PostERG/xamxam
1
0
Fork 0
mirror of https://codeberg.org/PostERG/xamxam.git synced 2026-09-25 01:53:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

add password-reset smoke test + AdminAuth DI + OneTimeToken empty-context redeem fix

Browse Source
This commit is contained in:
Pontoporeia
2026-08-24 11:36:02 +02:00
parent ddae5d8fef
commit f31addb6bc
4 changed files with 134 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/src/AdminAuth.php
+33 -9
View File
@@ -19,6 +19,29 @@ class AdminAuth
private const MAX_ATTEMPTS = 5;
private const COOLDOWN_MINUTES = 15;
/** Test hook: override the Database connection (e.g. temp DB in smoke tests). */
private static ?Database $dbOverride = null;
/**
* Return the Database used by AdminAuth. Overridable for tests.
*/
private static function db(): Database
{
if (self::$dbOverride !== null) {
return self::$dbOverride;
}
require_once APP_ROOT . '/src/Database.php';
return new Database();
}
/**
* Inject a Database instance (used by tests / smoke scripts).
*/
public static function setDatabase(Database $db): void
{
self::$dbOverride = $db;
}
/**
* Start the PHP session with hardened cookie parameters.
* Idempotent — safe to call even if session is already active.
@@ -51,8 +74,7 @@ class AdminAuth
}
// Lazy-load minimal DB just for this lookup.
require_once APP_ROOT . '/src/Database.php';
$db = new Database();
$db = self::db();
$hash = $db->getSetting('admin_password_hash');
return $hash !== '' ? $hash : null;
}
@@ -150,8 +172,7 @@ class AdminAuth
*/
public static function setPasswordHash(string $newHash): void
{
require_once APP_ROOT . '/src/Database.php';
$db = new Database();
$db = self::db();
$db->setSetting('admin_password_hash', $newHash);
}
@@ -160,8 +181,7 @@ class AdminAuth
*/
public static function removePasswordHash(): void
{
require_once APP_ROOT . '/src/Database.php';
$db = new Database();
$db = self::db();
$db->setSetting('admin_password_hash', '');
}
@@ -176,7 +196,7 @@ class AdminAuth
public static function issuePasswordResetToken(int $ttlSeconds = 1800): string
{
require_once APP_ROOT . '/src/OneTimeToken.php';
$db = new Database();
$db = self::db();
$ot = new OneTimeToken($db->getPDO());
return $ot->issue('password_reset', $ttlSeconds);
}
@@ -192,7 +212,7 @@ class AdminAuth
public static function requestPasswordReset(): bool
{
require_once APP_ROOT . '/src/SmtpRelay.php';
$db = new Database();
$db = self::db();
$to = SmtpRelay::getNotifyEmail($db);
if ($to === '') {
@@ -240,7 +260,7 @@ HTML;
}
require_once APP_ROOT . '/src/OneTimeToken.php';
$db = new Database();
$db = self::db();
$ot = new OneTimeToken($db->getPDO());
$context = $ot->redeem('password_reset', $token);
@@ -287,6 +307,10 @@ HTML;
*/
public static function logout(): void
{
// No session in this request (e.g. CLI) — nothing to destroy.
if (session_status() === PHP_SESSION_NONE) {
return;
}
self::startSession();
$_SESSION = [];
if (ini_get('session.use_cookies')) {