Adminator
fb44ec7afe
- student_sessions: neue Spalte student_id (+Index), backfilled aus (class_id,display_name) - Session::createStudent setzt student_id (per Lookup, falls nicht uebergeben) - alle Joins students<->student_sessions von display_name auf student_id umgestellt: Benchmark.php, live.php (5x), results.php (4x + runs), modules.php, profile.php, progress.php (answers+runs) - verlustfrei verifiziert (alt-Join == neu-Join, class 99/102) Robuster gegen Umbenennung/Doppelnamen, indexierbare Joins. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
104 lines
3.1 KiB
PHP
104 lines
3.1 KiB
PHP
<?php
|
|
/**
|
|
* GeoGraSim — Session Management
|
|
* Schueler: UUID-Cookie (anonym, kein Login)
|
|
* Lehrkraefte: PHP-Session mit teacher_id
|
|
*/
|
|
|
|
class Session {
|
|
const COOKIE_NAME = 'ggs_session';
|
|
const COOKIE_TTL = 86400 * 30; // 30 Tage
|
|
|
|
public static function start(): void {
|
|
if (session_status() === PHP_SESSION_NONE) {
|
|
session_start();
|
|
}
|
|
}
|
|
|
|
/** Schueler-Session-ID aus Cookie */
|
|
public static function studentId(): ?string {
|
|
return $_COOKIE[self::COOKIE_NAME] ?? null;
|
|
}
|
|
|
|
/** Neue Schueler-Session erstellen. student_id wird direkt gesetzt (per FK
|
|
* statt fragilem display_name-Join) — falls nicht übergeben, aus
|
|
* (class_id, display_name) aufgelöst. */
|
|
public static function createStudent(int $classId, string $displayName = '', ?int $studentId = null): string {
|
|
$uuid = sprintf('%s-%s-%s-%s-%s',
|
|
bin2hex(random_bytes(4)),
|
|
bin2hex(random_bytes(2)),
|
|
bin2hex(random_bytes(2)),
|
|
bin2hex(random_bytes(2)),
|
|
bin2hex(random_bytes(6))
|
|
);
|
|
|
|
$db = Database::get();
|
|
if ($studentId === null && $displayName !== '') {
|
|
$row = $db->fetchOne(
|
|
'SELECT id FROM students WHERE class_id = ? AND display_name = ? AND deleted_at IS NULL',
|
|
[$classId, $displayName]
|
|
);
|
|
if ($row) $studentId = (int)$row['id'];
|
|
}
|
|
$db->execute(
|
|
'INSERT INTO student_sessions (id, class_id, display_name, student_id) VALUES (?, ?, ?, ?)',
|
|
[$uuid, $classId, $displayName, $studentId]
|
|
);
|
|
|
|
setcookie(self::COOKIE_NAME, $uuid, [
|
|
'expires' => time() + self::COOKIE_TTL,
|
|
'path' => BASE_PATH . '/',
|
|
'samesite' => 'Lax',
|
|
'secure' => IS_PRODUCTION,
|
|
'httponly' => true,
|
|
]);
|
|
|
|
return $uuid;
|
|
}
|
|
|
|
/** API-Guard: 401 wenn keine Session */
|
|
public static function requireStudent(): string {
|
|
$id = self::studentId();
|
|
if (!$id) {
|
|
http_response_code(401);
|
|
echo json_encode(['error' => 'Keine Session']);
|
|
exit;
|
|
}
|
|
return $id;
|
|
}
|
|
|
|
/** Lehrer eingeloggt? */
|
|
public static function teacherId(): ?int {
|
|
return $_SESSION['teacher_id'] ?? null;
|
|
}
|
|
|
|
/** Lehrer-Login */
|
|
public static function loginTeacher(int $teacherId): void {
|
|
self::start();
|
|
$_SESSION['teacher_id'] = $teacherId;
|
|
}
|
|
|
|
/** Lehrer-Guard: 401 wenn nicht eingeloggt */
|
|
public static function requireTeacher(): int {
|
|
$id = self::teacherId();
|
|
if (!$id) {
|
|
http_response_code(401);
|
|
echo json_encode(['error' => 'Nicht eingeloggt']);
|
|
exit;
|
|
}
|
|
return $id;
|
|
}
|
|
|
|
public static function logout(): void {
|
|
self::start();
|
|
session_destroy();
|
|
setcookie(self::COOKIE_NAME, '', [
|
|
'expires' => 1,
|
|
'path' => BASE_PATH . '/',
|
|
'samesite' => 'Lax',
|
|
'secure' => IS_PRODUCTION,
|
|
'httponly' => true,
|
|
]);
|
|
}
|
|
}
|