Initial Kaffeekasse SaaS restart

2026-06-15 17:13:38 +02:00
commit b08eb93547
54 changed files with 4617 additions and 0 deletions
@@ -0,0 +1,108 @@
+<?php
+
+namespace App\Core;
+
+use PDO;
+
+final class Auth
+{
+    public function __construct(
+        private readonly PDO $pdo,
+        private readonly Session $session
+    ) {
+    }
+
+    public function attemptPlatformLogin(string $email, string $password): bool
+    {
+        $statement = $this->pdo->prepare(
+            'SELECT id, password_hash, platform_role FROM users WHERE email = :email LIMIT 1'
+        );
+        $statement->execute(['email' => mb_strtolower($email)]);
+        $user = $statement->fetch();
+
+        if (!$user || !password_verify($password, $user['password_hash'])) {
+            return false;
+        }
+
+        if (($user['platform_role'] ?? 'user') !== 'platform_admin') {
+            return false;
+        }
+
+        $this->session->regenerate();
+        $this->session->put('auth', [
+            'user_id' => (int) $user['id'],
+            'platform_role' => $user['platform_role'],
+        ]);
+
+        return true;
+    }
+
+    public function attemptTenantLogin(string $tenantSlug, string $email, string $password): bool
+    {
+        $statement = $this->pdo->prepare(
+            'SELECT u.id,
+                    u.password_hash,
+                    m.tenant_id,
+                    m.role,
+                    t.slug AS tenant_slug
+             FROM users u
+             INNER JOIN tenant_memberships m ON m.user_id = u.id AND m.status = "active"
+             INNER JOIN tenants t ON t.id = m.tenant_id AND t.slug = :slug AND t.status = "active"
+             WHERE u.email = :email
+             LIMIT 1'
+        );
+        $statement->execute([
+            'slug' => $tenantSlug,
+            'email' => mb_strtolower($email),
+        ]);
+        $membership = $statement->fetch();
+
+        if (!$membership || !password_verify($password, $membership['password_hash'])) {
+            return false;
+        }
+
+        $this->session->regenerate();
+        $this->session->put('auth', [
+            'user_id' => (int) $membership['id'],
+            'tenant_id' => (int) $membership['tenant_id'],
+            'tenant_slug' => $membership['tenant_slug'],
+            'tenant_role' => $membership['role'],
+            'platform_role' => 'user',
+        ]);
+
+        return true;
+    }
+
+    public function user(): ?array
+    {
+        $auth = $this->session->get('auth');
+
+        return is_array($auth) ? $auth : null;
+    }
+
+    public function checkPlatformAdmin(): bool
+    {
+        return ($this->user()['platform_role'] ?? null) === 'platform_admin';
+    }
+
+    public function checkTenantAccess(string $tenantSlug): bool
+    {
+        $auth = $this->user();
+
+        return is_array($auth)
+            && isset($auth['tenant_slug'])
+            && hash_equals($auth['tenant_slug'], $tenantSlug);
+    }
+
+    public function requireRole(array $allowedRoles): bool
+    {
+        $role = $this->user()['tenant_role'] ?? null;
+
+        return is_string($role) && in_array($role, $allowedRoles, true);
+    }
+
+    public function logout(): void
+    {
+        $this->session->invalidate();
+    }
+}