Adminator
9a61f55cb1
- Design-System (assets/css/design-system.css) mit 21 Komponenten, iPad-Responsive-Breakpoints, Touch-Ziele 36px, Music-Player, Glossar-Tooltips - Templates (sims/template.html + student/teacher-Dashboard) - Docs: module-interface.md (inkl. 4a Sprachregel, 4b Leichte Sprache, 4c iPad), content-architecture.md, crash-recovery.md, music-registry.md - Admin-Infrastruktur: admin-modules.html + api/admin-modules.php (Titel, Emoji, Bild, Status, Dauer, Alter pro Modul) - Inbox-System: _inbox/README.md + _status.md fuer Atlas + Briefings an Klima, Glossar, Lehrplan, Fluss - Zentrale SFX-Pipeline (scripts/generate-sounds.py) - DALL-E-Bilder: 8 Badges + 5 Glossar-Repraesentationsbilder (Querformat) - Logo + Inter-Font lokal - PHP-APIs: admin, glossar, levels, licenses, progress, waypoints, assignments, profile, tickets - Spielsprache entfernt (admin-modules, admin-levels, schueler) - Landing-Page-Bearbeitungen (Boote sichtbarer, Button-Hintergrund) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
102 lines
3.3 KiB
PHP
102 lines
3.3 KiB
PHP
<?php
|
|
/**
|
|
* API: Super-Admin Authentifizierung (2FA mit E-Mail-PIN)
|
|
* POST /api/admin {action: "login"|"verify_pin"|"status"|"logout"}
|
|
*/
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
|
|
Response::error('Nur POST erlaubt', 405);
|
|
}
|
|
|
|
$body = json_decode(file_get_contents('php://input'), true);
|
|
$action = $body['action'] ?? '';
|
|
$db = Database::get();
|
|
|
|
// === LOGIN (Schritt 1: Username + Passwort → PIN per E-Mail) ===
|
|
if ($action === 'login') {
|
|
$username = trim($body['username'] ?? '');
|
|
$password = $body['password'] ?? '';
|
|
|
|
if (!$username || !$password) Response::error('Benutzername und Passwort erforderlich');
|
|
|
|
$admin = $db->fetchOne('SELECT id, password, email_2fa FROM admin_users WHERE username = ?', [$username]);
|
|
if (!$admin || !password_verify($password, $admin['password'])) {
|
|
sleep(1); // Brute-force delay
|
|
Response::error('Benutzername oder Passwort falsch');
|
|
}
|
|
|
|
// PIN generieren (4-stellig)
|
|
$pin = str_pad(random_int(0, 9999), 4, '0', STR_PAD_LEFT);
|
|
$db->execute(
|
|
'INSERT INTO admin_pins (admin_id, pin, expires_at) VALUES (?, ?, DATE_ADD(NOW(), INTERVAL 10 MINUTE))',
|
|
[$admin['id'], $pin]
|
|
);
|
|
|
|
// PIN per E-Mail senden
|
|
if (class_exists('Mailer')) {
|
|
Mailer::sendAdminPin($admin['email_2fa'], $pin);
|
|
}
|
|
|
|
// Admin-ID in Session speichern (aber noch nicht authentifiziert)
|
|
Session::start();
|
|
$_SESSION['admin_pending'] = (int)$admin['id'];
|
|
unset($_SESSION['admin_id']); // Sicherstellen dass nicht schon eingeloggt
|
|
|
|
Response::ok(['message' => 'PIN wurde an Ihre E-Mail gesendet.', 'email' => maskEmail($admin['email_2fa'])]);
|
|
}
|
|
|
|
// === VERIFY PIN (Schritt 2: PIN eingeben → Admin-Session) ===
|
|
if ($action === 'verify_pin') {
|
|
Session::start();
|
|
$adminId = $_SESSION['admin_pending'] ?? null;
|
|
if (!$adminId) Response::error('Kein ausstehender Login. Bitte erneut anmelden.');
|
|
|
|
$pin = trim($body['pin'] ?? '');
|
|
if (!$pin || strlen($pin) !== 4) Response::error('4-stelliger PIN erforderlich');
|
|
|
|
$valid = $db->fetchOne(
|
|
'SELECT id FROM admin_pins WHERE admin_id = ? AND pin = ? AND expires_at > NOW() AND used = 0 ORDER BY id DESC LIMIT 1',
|
|
[$adminId, $pin]
|
|
);
|
|
|
|
if (!$valid) {
|
|
sleep(1);
|
|
Response::error('PIN ungültig oder abgelaufen');
|
|
}
|
|
|
|
// PIN als benutzt markieren
|
|
$db->execute('UPDATE admin_pins SET used = 1 WHERE id = ?', [$valid['id']]);
|
|
|
|
// Admin-Session aktivieren
|
|
$_SESSION['admin_id'] = $adminId;
|
|
unset($_SESSION['admin_pending']);
|
|
|
|
Response::ok(['message' => 'Anmeldung erfolgreich.']);
|
|
}
|
|
|
|
// === STATUS ===
|
|
if ($action === 'status') {
|
|
Session::start();
|
|
$adminId = $_SESSION['admin_id'] ?? null;
|
|
if ($adminId) {
|
|
$admin = $db->fetchOne('SELECT id, username FROM admin_users WHERE id = ?', [$adminId]);
|
|
Response::ok(['authenticated' => true, 'admin' => $admin]);
|
|
}
|
|
Response::ok(['authenticated' => false]);
|
|
}
|
|
|
|
// === LOGOUT ===
|
|
if ($action === 'logout') {
|
|
Session::start();
|
|
unset($_SESSION['admin_id'], $_SESSION['admin_pending']);
|
|
Response::ok();
|
|
}
|
|
|
|
Response::error('Unbekannte Aktion');
|
|
|
|
// Helper: E-Mail maskieren (t***@ph-vorarlberg.ac.at)
|
|
function maskEmail(string $email): string {
|
|
$parts = explode('@', $email);
|
|
return substr($parts[0], 0, 1) . '***@' . $parts[1];
|
|
}
|