aneurinandClaude Sonnet 5
7da881bb78
APP_ALLOW_REGISTRATION (default true) gates the only "sign up" this app has -- the account-creation side effect of POST /api/auth/magic-link. When false, an unknown address is silently ignored (find-only, no findOrCreateByEmail) while an existing address still gets its sign-in link as normal; the response is identical either way (202, same message), so there's still no enumeration signal. - Config::allowRegistration, read from APP_ALLOW_REGISTRATION. - AuthController::requestLoginLink takes the flag; only looks up (doesn't create) when it's off. - docker-compose.yml / .env.example / README document the new var. - ApiTestCase::reconfigure() rebuilds the app against changed env (same database) for tests that need a non-default Config; two new AuthTest cases cover both halves (blocks a new address, doesn't block an existing one). 59 tests pass. Verified against the rebuilt container: with the flag on (default), a new address gets a link and an account; switched off via the same env var, a brand-new address gets the same 202 but no email and no user row, while an address that already had an account still receives its link. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
89 lines
3.1 KiB
PHP
89 lines
3.1 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Controllers;
|
|
|
|
use App\Auth\SessionPayload;
|
|
use App\Exception\ValidationException;
|
|
use App\Mail\EmailVerifier;
|
|
use App\Mail\MailException;
|
|
use App\Repository\UserRepository;
|
|
use Psr\Http\Message\ResponseInterface as Response;
|
|
use Psr\Http\Message\ServerRequestInterface as Request;
|
|
|
|
/**
|
|
* Passwordless auth: there is no register/login pair. An email address is
|
|
* turned into an account (if it isn't one already) and sent a magic link;
|
|
* opening that link is what actually signs the caller in.
|
|
*/
|
|
final class AuthController extends Controller
|
|
{
|
|
private const EMAIL_MAX = 255;
|
|
|
|
public function __construct(
|
|
private readonly UserRepository $users,
|
|
private readonly SessionPayload $session,
|
|
private readonly EmailVerifier $verifier,
|
|
private readonly bool $allowRegistration,
|
|
) {
|
|
}
|
|
|
|
/**
|
|
* POST /api/auth/magic-link (public)
|
|
*
|
|
* Emails a one-time sign-in link for the given address, creating the
|
|
* account first if it doesn't exist yet -- unless registration is turned
|
|
* off (APP_ALLOW_REGISTRATION=false), in which case an unknown address is
|
|
* silently ignored and only existing users can still sign in. Always
|
|
* responds the same way either way, so registered addresses can't be
|
|
* enumerated. A link is only actually (re-)sent when one hasn't gone out
|
|
* in the last minute. Opening the link creates the session and, the first
|
|
* time, marks the address verified.
|
|
*/
|
|
public function requestLoginLink(Request $request, Response $response): Response
|
|
{
|
|
$body = (array) ($request->getParsedBody() ?? []);
|
|
$email = is_string($body['email'] ?? null) ? mb_strtolower(trim($body['email'])) : '';
|
|
|
|
if ($email === '' || !filter_var($email, FILTER_VALIDATE_EMAIL) || strlen($email) > self::EMAIL_MAX) {
|
|
throw new ValidationException(['email' => ['Enter a valid email address.']]);
|
|
}
|
|
|
|
$user = $this->allowRegistration
|
|
? $this->users->findOrCreateByEmail($email)
|
|
: $this->users->findByEmail($email);
|
|
|
|
if ($user !== null && !$this->recentlyEmailed($user)) {
|
|
try {
|
|
$this->verifier->sendLoginLink($user);
|
|
} catch (MailException $e) {
|
|
error_log('Login link failed for user ' . $user['id'] . ': ' . $e->getMessage());
|
|
}
|
|
}
|
|
|
|
return $this->json($response, [
|
|
'message' => 'Check your email for a link to sign in.',
|
|
], 202);
|
|
}
|
|
|
|
/**
|
|
* GET /api/me (requires AuthMiddleware)
|
|
*/
|
|
public function me(Request $request, Response $response): Response
|
|
{
|
|
return $this->json($response, ['user' => $this->session->present($this->user($request))]);
|
|
}
|
|
|
|
/**
|
|
* @param array{verification_email_sent_at?: string|null} $user
|
|
*/
|
|
private function recentlyEmailed(array $user): bool
|
|
{
|
|
$lastSent = $user['verification_email_sent_at'] ?? null;
|
|
|
|
return $lastSent !== null
|
|
&& (time() - (int) strtotime($lastSent)) < EmailVerifier::RESEND_INTERVAL_SECONDS;
|
|
}
|
|
}
|