private/desktop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

dadasd
All checks were successful
Deploy / deploy-staging (push) Successful in 24s
Details
Deploy / deploy-production (push) Has been skipped
Details

Browse Source
This commit is contained in:
Lars Gebhardt-Kusche
2026-06-15 22:15:01 +02:00
parent f07d8e7110
commit 033fdfd598
10 changed files with 186 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
public/admin/users/index.php
View File

@@ -5,12 +5,26 @@ declare(strict_types=1);
require_once dirname(__DIR__, 3) . '/src/App/bootstrap.php';
use App\ConfigLoader;
use App\AccountGate;
use App\RegistrationService;
session_start();
$projectRoot = dirname(__DIR__, 3);
$accountGate = new AccountGate(ConfigLoader::load($projectRoot, 'registration'));
$registration = new RegistrationService($projectRoot, ConfigLoader::load($projectRoot, 'registration'));
if (isset($_SESSION['desktop_auth']) && is_array($_SESSION['desktop_auth'])) {
$currentAuthUser = is_array($_SESSION['desktop_auth']['user'] ?? null) ? $_SESSION['desktop_auth']['user'] : [];
$accountCheck = $accountGate->checkUsername((string) ($currentAuthUser['username'] ?? ''));
if (!($accountCheck['allowed'] ?? false)) {
unset($_SESSION['desktop_auth']);
header('Location: /auth/inactive/?message=' . urlencode((string) ($accountCheck['message'] ?? 'Dieses Konto ist noch nicht freigeschaltet.')), true, 302);
exit;
}
}
$currentUser = is_array($_SESSION['desktop_auth']['user'] ?? null) ? $_SESSION['desktop_auth']['user'] : [];
$currentGroups = array_map(static fn (string $group): string => strtolower(trim($group, '/')), array_values(array_map('strval', (array) ($currentUser['groups'] ?? []))));

12
public/api/mining-checker/index.php
View File

@@ -5,6 +5,7 @@ declare(strict_types=1);
require_once dirname(__DIR__, 3) . '/src/App/bootstrap.php';
use App\ConfigLoader;
use App\AccountGate;
use App\KeycloakAuth;
use MiningChecker\LegacyModuleStore;
use MiningChecker\MiningCheckerUserScope;
@@ -13,9 +14,20 @@ session_start();
$projectRoot = dirname(__DIR__, 3);
$auth = new KeycloakAuth(ConfigLoader::load($projectRoot, 'keycloak'));
$accountGate = new AccountGate(ConfigLoader::load($projectRoot, 'registration'));
header('Content-Type: application/json; charset=utf-8');
if ($auth->isAuthenticated()) {
$currentUser = is_array($_SESSION['desktop_auth']['user'] ?? null) ? $_SESSION['desktop_auth']['user'] : [];
$accountCheck = $accountGate->checkUsername((string) ($currentUser['username'] ?? ''));
if (!($accountCheck['allowed'] ?? false)) {
$auth->logout();
respond(['error' => (string) ($accountCheck['message'] ?? 'Dieses Konto ist noch nicht freigeschaltet.')], 403);
}
}
if (!$auth->shouldShowDesktop()) {
respond(['error' => 'Nicht autorisiert.'], 401);
}

14
public/api/module-auth/mining-checker/index.php
View File

@@ -5,6 +5,7 @@ declare(strict_types=1);
require_once dirname(__DIR__, 5) . '/src/App/bootstrap.php';
use App\ConfigLoader;
use App\AccountGate;
use App\KeycloakAuth;
use MiningChecker\LegacyModuleStore;
use MiningChecker\MiningCheckerUserScope;
@@ -13,9 +14,22 @@ session_start();
$projectRoot = dirname(__DIR__, 5);
$auth = new KeycloakAuth(ConfigLoader::load($projectRoot, 'keycloak'));
$accountGate = new AccountGate(ConfigLoader::load($projectRoot, 'registration'));
header('Content-Type: application/json; charset=utf-8');
if ($auth->isAuthenticated()) {
$currentUser = is_array($_SESSION['desktop_auth']['user'] ?? null) ? $_SESSION['desktop_auth']['user'] : [];
$accountCheck = $accountGate->checkUsername((string) ($currentUser['username'] ?? ''));
if (!($accountCheck['allowed'] ?? false)) {
$auth->logout();
http_response_code(403);
echo json_encode(['error' => (string) ($accountCheck['message'] ?? 'Dieses Konto ist noch nicht freigeschaltet.')], JSON_UNESCAPED_UNICODE);
exit;
}
}
if (!$auth->shouldShowDesktop()) {
http_response_code(401);
echo json_encode(['error' => 'Nicht autorisiert.'], JSON_UNESCAPED_UNICODE);

13
public/apps/mining-checker/index.php
View File

@@ -5,12 +5,25 @@ declare(strict_types=1);
require_once dirname(__DIR__, 3) . '/src/App/bootstrap.php';
use App\ConfigLoader;
use App\AccountGate;
use App\KeycloakAuth;
session_start();
$projectRoot = dirname(__DIR__, 3);
$auth = new KeycloakAuth(ConfigLoader::load($projectRoot, 'keycloak'));
$accountGate = new AccountGate(ConfigLoader::load($projectRoot, 'registration'));
if ($auth->isAuthenticated()) {
$currentUser = is_array($_SESSION['desktop_auth']['user'] ?? null) ? $_SESSION['desktop_auth']['user'] : [];
$accountCheck = $accountGate->checkUsername((string) ($currentUser['username'] ?? ''));
if (!($accountCheck['allowed'] ?? false)) {
$auth->logout();
header('Location: /auth/inactive/?message=' . urlencode((string) ($accountCheck['message'] ?? 'Dieses Konto ist noch nicht freigeschaltet.')), true, 302);
exit;
}
}
if (!$auth->shouldShowDesktop()) {
header('Location: /auth/keycloak', true, 302);

18
public/auth/callback/index.php
View File

@@ -5,12 +5,14 @@ declare(strict_types=1);
require_once dirname(__DIR__, 3) . '/src/App/bootstrap.php';
use App\ConfigLoader;
use App\AccountGate;
use App\KeycloakAuth;
session_start();
$projectRoot = dirname(__DIR__, 3);
$auth = new KeycloakAuth(ConfigLoader::load($projectRoot, 'keycloak'));
$accountGate = new AccountGate(ConfigLoader::load($projectRoot, 'registration'));
$state = (string) ($_GET['state'] ?? '');
$expectedState = (string) ($_SESSION['keycloak_oauth_state'] ?? '');
$code = (string) ($_GET['code'] ?? '');
@@ -50,9 +52,19 @@ if ($state === '' || $expectedState === '' || !hash_equals($expectedState, $stat
} else {
/** @var array<string, mixed> $userPayload */
$userPayload = $userInfo['data'];
$auth->establishSession($tokenPayload, $userPayload);
header('Location: ' . $redirectTarget, true, 302);
exit;
$username = (string) ($userPayload['preferred_username'] ?? '');
$accountCheck = $accountGate->checkUsername($username);
if (!($accountCheck['allowed'] ?? false)) {
$auth->logout();
http_response_code(403);
$title = 'Zugriff gesperrt';
$message = (string) ($accountCheck['message'] ?? 'Dieses Konto ist noch nicht freigeschaltet.');
} else {
$auth->establishSession($tokenPayload, $userPayload);
header('Location: ' . $redirectTarget, true, 302);
exit;
}
}
}
}

35
public/auth/inactive/index.php Normal file
View File

@@ -0,0 +1,35 @@
<?php
declare(strict_types=1);
require_once dirname(__DIR__, 3) . '/src/App/bootstrap.php';
$message = trim((string) ($_GET['message'] ?? ''));
if ($message === '') {
$message = 'Dieses Konto ist noch nicht freigeschaltet.';
}
?><!DOCTYPE html>
<html lang="de">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Konto nicht freigeschaltet</title>
<link rel="stylesheet" href="/assets/auth/login.css">
</head>
<body>
<main class="login-shell">
<section class="login-panel">
<div class="login-panel-top">
<p class="login-kicker">Kusche.Berlin</p>
<h1>Konto nicht freigeschaltet</h1>
<p class="login-copy"><?= htmlspecialchars($message, ENT_QUOTES) ?></p>
</div>
<div class="login-actions">
<a class="login-button login-button-primary" href="/auth/keycloak">Zum Login</a>
</div>
</section>
</main>
</body>
</html>

3
public/auth/register/confirmation/index.php
View File

@@ -39,8 +39,7 @@ unset($_SESSION['registration_confirmation']);
</div>
<div class="login-actions">
<a class="login-button login-button-primary" href="/auth/keycloak">Weiter zu Keycloak</a>
<a class="login-button login-button-secondary" href="/auth/register/">Neue Registrierung</a>
<a class="login-button login-button-primary" href="/auth/keycloak">Zum Login</a>
</div>
</section>
</main>

14
public/index.php
View File

@@ -5,6 +5,7 @@ declare(strict_types=1);
require_once dirname(__DIR__) . '/src/App/bootstrap.php';
use App\App;
use App\AccountGate;
use App\ConfigLoader;
use App\KeycloakAuth;
@@ -12,7 +13,20 @@ session_start();
$projectRoot = dirname(__DIR__);
$keycloakConfig = ConfigLoader::load($projectRoot, 'keycloak');
$registrationConfig = ConfigLoader::load($projectRoot, 'registration');
$auth = new KeycloakAuth($keycloakConfig);
$accountGate = new AccountGate($registrationConfig);
if ($auth->isAuthenticated()) {
$currentUser = is_array($_SESSION['desktop_auth']['user'] ?? null) ? $_SESSION['desktop_auth']['user'] : [];
$accountCheck = $accountGate->checkUsername((string) ($currentUser['username'] ?? ''));
if (!($accountCheck['allowed'] ?? false)) {
$auth->logout();
header('Location: /auth/inactive/?message=' . urlencode((string) ($accountCheck['message'] ?? 'Dieses Konto ist noch nicht freigeschaltet.')), true, 302);
exit;
}
}
if (!$auth->shouldShowDesktop()) {
if ($auth->isConfigured()) {

65
src/App/AccountGate.php Normal file
View File

@@ -0,0 +1,65 @@
<?php
declare(strict_types=1);
namespace App;
final class AccountGate
{
private LdapProvisioner $ldap;
/**
* @param array<string, mixed> $config
*/
public function __construct(
private readonly array $config,
) {
$this->ldap = new LdapProvisioner($config);
}
/**
* @return array{allowed: bool, message: string}
*/
public function checkUsername(string $username): array
{
$username = strtolower(trim($username));
if ($username === '') {
return [
'allowed' => false,
'message' => 'Für dieses Konto konnte kein Benutzername ermittelt werden.',
];
}
if (!$this->ldap->isEnabled() || !$this->ldap->canUseLdap()) {
return [
'allowed' => false,
'message' => 'Der Kontostatus konnte nicht sicher geprüft werden.',
];
}
$user = $this->ldap->getUserByUsername($username, ['uid', 'shadowExpire']);
if (!is_array($user)) {
return [
'allowed' => false,
'message' => 'Dieses Konto ist nicht freigeschaltet.',
];
}
$shadowExpire = (string) ($user['shadowexpire'] ?? $user['shadowExpire'] ?? '');
$activeShadowExpire = (string) ($this->config['ldap']['active_shadow_expire'] ?? -1);
if ($shadowExpire !== $activeShadowExpire) {
return [
'allowed' => false,
'message' => 'Dieses Konto ist noch nicht freigeschaltet.',
];
}
return [
'allowed' => true,
'message' => 'Konto ist aktiv.',
];
}
}

5
src/App/RegistrationService.php
View File

@@ -64,7 +64,8 @@ final class RegistrationService
$note = trim((string) ($input['note'] ?? ''));
$password = (string) ($input['password'] ?? '');
$passwordConfirm = (string) ($input['password_confirm'] ?? '');
$displayName = trim($givenName . ' ' . $familyName);
$displayName = $givenName;
$fullName = trim($givenName . ' ' . $familyName);
$errors = [];
if (!preg_match('/^[a-z0-9._-]{3,32}$/', $username)) {
@@ -128,7 +129,7 @@ final class RegistrationService
'apple_generateduid' => '',
'display_name' => $displayName,
'cn' => $displayName !== '' ? $displayName : $username,
'gecos' => $displayName,
'gecos' => $fullName !== '' ? $fullName : $displayName,
'admin_note' => '',
'ldap_created_at' => gmdate('c'),
];