dadasd

public/auth/callback/index.php

@@ -5,12 +5,14 @@ declare(strict_types=1);
 require_once dirname(__DIR__, 3) . '/src/App/bootstrap.php';
 
 use App\ConfigLoader;
+use App\AccountGate;
 use App\KeycloakAuth;
 
 session_start();
 
 $projectRoot = dirname(__DIR__, 3);
 $auth = new KeycloakAuth(ConfigLoader::load($projectRoot, 'keycloak'));
+$accountGate = new AccountGate(ConfigLoader::load($projectRoot, 'registration'));
 $state = (string) ($_GET['state'] ?? '');
 $expectedState = (string) ($_SESSION['keycloak_oauth_state'] ?? '');
 $code = (string) ($_GET['code'] ?? '');
@@ -50,9 +52,19 @@ if ($state === '' || $expectedState === '' || !hash_equals($expectedState, $stat
             } else {
                 /** @var array<string, mixed> $userPayload */
                 $userPayload = $userInfo['data'];
-                $auth->establishSession($tokenPayload, $userPayload);
-                header('Location: ' . $redirectTarget, true, 302);
-                exit;
+                $username = (string) ($userPayload['preferred_username'] ?? '');
+                $accountCheck = $accountGate->checkUsername($username);
+
+                if (!($accountCheck['allowed'] ?? false)) {
+                    $auth->logout();
+                    http_response_code(403);
+                    $title = 'Zugriff gesperrt';
+                    $message = (string) ($accountCheck['message'] ?? 'Dieses Konto ist noch nicht freigeschaltet.');
+                } else {
+                    $auth->establishSession($tokenPayload, $userPayload);
+                    header('Location: ' . $redirectTarget, true, 302);
+                    exit;
+                }
             }
         }
     }