285 lines
11 KiB
PHP
285 lines
11 KiB
PHP
<?php
|
|
/**
|
|
* API: Authentifizierung (Lehrer + Schueler)
|
|
* POST /api/auth {action: "register"|"login"|"logout"|"student_login"|"reset_request"|"reset_confirm"}
|
|
*/
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
|
|
Response::error('Nur POST erlaubt', 405);
|
|
}
|
|
|
|
$body = json_decode(file_get_contents('php://input'), true);
|
|
$action = $body['action'] ?? '';
|
|
$db = Database::get();
|
|
|
|
// === LEHRER-REGISTRIERUNG ===
|
|
if ($action === 'register') {
|
|
$email = trim($body['email'] ?? '');
|
|
$password = $body['password'] ?? '';
|
|
$displayName = mb_substr(trim($body['displayName'] ?? ''), 0, 128);
|
|
$schoolName = mb_substr(trim($body['schoolName'] ?? ''), 0, 255);
|
|
|
|
if (!$email || !filter_var($email, FILTER_VALIDATE_EMAIL)) Response::error('Gültige E-Mail-Adresse erforderlich');
|
|
if (strlen($password) < 8) Response::error('Passwort muss mindestens 8 Zeichen lang sein');
|
|
if (!$displayName) Response::error('Name erforderlich');
|
|
|
|
// Pruefen ob E-Mail schon existiert
|
|
$existing = $db->fetchOne('SELECT id FROM teachers WHERE email = ?', [$email]);
|
|
if ($existing) Response::error('Diese E-Mail-Adresse ist bereits registriert');
|
|
|
|
// Regel (ab 2026-08): Der Benutzername einer Lehrperson IST ihre E-Mail-Adresse.
|
|
// Bestehende, abweichende Benutzernamen bleiben gültig (Login akzeptiert E-Mail ODER Benutzername).
|
|
$username = strtolower($email);
|
|
$hash = password_hash($password, PASSWORD_DEFAULT);
|
|
|
|
$db->execute(
|
|
'INSERT INTO teachers (username, email, password, display_name, school_name) VALUES (?, ?, ?, ?, ?)',
|
|
[$username, $email, $hash, $displayName, $schoolName]
|
|
);
|
|
|
|
$teacherId = (int)$db->lastInsertId();
|
|
Session::start();
|
|
Session::loginTeacher($teacherId);
|
|
|
|
// "Meine Klasse" automatisch anlegen
|
|
$chars = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
|
|
$joinCode = '';
|
|
do {
|
|
$joinCode = '';
|
|
for ($i = 0; $i < 6; $i++) $joinCode .= $chars[random_int(0, strlen($chars) - 1)];
|
|
$exists = $db->fetchOne('SELECT id FROM classes WHERE join_code = ?', [$joinCode]);
|
|
} while ($exists);
|
|
|
|
$db->execute(
|
|
'INSERT INTO classes (teacher_id, name, school_year, join_code) VALUES (?, ?, ?, ?)',
|
|
[$teacherId, 'Meine Klasse', date('Y') . '/' . (date('y') + 1), $joinCode]
|
|
);
|
|
|
|
// Willkommens-Mail senden (nicht-blockierend)
|
|
if (class_exists('Mailer')) {
|
|
Mailer::sendWelcomeTeacher($email, $displayName);
|
|
}
|
|
|
|
Response::ok([
|
|
'teacherId' => $teacherId,
|
|
'displayName' => $displayName,
|
|
]);
|
|
}
|
|
|
|
// === LEHRER-LOGIN ===
|
|
if ($action === 'login') {
|
|
$email = trim($body['email'] ?? '');
|
|
$password = $body['password'] ?? '';
|
|
|
|
if (!$email || !$password) Response::error('E-Mail und Passwort erforderlich');
|
|
|
|
$teacher = $db->fetchOne(
|
|
'SELECT id, password, display_name FROM teachers WHERE email = ? OR username = ?',
|
|
[$email, $email]
|
|
);
|
|
|
|
if (!$teacher || !password_verify($password, $teacher['password'])) {
|
|
Response::error('E-Mail oder Passwort falsch');
|
|
}
|
|
|
|
Session::start();
|
|
Session::loginTeacher((int)$teacher['id']);
|
|
|
|
$db->execute(
|
|
"INSERT INTO activity_log (user_type, user_id, action) VALUES ('teacher', ?, 'login')",
|
|
[$teacher['id']]
|
|
);
|
|
|
|
Response::ok([
|
|
'teacherId' => (int)$teacher['id'],
|
|
'displayName' => $teacher['display_name'],
|
|
]);
|
|
}
|
|
|
|
// === SCHÜLER*IN SELBST-REGISTRIERUNG (mit Klassencode) ===
|
|
if ($action === 'student_register') {
|
|
$classCode = strtoupper(trim($body['classCode'] ?? ''));
|
|
$username = trim($body['username'] ?? '');
|
|
$password = $body['password'] ?? '';
|
|
|
|
if (!$classCode || !$username || !$password) Response::error('Klassencode, Benutzername und Passwort erforderlich');
|
|
if (strlen($password) < 4) Response::error('Passwort muss mindestens 4 Zeichen haben');
|
|
|
|
$class = $db->fetchOne('SELECT id, name FROM classes WHERE join_code = ?', [$classCode]);
|
|
if (!$class) Response::error('Klassencode ungültig');
|
|
|
|
// Prüfen ob Username schon existiert
|
|
$existing = $db->fetchOne('SELECT id FROM students WHERE class_id = ? AND username = ?', [$class['id'], $username]);
|
|
if ($existing) Response::error('Benutzername in dieser Klasse bereits vergeben');
|
|
|
|
$hash = password_hash($password, PASSWORD_DEFAULT);
|
|
$db->execute(
|
|
'INSERT INTO students (class_id, username, password, display_name, is_anonymous) VALUES (?, ?, ?, ?, 0)',
|
|
[$class['id'], $username, $hash, $username]
|
|
);
|
|
|
|
// Direkt einloggen
|
|
$sessionId = Session::createStudent((int)$class['id'], $username);
|
|
|
|
Response::ok([
|
|
'sessionId' => $sessionId,
|
|
'displayName' => $username,
|
|
'className' => $class['name'],
|
|
]);
|
|
}
|
|
|
|
// === SCHÜLER*IN LOGIN OHNE KLASSENCODE (sucht über alle Klassen) ===
|
|
if ($action === 'student_login_by_username') {
|
|
$username = trim($body['username'] ?? '');
|
|
$password = $body['password'] ?? '';
|
|
|
|
if (!$username || !$password) Response::error('Benutzername und Passwort erforderlich');
|
|
|
|
$student = $db->fetchOne(
|
|
'SELECT s.id, s.password, s.display_name, s.class_id, c.name as class_name, c.join_code
|
|
FROM students s JOIN classes c ON c.id = s.class_id
|
|
WHERE s.username = ? AND s.deleted_at IS NULL
|
|
ORDER BY s.last_login DESC LIMIT 1',
|
|
[$username]
|
|
);
|
|
|
|
if (!$student || !password_verify($password, $student['password'])) {
|
|
Response::error('Benutzername oder Passwort falsch');
|
|
}
|
|
|
|
$sessionId = Session::createStudent((int)$student['class_id'], $student['display_name'] ?: $username);
|
|
$db->execute('UPDATE students SET last_login = NOW() WHERE id = ?', [$student['id']]);
|
|
|
|
Response::ok([
|
|
'sessionId' => $sessionId,
|
|
'studentId' => (int)$student['id'],
|
|
'displayName' => $student['display_name'] ?: $username,
|
|
'className' => $student['class_name'] ?? '',
|
|
]);
|
|
}
|
|
|
|
// === LOGOUT ===
|
|
if ($action === 'logout') {
|
|
Session::logout();
|
|
Response::ok();
|
|
}
|
|
|
|
// === SCHUELER-LOGIN ===
|
|
if ($action === 'student_login') {
|
|
$classCode = strtoupper(trim($body['classCode'] ?? ''));
|
|
$username = trim($body['username'] ?? '');
|
|
$password = $body['password'] ?? '';
|
|
|
|
if (!$classCode || !$username || !$password) Response::error('Klassencode, Benutzername und Passwort erforderlich');
|
|
|
|
$class = $db->fetchOne('SELECT id, name FROM classes WHERE join_code = ?', [$classCode]);
|
|
if (!$class) Response::error('Klasse nicht gefunden');
|
|
|
|
$student = $db->fetchOne(
|
|
'SELECT id, password, display_name FROM students WHERE class_id = ? AND username = ?',
|
|
[$class['id'], $username]
|
|
);
|
|
|
|
if (!$student || !password_verify($password, $student['password'])) {
|
|
Response::error('Benutzername oder Passwort falsch');
|
|
}
|
|
|
|
// Schueler-Session erstellen
|
|
$sessionId = Session::createStudent((int)$class['id'], $student['display_name'] ?: $username);
|
|
|
|
$db->execute('UPDATE students SET last_login = NOW() WHERE id = ?', [$student['id']]);
|
|
$db->execute(
|
|
"INSERT INTO activity_log (user_type, user_id, action) VALUES ('student', ?, 'login')",
|
|
[$student['id']]
|
|
);
|
|
|
|
Response::ok([
|
|
'sessionId' => $sessionId,
|
|
'studentId' => (int)$student['id'],
|
|
'displayName' => $student['display_name'] ?: $username,
|
|
'className' => $class['name'] ?? '',
|
|
]);
|
|
}
|
|
|
|
// === PASSWORT-RESET ANFORDERN ===
|
|
if ($action === 'reset_request') {
|
|
$email = trim($body['email'] ?? '');
|
|
if (!$email) Response::error('E-Mail-Adresse erforderlich');
|
|
|
|
$teacher = $db->fetchOne('SELECT id, display_name FROM teachers WHERE email = ?', [$email]);
|
|
if (!$teacher) {
|
|
// Kein Fehler zurückgeben (Datenschutz)
|
|
Response::ok(['message' => 'Falls ein Konto existiert, wurde eine E-Mail gesendet.']);
|
|
}
|
|
|
|
$token = bin2hex(random_bytes(32));
|
|
$db->execute('UPDATE teachers SET reset_token = ?, reset_expires = DATE_ADD(NOW(), INTERVAL 1 HOUR) WHERE id = ?', [$token, $teacher['id']]);
|
|
|
|
if (class_exists('Mailer')) {
|
|
Mailer::sendPasswordReset($email, $teacher['display_name'] ?: 'Lehrkraft', $token);
|
|
}
|
|
|
|
Response::ok(['message' => 'Falls ein Konto existiert, wurde eine E-Mail gesendet.']);
|
|
}
|
|
|
|
// === PASSWORT-RESET BESTÄTIGEN ===
|
|
if ($action === 'reset_confirm') {
|
|
$token = trim($body['token'] ?? '');
|
|
$newPassword = $body['newPassword'] ?? '';
|
|
|
|
if (!$token || !$newPassword) Response::error('Token und neues Passwort erforderlich');
|
|
if (strlen($newPassword) < 8) Response::error('Passwort muss mindestens 8 Zeichen haben');
|
|
|
|
$teacher = $db->fetchOne('SELECT id FROM teachers WHERE reset_token = ? AND reset_expires > NOW()', [$token]);
|
|
if (!$teacher) Response::error('Link ist ungültig oder abgelaufen');
|
|
|
|
$db->execute('UPDATE teachers SET password = ?, reset_token = NULL, reset_expires = NULL WHERE id = ?',
|
|
[password_hash($newPassword, PASSWORD_DEFAULT), $teacher['id']]);
|
|
|
|
Response::ok(['message' => 'Passwort wurde geändert.']);
|
|
}
|
|
|
|
// === STATUS ===
|
|
if ($action === 'status') {
|
|
Session::start();
|
|
$teacherId = Session::teacherId();
|
|
$studentId = Session::studentId();
|
|
|
|
if ($teacherId) {
|
|
$teacher = $db->fetchOne('SELECT id, display_name, email, school_name FROM teachers WHERE id = ?', [$teacherId]);
|
|
Response::ok(['role' => 'teacher', 'user' => $teacher]);
|
|
}
|
|
if ($studentId) {
|
|
$session = $db->fetchOne(
|
|
'SELECT s.display_name, s.class_id, c.name as class_name FROM student_sessions s LEFT JOIN classes c ON c.id = s.class_id WHERE s.id = ?',
|
|
[$studentId]
|
|
);
|
|
Response::ok(['role' => 'student', 'session' => $session]);
|
|
}
|
|
Response::ok(['role' => 'guest']);
|
|
}
|
|
|
|
// === KONTAKTFORMULAR ===
|
|
if ($action === 'contact') {
|
|
$name = mb_substr(trim($body['name'] ?? ''), 0, 128);
|
|
$email = trim($body['email'] ?? '');
|
|
$subject = mb_substr(trim($body['subject'] ?? ''), 0, 128);
|
|
$message = mb_substr(trim($body['message'] ?? ''), 0, 5000);
|
|
|
|
if (!$name || !$email || !$message) Response::error('Alle Felder erforderlich');
|
|
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) Response::error('Ungültige E-Mail-Adresse');
|
|
|
|
if (class_exists('Mailer')) {
|
|
$html = '<p><strong>Kontaktformular GeoGraSim</strong></p>'
|
|
. '<p><strong>Von:</strong> ' . htmlspecialchars($name) . ' (' . htmlspecialchars($email) . ')</p>'
|
|
. '<p><strong>Betreff:</strong> ' . htmlspecialchars($subject) . '</p>'
|
|
. '<p><strong>Nachricht:</strong></p>'
|
|
. '<p>' . nl2br(htmlspecialchars($message)) . '</p>';
|
|
Mailer::send('support@geograsim.at', 'Kontakt: ' . $subject . ' — ' . $name, $html);
|
|
}
|
|
|
|
Response::ok(['message' => 'Nachricht gesendet.']);
|
|
}
|
|
|
|
Response::error('Unbekannte Aktion');
|