Phase1 Bearbeitung

app/Core/Auth.php

@@ -28,6 +28,8 @@ final class Auth
             return false;
         }
 
+        $this->rehashPasswordIfNeeded((int) $user['id'], (string) $user['password_hash'], $password);
+
         $this->session->regenerate();
         $this->session->put('auth', [
             'user_id' => (int) $user['id'],
@@ -44,10 +46,15 @@ final class Auth
                     u.password_hash,
                     m.tenant_id,
                     m.role,
-                    t.slug AS tenant_slug
+                    t.slug AS tenant_slug,
+                    member.id AS member_id
              FROM users u
              INNER JOIN tenant_memberships m ON m.user_id = u.id AND m.status = "active"
              INNER JOIN tenants t ON t.id = m.tenant_id AND t.slug = :slug AND t.status = "active"
+             LEFT JOIN members member
+               ON member.user_id = u.id
+              AND member.tenant_id = m.tenant_id
+              AND member.status = "active"
              WHERE u.email = :email
              LIMIT 1'
         );
@@ -61,12 +68,15 @@ final class Auth
             return false;
         }
 
+        $this->rehashPasswordIfNeeded((int) $membership['id'], (string) $membership['password_hash'], $password);
+
         $this->session->regenerate();
         $this->session->put('auth', [
             'user_id' => (int) $membership['id'],
             'tenant_id' => (int) $membership['tenant_id'],
             'tenant_slug' => $membership['tenant_slug'],
             'tenant_role' => $membership['role'],
+            'member_id' => isset($membership['member_id']) ? (int) $membership['member_id'] : null,
             'platform_role' => 'user',
         ]);
 
@@ -101,8 +111,37 @@ final class Auth
         return is_string($role) && in_array($role, $allowedRoles, true);
     }
 
+    public function tenantMemberId(): ?int
+    {
+        $memberId = $this->user()['member_id'] ?? null;
+
+        return is_int($memberId) ? $memberId : null;
+    }
+
+    public function canManageTenant(): bool
+    {
+        $role = $this->user()['tenant_role'] ?? null;
+
+        return is_string($role) && in_array($role, ['owner', 'admin'], true);
+    }
+
     public function logout(): void
     {
         $this->session->invalidate();
     }
+
+    private function rehashPasswordIfNeeded(int $userId, string $currentHash, string $password): void
+    {
+        if (!password_needs_rehash($currentHash, defined('PASSWORD_ARGON2ID') ? PASSWORD_ARGON2ID : PASSWORD_BCRYPT)) {
+            return;
+        }
+
+        $statement = $this->pdo->prepare(
+            'UPDATE users SET password_hash = :password_hash WHERE id = :id'
+        );
+        $statement->execute([
+            'password_hash' => secure_password_hash($password),
+            'id' => $userId,
+        ]);
+    }
 }