address, creating the
     * account first if it doesn't exist yet -- unless registration is turned
     * off (APP_ALLOW_REGISTRATION=false) or the address falls outside the
     * email allowlist (APP_EMAIL_ALLOWLIST), in which case an unknown address
     * is silently ignored and only existing users can still sign in. Always
     * responds the same way either way, so registered addresses can't be
     * enumerated. A link is only actually (re-)sent when one hasn't gone out
     * in the last minute. Opening the link creates the session and, the first
     * time, marks the address verified.
     */
    public function requestLoginLink(Request $request, Response $response): Response
    {
        $body = (array) ($request->getParsedBody() ?? []);
        $email = is_string($body['email'] ?? null) ? mb_strtolower(trim($body['email'])) : '';

        if ($email === '' || !filter_var($email, FILTER_VALIDATE_EMAIL) || strlen($email) > self::EMAIL_MAX) {
            throw new ValidationException(['email' => ['Enter a valid email address.']]);
        }

        $user = $this->users->findByEmail($email);
        if ($user === null && $this->allowRegistration && $this->emailAllowlist->permits($email)) {
            $user = $this->users->findOrCreateByEmail($email);
        }

        if ($user !== null && !$this->recentlyEmailed($user)) {
            try {
                $this->verifier->sendLoginLink($user);
            } catch (MailException $e) {
                error_log('Login link failed for user ' . $user['id'] . ': ' . $e->getMessage());
            }
        }

        return $this->json($response, [
            'message' => 'Check your email for a link to sign in.',
        ], 202);
    }

    /**
     * GET /api/me  (requires AuthMiddleware)
     */
    public function me(Request $request, Response $response): Response
    {
        return $this->json($response, ['user' => $this->session->present($this->user($request))]);
    }

    /**
     * @param array{verification_email_sent_at?: string|null} $user
     */
    private function recentlyEmailed(array $user): bool
    {
        $lastSent = $user['verification_email_sent_at'] ?? null;

        return $lastSent !== null
            && (time() - (int) strtotime($lastSent)) < $this->verifier->resendIntervalSeconds;
    }
}