bert.hausmans
2e94a107e4
The dual-cookie machinery (crewli_app_token + crewli_portal_token, Origin-based resolution) was load-bearing only when the second SPA existed. apps/portal/ was deleted in WS-3 PR-B1; the resolver code has been carrying dead branches since then. Collapse to one cookie. Cookie name retained as crewli_app_token — no session breakage on deploy. crewli_portal_token is fully purged from the server-side. CookieBearerToken middleware: - COOKIE_NAMES array → single COOKIE_NAME constant - resolveCookieName method (Origin/Referer parsing, host+port matching against frontend_app_url/frontend_portal_url) → removed - Body collapses to: skip if Authorization header present; else read crewli_app_token cookie and inject Bearer header SetAuthCookie trait: - COOKIE_MAP / resolveCookieName / originMatches → removed - makeAuthCookie / forgetAuthCookie now take only $token; the cookie name is the trait's private constant Five callers updated to drop the resolveCookieName($request) line and the cookie-name argument: LoginController (3 sites), MfaVerifyController (1 site), AuthRefreshController (1 site), LogoutController (1 site), InvitationController (1 site — caller list in the prompt missed this one but the same pattern applies). frontend_portal_url config key retained (per Phase A directive Q1): EmailChangeController, PasswordResetController, PersonController are non-auth consumers that build per-app URL maps for outbound emails. The map structure is now functionally redundant (production resolves all FRONTEND_* env vars to the same host) but stays structurally intact. Refactor tracked as TECH-FRONTEND-URL-CONSOLIDATE in the upcoming docs commit. HttpOnlyCookieAuthTest: - Removed 4 dual-cookie tests (login_sets_portal_cookie_for_portal_origin, app_cookie_does_not_authenticate_portal_requests, portal_cookie_does_not_authenticate_app_requests, correct_cookie_authenticates_with_matching_origin) - Renamed login_sets_app_cookie_for_unknown_origin → login_sets_app_cookie_regardless_of_origin; expanded to four Origin variants (none, app, unknown, foreign) — pins the new origin-agnostic contract - Removed Origin headers from request calls in remaining tests (now meaningless) Backend test count: 1491 → 1487 (-4 deleted, dual-cookie tests encoding the obsolete contract). Pint clean. Larastan clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
90 lines
2.7 KiB
PHP
90 lines
2.7 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Controllers\Api\V1\Auth;
|
|
|
|
use App\Enums\MfaMethod;
|
|
use App\Http\Controllers\Api\V1\Traits\SetAuthCookie;
|
|
use App\Http\Controllers\Controller;
|
|
use App\Http\Requests\Api\V1\Auth\MfaEmailSendRequest;
|
|
use App\Http\Requests\Api\V1\Auth\MfaVerifyRequest;
|
|
use App\Http\Resources\Api\V1\MeResource;
|
|
use App\Models\User;
|
|
use App\Services\MfaService;
|
|
use Illuminate\Http\JsonResponse;
|
|
use Illuminate\Support\Facades\Cache;
|
|
|
|
final class MfaVerifyController extends Controller
|
|
{
|
|
use SetAuthCookie;
|
|
|
|
public function __construct(
|
|
private MfaService $mfaService,
|
|
) {}
|
|
|
|
public function verify(MfaVerifyRequest $request): JsonResponse
|
|
{
|
|
$validated = $request->validated();
|
|
$method = MfaMethod::from($validated['method']);
|
|
|
|
try {
|
|
$user = $this->mfaService->verifyMfaCode(
|
|
sessionToken: $validated['mfa_session_token'],
|
|
code: $validated['code'],
|
|
method: $method,
|
|
ipAddress: $request->ip(),
|
|
);
|
|
} catch (\DomainException $e) {
|
|
return $this->error($e->getMessage(), 422);
|
|
}
|
|
|
|
// Trust device if requested
|
|
if (! empty($validated['trust_device']) && ! empty($validated['device_fingerprint'])) {
|
|
$this->mfaService->trustDevice(
|
|
user: $user,
|
|
fingerprint: $validated['device_fingerprint'],
|
|
ipAddress: $request->ip(),
|
|
deviceName: $validated['device_name'] ?? null,
|
|
);
|
|
}
|
|
|
|
// Issue auth token (same as login flow)
|
|
$user->load([
|
|
'organisations',
|
|
'roles',
|
|
'permissions',
|
|
'persons' => fn ($q) => $q->with(['event:id,name,slug,start_date,end_date,organisation_id', 'event.organisation:id,name']),
|
|
]);
|
|
|
|
$token = $user->createToken('auth-token')->plainTextToken;
|
|
|
|
return $this->success([
|
|
'user' => new MeResource($user),
|
|
], 'MFA verification successful')
|
|
->withCookie($this->makeAuthCookie($token));
|
|
}
|
|
|
|
public function sendEmailCode(MfaEmailSendRequest $request): JsonResponse
|
|
{
|
|
$sessionToken = $request->validated('mfa_session_token');
|
|
|
|
$cacheKey = 'mfa_session:'.$sessionToken;
|
|
$session = Cache::get($cacheKey);
|
|
|
|
if (! $session) {
|
|
return $this->error('MFA-sessie verlopen. Log opnieuw in.', 422);
|
|
}
|
|
|
|
$user = User::findOrFail($session['user_id']);
|
|
|
|
try {
|
|
$this->mfaService->sendEmailCode($user);
|
|
} catch (\DomainException $e) {
|
|
return $this->error($e->getMessage(), 429);
|
|
}
|
|
|
|
return $this->success(null, 'Verification code sent');
|
|
}
|
|
}
|