140 lines
4.3 KiB
PHP
140 lines
4.3 KiB
PHP
<?php
|
|
require_once __DIR__ . '/../../config.php';
|
|
require_once __DIR__ . '/db.php';
|
|
|
|
/**
|
|
* ---------- SESSION ----------
|
|
*/
|
|
function auth_session_start(): void {
|
|
if (session_status() === PHP_SESSION_NONE) {
|
|
session_set_cookie_params([
|
|
'lifetime' => SERVICE_SESSION_TTL,
|
|
'path' => '/service/',
|
|
'secure' => !empty($_SERVER['HTTPS']),
|
|
'httponly' => true,
|
|
'samesite' => 'Strict',
|
|
]);
|
|
session_name('AEGIS_SRV');
|
|
session_start();
|
|
}
|
|
}
|
|
|
|
/**
|
|
* ---------- LOGIN ----------
|
|
*/
|
|
define('BRUTE_FORCE_WINDOW', 180);
|
|
define('BRUTE_FORCE_MAX_ATTEMPTS', 3);
|
|
|
|
function auth_brute_force_check(string $login): bool {
|
|
$pdo = getDB();
|
|
$stmt = $pdo->prepare("SELECT COUNT(*) FROM login_attempts WHERE (login = ? OR ip_address = ?) AND attempt_time > DATE_SUB(NOW(), INTERVAL ? SECOND)");
|
|
$stmt->execute([$login, $_SERVER['REMOTE_ADDR'] ?? '', BRUTE_FORCE_WINDOW]);
|
|
return $stmt->fetchColumn() >= BRUTE_FORCE_MAX_ATTEMPTS;
|
|
}
|
|
|
|
function auth_record_attempt(string $login): void {
|
|
$pdo = getDB();
|
|
$stmt = $pdo->prepare("INSERT INTO login_attempts (ip_address, login) VALUES (?, ?)");
|
|
$stmt->execute([$_SERVER['REMOTE_ADDR'] ?? '', $login]);
|
|
}
|
|
|
|
function auth_clear_attempts(string $login): void {
|
|
$pdo = getDB();
|
|
$stmt = $pdo->prepare("DELETE FROM login_attempts WHERE login = ? OR ip_address = ?");
|
|
$stmt->execute([$login, $_SERVER['REMOTE_ADDR'] ?? '']);
|
|
}
|
|
|
|
function auth_login(string $login, string $password): array {
|
|
$pdo = getDB();
|
|
|
|
if (auth_brute_force_check($login)) {
|
|
return ['success' => false, 'error' => 'Превышен лимит попыток. Подождите 3 минуты.'];
|
|
}
|
|
|
|
$stmt = $pdo->prepare("SELECT id, login, password_hash, role, full_name, is_active FROM users WHERE login = ? LIMIT 1");
|
|
$stmt->execute([$login]);
|
|
$user = $stmt->fetch();
|
|
|
|
if (!$user || !password_verify($password, $user['password_hash'])) {
|
|
auth_record_attempt($login);
|
|
return ['success' => false, 'error' => 'Неверный логин или пароль.'];
|
|
}
|
|
|
|
if (!$user['is_active']) {
|
|
return ['success' => false, 'error' => 'Учётная запись заблокирована.'];
|
|
}
|
|
|
|
auth_clear_attempts($login);
|
|
|
|
$_SESSION['user_id'] = (int)$user['id'];
|
|
$_SESSION['user_login'] = $user['login'];
|
|
$_SESSION['user_role'] = $user['role'];
|
|
$_SESSION['user_name'] = $user['full_name'];
|
|
$_SESSION['auth_time'] = time();
|
|
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
|
|
|
|
auth_log($user['id'], 'login', 'Вход в систему');
|
|
|
|
return ['success' => true];
|
|
}
|
|
|
|
/**
|
|
* ---------- LOGOUT ----------
|
|
*/
|
|
function auth_logout(): void {
|
|
if (!empty($_SESSION['user_id'])) {
|
|
auth_log($_SESSION['user_id'], 'logout', 'Выход из системы');
|
|
}
|
|
$_SESSION = [];
|
|
if (ini_get('session.use_cookies')) {
|
|
setcookie(session_name(), '', time() - 42000, '/service/');
|
|
}
|
|
session_destroy();
|
|
}
|
|
|
|
/**
|
|
* ---------- GUARD ----------
|
|
*/
|
|
function auth_require(): array {
|
|
auth_session_start();
|
|
$allowed_roles = func_get_args();
|
|
if (empty($_SESSION['user_id'])) {
|
|
header('Location: /service/index.php?redirect=' . urlencode($_SERVER['REQUEST_URI']));
|
|
exit;
|
|
}
|
|
if (!empty($allowed_roles) && !in_array($_SESSION['user_role'], $allowed_roles, true)) {
|
|
http_response_code(403);
|
|
require __DIR__ . '/../pages/shared/403.php';
|
|
exit;
|
|
}
|
|
return $_SESSION;
|
|
}
|
|
|
|
function auth_has_role(string $role): bool {
|
|
return isset($_SESSION['user_role']) && $_SESSION['user_role'] === $role;
|
|
}
|
|
|
|
/**
|
|
* ---------- CSRF ----------
|
|
*/
|
|
function auth_csrf_token(): string {
|
|
return $_SESSION['csrf_token'] ?? '';
|
|
}
|
|
|
|
function auth_csrf_verify(string $token): bool {
|
|
return hash_equals($_SESSION['csrf_token'] ?? '', $token);
|
|
}
|
|
|
|
/**
|
|
* ---------- AUDIT LOG ----------
|
|
*/
|
|
function auth_log(?int $userId, string $action, string $details = ''): void {
|
|
try {
|
|
$pdo = getDB();
|
|
$stmt = $pdo->prepare("INSERT INTO audit_log (user_id, action, details, ip_address) VALUES (?, ?, ?, ?)");
|
|
$stmt->execute([$userId, $action, $details, $_SERVER['REMOTE_ADDR'] ?? '']);
|
|
} catch (\Throwable $e) {
|
|
// silent
|
|
}
|
|
}
|