/home/techb158/workloadmatch.com/api/routes
Edit: /home/techb158/workloadmatch.com/api/routes/auth.php (6697B)
'Required', 'password' => 'Required']);
}
// Use the existing login function from includes/functions.php
if (!function_exists('login')) {
require_once __DIR__ . '/../../includes/functions.php';
}
if (login($username, $password, $mysqli)) {
$user = Auth::getUser();
$userType = $_SESSION['User_type'] ?? '';
// Remove sensitive fields
unset($user['Password'], $user['salt']);
Response::success([
'user' => $user,
'user_type' => $userType,
'session_id' => session_id(),
'role_dir' => Auth::getRoleDir(),
], 'Login successful');
}
Response::error('Invalid credentials or account disabled', 401);
}
function handleLogout(): void
{
$_SESSION = [];
$params = session_get_cookie_params();
setcookie(session_name(), '', time() - 42000, $params['path'], $params['domain'], $params['secure'], $params['httponly']);
session_destroy();
Response::success(null, 'Logged out successfully');
}
function handleGetCurrentUser(): void
{
$user = Auth::requireLogin();
$userType = $_SESSION['User_type'] ?? '';
unset($user['Password'], $user['salt']);
Response::success([
'user' => $user,
'user_type' => $userType,
'role_dir' => Auth::getRoleDir(),
'manage_as' => $_SESSION['manage_as'] ?? null,
]);
}
function handleCheckSession(): void
{
$user = Auth::getUser();
Response::success([
'authenticated' => $user !== null,
'user_type' => $_SESSION['User_type'] ?? null,
]);
}
function handleChangePassword(?array $body, mysqli $mysqli): void
{
$user = Auth::requireLogin();
$oldPassword = $body['old_password'] ?? '';
$newPassword = $body['new_password'] ?? '';
if (!$oldPassword || !$newPassword) {
Response::validationError(['old_password' => 'Required', 'new_password' => 'Required']);
}
if (strlen($newPassword) < 6) {
Response::validationError(['new_password' => 'Must be at least 6 characters']);
}
$userType = $_SESSION['User_type'];
$tableMap = [
'admin_profile' => ['Admin_ID', 'admin_profile'],
'master_profile' => ['Master_ID', 'master_profile'],
'manager_profile' => ['Manager_ID', 'manager_profile'],
'teacher_profile' => ['Teacher_ID', 'teacher_profile'],
];
[$idCol, $table] = $tableMap[$userType];
// Verify old password
$stmt = $mysqli->prepare("SELECT Password, salt FROM $table WHERE $idCol = ? LIMIT 1");
$stmt->bind_param('s', $user[$idCol]);
$stmt->execute();
$stmt->bind_result($storedHash, $salt);
$stmt->fetch();
$stmt->close();
if (!$storedHash) {
Response::error('User not found', 404);
}
$valid = false;
if (strlen($storedHash) === 60 && strpos($storedHash, '$2y$') === 0) {
$valid = password_verify($oldPassword, $storedHash);
} else {
$valid = ($storedHash === hash('sha512', $oldPassword . $salt));
}
if (!$valid) {
Response::error('Current password is incorrect', 401);
}
$newHash = password_hash($newPassword, PASSWORD_BCRYPT);
$upd = $mysqli->prepare("UPDATE $table SET Password = ?, salt = '' WHERE $idCol = ?");
$upd->bind_param('ss', $newHash, $user[$idCol]);
$upd->execute();
$upd->close();
// Update session login string
$_SESSION['login_string'] = hash('sha512', $newHash . $_SERVER['HTTP_USER_AGENT']);
Response::success(null, 'Password changed successfully');
}
function handleForgotPassword(?array $body, mysqli $mysqli): void
{
$email = trim($body['email'] ?? '');
if (!$email || !filter_var($email, FILTER_VALIDATE_EMAIL)) {
Response::validationError(['email' => 'Valid email required']);
}
// Check all user tables for this email
$tables = [
['teacher_profile', 'Teacher_ID', 'Email', 'First_Name', 'Last_Name'],
['manager_profile', 'Manager_ID', 'Email', 'First_Name', 'Last_Name'],
['master_profile', 'Master_ID', 'User_Name', 'User_Name', 'User_Name'],
['admin_profile', 'Admin_ID', 'User_Name', 'User_Name', 'User_Name'],
];
$found = false;
foreach ($tables as $t) {
[$table, $idCol, $emailCol, $fnCol, $lnCol] = $t;
$stmt = $mysqli->prepare("SELECT $idCol, $fnCol, $lnCol FROM $table WHERE $emailCol = ? LIMIT 1");
$stmt->bind_param('s', $email);
$stmt->execute();
$stmt->store_result();
if ($stmt->num_rows === 1) {
$found = true;
$stmt->close();
break;
}
$stmt->close();
}
if (!$found) {
// Don't reveal whether email exists
Response::success(null, 'If the email exists, a reset link has been sent.');
}
// Generate reset token
$token = bin2hex(random_bytes(32));
$expires = date('Y-m-d H:i:s', strtotime('+1 hour'));
$stmt = $mysqli->prepare("INSERT INTO password_resets (email, token, expires_at) VALUES (?, ?, ?)");
$stmt->bind_param('sss', $email, $token, $expires);
$stmt->execute();
$stmt->close();
// In production, send email with PHPMailer
$resetUrl = rtrim(BASE_URL, '/') . '/reset?token=' . $token;
Response::success([
'reset_url' => $resetUrl,
'token' => $token, // Remove in production
], 'If the email exists, a reset link has been sent.');
}