function __invoke($req, $res, $next)
{
$apip = apip::getInstance();
$userId = utils::getRequestHeader($req, 'AliceSPA-UserID');
$webToken = utils::getRequestHeader($req, 'AliceSPA-WebToken');
$userId = empty($userId) ? null : $userId[0];
$webToken = empty($webToken) ? null : $webToken[0];
if ($userId === null || $webToken === null) {
$apip->pushError(3);
return $res;
}
$r = utils::disposeAPIException(function () use($userId, $webToken) {
return authService::getInstance()->authenticateByWebToken($userId, $webToken);
}, [1 => ['dispel' => 3, 'dispelPushError' => false]]);
if ($r === false) {
$apip->pushError(3);
return $res;
}
$roles = $req->getAttribute('route')->getArgument('AliceSPA_Roles');
$r = authService::getInstance()->checkRoles($roles);
if ($r === false) {
$apip->pushError(5);
return $res;
}
return $next($req, $res);
}
function __invoke($req, $res, $next)
{
if ($req->isOptions()) {
return $res;
}
$sessionId = utils::getRequestHeader($req, 'AliceSPA-SessionID');
if (!empty($sessionId)) {
$sessionId = $sessionId[0];
}
$sessionId = sessionServ::getInstance()->loadSession($sessionId);
apip::getInstance()->setSessionId($sessionId);
$res = $next($req, $res);
sessionServ::getInstance()->storeSession($sessionId);
return $res;
}
public function register($req, $res, $args)
{
$auth = $this->c->get('auth');
$apip = $this->c->get('apip');
$parsedBody = $req->getParsedBody();
$r = utils::disposeAPIException(function () use($parsedBody, $auth) {
return $auth->registerByUnionField($parsedBody, $parsedBody['password']);
}, [2 => ['dispel' => 4]]);
if (!($r === true)) {
return $res;
}
$r = $auth->loginByUnionField($parsedBody, $parsedBody['password']);
$apip->setData($r);
return $res;
}
public function check($codeId, $code, $type, $validTime = null)
{
$session = session::getInstance();
$codes = $session->get('AliceSPA_VerificationCodes');
if (empty($codes)) {
return false;
}
if (empty($codes[$type])) {
return false;
}
if (empty($codes[$type][$codeId])) {
return false;
}
$c = $codes[$type][$codeId];
if (empty($c)) {
return false;
}
if ($c['Code'] === $code && ($validTime === null || utils::datetimeMysql2PHP($c['CreateTime']) > time() - $validTime)) {
return true;
}
return false;
}
<?php
use AliceSPA\Helper\Utilities as utils;
$app->post('/AliceSPA/api/account/login', '\\AliceSPA\\Controller\\Account:login');
$app->post('/AliceSPA/api/account/register', '\\AliceSPA\\Controller\\Account:register');
utils::secureRoute($app->post('/AliceSPA/api/account/info', '\\AliceSPA\\Controller\\Account:info'));
utils::secureRoute($app->post('/AliceSPA/api/account/logout', '\\AliceSPA\\Controller\\Account:logout'));
public function authenticateByWebToken($userId, $webToken)
{
$db = db::getInstance();
$user = $db->get('aspa_account', '*', ['AND' => ['id' => $userId, 'web_token' => $webToken]]);
if (!$user) {
throw new APIException(1);
return false;
}
$web_token_create_time = $user['web_token_create_time'];
if (empty($web_token_create_time)) {
return false;
}
if (time() - utils::datetimeMysql2PHP($web_token_create_time) > configHelper::getCoreConfig()['webTokenValidTime']) {
return false;
}
unset($user['password']);
unset($user['web_token_create_time']);
$this->isLoggedIn = true;
$this->userInfo = $user;
return $this->userInfo;
}
<?php
use AliceSPA\Helper\Utilities as utils;
utils::secureRoute($app->post('/api/test', function ($req, $res, $args) {
return $res;
}), false, false, ['test' => ['select', 'insert', 'update', 'delete']]);
utils::secureRoute($app->post('/api/test123', function ($req, $res, $args) {
return $res;
}), false, 'image');
public function clearSessions()
{
$db = db::getInstance();
$db->delete('aspa_session', ['create_time[<]' => utils::datetimePHP2Mysql(time() - configHelper::getCoreConfig()['sessionValidTime'])]);
return true;
}
<?php
use AliceSPA\Helper\Utilities as utils;
$app->get('/AliceSPA/api/environment/errors', '\\AliceSPA\\Controller\\Environment:getErrors');
$app->get('/AliceSPA/api/environment/checkSession', function ($req, $res, $args) {
return $res;
});
//in session middleware
utils::secureRoute($app->post('/AliceSPA/api/environment/clearSessions', function ($req, $res, $args) {
\AliceSPA\Service\Session::getInstance()->clearSessions();
}), ['admin']);
