aneurinandClaude Sonnet 5
8732e0e5f5
Build / build-and-push (push) Successful in 14s
An optional comma-separated list of glob patterns restricting which addresses may register, applied on top of APP_ALLOW_REGISTRATION. A non-matching new address is silently ignored exactly like registration being off; an address that already has an account can still sign in. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
93 lines
3.3 KiB
PHP
93 lines
3.3 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Controllers;
|
|
|
|
use App\Auth\SessionPayload;
|
|
use App\Exception\ValidationException;
|
|
use App\Mail\EmailVerifier;
|
|
use App\Mail\MailException;
|
|
use App\Repository\UserRepository;
|
|
use App\Support\EmailAllowlist;
|
|
use Psr\Http\Message\ResponseInterface as Response;
|
|
use Psr\Http\Message\ServerRequestInterface as Request;
|
|
|
|
/**
|
|
* Passwordless auth: there is no register/login pair. An email address is
|
|
* turned into an account (if it isn't one already) and sent a magic link;
|
|
* opening that link is what actually signs the caller in.
|
|
*/
|
|
final class AuthController extends Controller
|
|
{
|
|
private const EMAIL_MAX = 255;
|
|
|
|
public function __construct(
|
|
private readonly UserRepository $users,
|
|
private readonly SessionPayload $session,
|
|
private readonly EmailVerifier $verifier,
|
|
private readonly bool $allowRegistration,
|
|
private readonly EmailAllowlist $emailAllowlist,
|
|
) {
|
|
}
|
|
|
|
/**
|
|
* POST /api/auth/magic-link (public)
|
|
*
|
|
* Emails a one-time sign-in link for the given address, creating the
|
|
* account first if it doesn't exist yet -- unless registration is turned
|
|
* off (APP_ALLOW_REGISTRATION=false) or the address falls outside the
|
|
* email allowlist (APP_EMAIL_ALLOWLIST), in which case an unknown address
|
|
* is silently ignored and only existing users can still sign in. Always
|
|
* responds the same way either way, so registered addresses can't be
|
|
* enumerated. A link is only actually (re-)sent when one hasn't gone out
|
|
* in the last minute. Opening the link creates the session and, the first
|
|
* time, marks the address verified.
|
|
*/
|
|
public function requestLoginLink(Request $request, Response $response): Response
|
|
{
|
|
$body = (array) ($request->getParsedBody() ?? []);
|
|
$email = is_string($body['email'] ?? null) ? mb_strtolower(trim($body['email'])) : '';
|
|
|
|
if ($email === '' || !filter_var($email, FILTER_VALIDATE_EMAIL) || strlen($email) > self::EMAIL_MAX) {
|
|
throw new ValidationException(['email' => ['Enter a valid email address.']]);
|
|
}
|
|
|
|
$user = $this->users->findByEmail($email);
|
|
if ($user === null && $this->allowRegistration && $this->emailAllowlist->permits($email)) {
|
|
$user = $this->users->findOrCreateByEmail($email);
|
|
}
|
|
|
|
if ($user !== null && !$this->recentlyEmailed($user)) {
|
|
try {
|
|
$this->verifier->sendLoginLink($user);
|
|
} catch (MailException $e) {
|
|
error_log('Login link failed for user ' . $user['id'] . ': ' . $e->getMessage());
|
|
}
|
|
}
|
|
|
|
return $this->json($response, [
|
|
'message' => 'Check your email for a link to sign in.',
|
|
], 202);
|
|
}
|
|
|
|
/**
|
|
* GET /api/me (requires AuthMiddleware)
|
|
*/
|
|
public function me(Request $request, Response $response): Response
|
|
{
|
|
return $this->json($response, ['user' => $this->session->present($this->user($request))]);
|
|
}
|
|
|
|
/**
|
|
* @param array{verification_email_sent_at?: string|null} $user
|
|
*/
|
|
private function recentlyEmailed(array $user): bool
|
|
{
|
|
$lastSent = $user['verification_email_sent_at'] ?? null;
|
|
|
|
return $lastSent !== null
|
|
&& (time() - (int) strtotime($lastSent)) < $this->verifier->resendIntervalSeconds;
|
|
}
|
|
}
|