Added in a cookie popup and proper newsletter functionality

Signed-off-by: rodude123 <rodude123@gmail.com>
2023-12-06 00:38:33 +00:00
parent e6522fb05e
commit 52614e5835
37 changed files with 2634 additions and 154 deletions
@@ -0,0 +1,142 @@
+<?php
+
+namespace api\user;
+
+use Firebase\JWT\JWT;
+use PDO;
+use function api\utils\dbConn;
+use function api\utils\getSecretKey;
+
+require_once __DIR__ . "/../utils/config.php";
+
+/**
+ * User Class
+ * Define all functions which either check, update or delete userData data
+ */
+class userData
+{
+    /**
+     * Check if userData exists and can be logged in
+     * @param $username string - Username
+     * @param $password string - Password
+     * @return bool - True if logged in, false if not
+     */
+    public function checkUser(string $username, string $password): bool
+    {
+        $conn = dbConn();
+        $stmt = $conn->prepare("SELECT * FROM users WHERE username = :username");
+        $stmt->bindParam(":username", $username);
+        $stmt->execute();
+
+        // set the resulting array to associative
+        $result = $stmt->fetchAll(PDO::FETCH_ASSOC);
+
+        if ($result)
+        {
+            if (password_verify($password, $result[0]["password"]))
+            {
+                return true;
+            }
+            return false;
+        }
+        return false;
+    }
+
+    /**
+     * Create a JWT token
+     * @param $username string - Username
+     * @return string - JWT token
+     */
+    public function createToken(string $username): string
+    {
+        $now = time();
+        $future = strtotime('+2 day', $now);
+        $secretKey = getSecretKey();
+        $payload = [
+            "jti" => $username,
+            "iat" => $now,
+            "exp" => $future
+        ];
+
+        return JWT::encode($payload, $secretKey, "HS256");
+    }
+
+    /**
+     * Check if email is already in use
+     * @param string $email - Email to check
+     * @return bool - True if email exists, false if not
+     */
+    public function checkEmail(string $email): bool
+    {
+        $conn = dbConn();
+        $stmt = $conn->prepare("SELECT * FROM users WHERE email = :email");
+        $stmt->bindParam(":email", $email);
+        $stmt->execute();
+
+        // set the resulting array to associative
+        $result = $stmt->fetchAll(PDO::FETCH_ASSOC);
+
+        if ($result)
+        {
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * Send a verification email to the userData
+     * @param $email - email address of the userData
+     * @return string - verification code
+     */
+    public function sendResetEmail($email): string
+    {
+        //generate a random token and email the address
+        $token = uniqid("rpe-");
+        $headers1 = "From: noreply@rohitpai.co.uk\r\n";
+        $headers1 .= "MIME-Version: 1.0\r\n";
+        $headers1 .= "Content-Type: text/html; charset=UTF-8\r\n";
+
+        $message = "
+        <!doctype html>
+        <html lang='en'>
+        <head>
+        <meta charset='UTF-8'>
+        <meta name='viewport' content='width=device-width, userData-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0'>
+                 <meta http-equiv='X-UA-Compatible' content='ie=edge'>
+        <title>Document</title>
+        </head>
+        <body>
+            <h1>Reset Password Verification Code</h1>
+            <br>
+            <p>Please enter the following code to reset your password: $token</p>            
+        </body>
+        </html>
+        ";
+
+        mail($email, "Reset Password Verification Code", $message, $headers1);
+        return $token;
+    }
+
+    /**
+     * Change password for an email with new password
+     * @param $email string Email
+     * @param $password string Password
+     * @return bool - true if the password was changed, false if not
+     */
+    public function changePassword(string $email, string $password): bool
+    {
+        $conn = dbConn();
+        $stmt = $conn->prepare("UPDATE users SET password = :password WHERE email = :email");
+        $newPwd = password_hash($password, PASSWORD_BCRYPT);
+        $stmt->bindParam(":password", $newPwd);
+        $stmt->bindParam(":email", $email);
+
+        if ($stmt->execute())
+        {
+            return true;
+        }
+        return false;
+    }
+
+
+}
@@ -0,0 +1,168 @@
+<?php
+
+namespace api\user;
+require_once __DIR__ . "/../utils/routesInterface.php";
+require_once "userData.php";
+
+use api\utils\routesInterface;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+use Slim\App;
+
+class userRoutes implements routesInterface
+{
+    private userData $user;
+
+    /**
+     * constructor used to instantiate a base user routes, to be used in the index.php file.
+     * @param App $app - the slim app used to create the routes
+     */
+    public function __construct(App $app)
+    {
+        $this->user = new userData();
+        $this->createRoutes($app);
+    }
+
+    /**
+     * creates the routes for the user
+     * @param App $app - the slim app used to create the routes
+     * @return void - returns nothing
+     */
+    public function createRoutes(App $app): void
+    {
+        $app->post("/user/login", function (Request $request, Response $response)
+        {
+            // get request data
+            $data = $request->getParsedBody();
+
+            if (empty($data["username"]) || empty($data["password"]))
+            {
+                // uh oh user sent empty data
+                return $response->withStatus(400);
+            }
+
+            if ($this->user->checkUser($data["username"], $data["password"]))
+            {
+                // yay, user is logged in
+                $_SESSION["token"] = $this->user->createToken($data["username"]);
+                $_SESSION["username"] = $data["username"];
+
+                $inactive = 60 * 60 * 48; // 2 days
+                $_SESSION["timeout"] = time() + $inactive;
+
+                $response->getBody()->write(json_encode(array("token" => $_SESSION["token"])));
+                return $response;
+            }
+            $response->getBody()->write(json_encode(array("error" => "Unauthorised")));
+            return $response->withStatus(401);
+        });
+
+        $app->get("/user/logout", function (Request $request, Response $response)
+        {
+            session_unset();
+            return $response;
+        });
+
+        $app->get("/user/isLoggedIn", function (Request $request, Response $response)
+        {
+            if (empty($_SESSION["token"]) && empty($_SESSION["username"]))
+            {
+                // uh oh user not logged in
+                return $response->withStatus(401);
+            }
+
+            $inactive = 60 * 60 * 48; // 2 days
+            $sessionLife = time() - $_SESSION["timeout"];
+            if ($sessionLife > $inactive)
+            {
+                // uh oh user session expired
+                session_destroy();
+                return $response->withStatus(401);
+            }
+
+            if (empty($_SESSION["token"]))
+            {
+                // user is logged in but no token was created
+                $_SESSION["token"] = $this->user->createToken($_SESSION["username"]);
+                return $response->withStatus(201);
+            }
+
+            $response->getBody()->write(json_encode(array("token" => $_SESSION["token"])));
+            return $response;
+
+        });
+
+        $app->get("/user/checkResetEmail/{email}", function (Request $request, Response $response, array $args)
+        {
+            if (empty($args["email"]))
+            {
+                // uh oh sent empty data
+                return $response->withStatus(400);
+            }
+
+            if ($this->user->checkEmail($args["email"]))
+            {
+                // yay email does exist
+                $_SESSION["resetToken"] = $this->user->sendResetEmail($args["email"]);
+                $_SESSION["resetEmail"] = $args["email"];
+                return $response;
+            }
+            return $response->withStatus(404);
+        });
+
+        $app->get("/user/resendEmail", function (Request $request, Response $response)
+        {
+            if (empty($_SESSION["resetToken"]))
+            {
+                // uh oh not authorized to resend email
+                return $response->withStatus(401);
+            }
+
+            $_SESSION["resetToken"] = $this->user->sendResetEmail($_SESSION["resetEmail"]);
+            return $response;
+        });
+
+        $app->get("/user/checkResetCode/{code}", function (Request $request, Response $response, array $args)
+        {
+            if (empty($args["code"]))
+            {
+                // uh oh sent empty data
+                return $response->withStatus(400);
+            }
+
+            if ($_SESSION["resetToken"] === $args["code"])
+            {
+                // yay, code code matches
+                return $response;
+            }
+
+            return $response->withStatus(401);
+        });
+
+        $app->post("/user/changePassword", function (Request $request, Response $response)
+        {
+            if (empty($_SESSION["resetToken"]) && empty($_SESSION["resetEmail"]))
+            {
+                // uh oh not authorized to change password
+                return $response->withStatus(401);
+            }
+
+            $data = $request->getParsedBody();
+            if (empty($data["password"]))
+            {
+                // uh oh sent empty data
+                return $response->withStatus(400);
+            }
+
+            if ($this->user->changePassword($_SESSION["resetEmail"], $data["password"]))
+            {
+                // yay, password changed
+                unset($_SESSION["resetToken"]);
+                unset($_SESSION["resetEmail"]);
+                return $response->withStatus(201);
+            }
+
+            return $response->withStatus(500);
+        });
+    }
+}