55 lines
1.6 KiB
PHP
55 lines
1.6 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Middlewares;
|
|
|
|
use Core\Middleware;
|
|
use Core\Request;
|
|
use Core\Response;
|
|
use Core\Database;
|
|
use PDO;
|
|
|
|
class AuthMiddleware extends Middleware
|
|
{
|
|
public function handle(Request $request, callable $next): void
|
|
{
|
|
$authHeader = $request->getHeader('authorization');
|
|
if (empty($authHeader) || !str_starts_with($authHeader, 'Bearer ')) {
|
|
Response::unauthorized('Bearer token required in Authorization header.');
|
|
}
|
|
|
|
$token = substr($authHeader, 7);
|
|
$userId = $request->getHeader('x-user-id');
|
|
|
|
try {
|
|
$pdo = Database::getConnection();
|
|
$stmt = $pdo->prepare('
|
|
SELECT u.id, u.phone, u.full_name, u.role, u.status, us.last_token
|
|
FROM users u
|
|
JOIN user_security us ON us.user_id = u.id
|
|
WHERE u.id = :user_id AND us.last_token = :token
|
|
LIMIT 1
|
|
');
|
|
$stmt->execute([
|
|
':user_id' => $userId,
|
|
':token' => $token,
|
|
]);
|
|
$user = $stmt->fetch(PDO::FETCH_ASSOC);
|
|
|
|
if (!$user) {
|
|
Response::unauthorized('Invalid or expired authentication session token.');
|
|
}
|
|
|
|
if ($user['status'] !== 'ACTIVE' && $user['status'] !== 'PENDING_VERIFICATION') {
|
|
Response::forbidden('User account is not currently active.');
|
|
}
|
|
|
|
} catch (\Throwable $e) {
|
|
Response::error('Authentication verification failure: ' . $e->getMessage(), 500);
|
|
}
|
|
|
|
$next($request);
|
|
}
|
|
}
|