markus/finanzen
1
0
Fork 0
Code Issues 1 Pull Requests Packages Projects Releases Wiki Activity

update auf neuen codeigniter

Browse Source 
benutzerverwaltung hinzugefügt
sync scheduled implementiert
This commit is contained in:
Markus
2024-11-26 11:45:22 +01:00
parent eb028d1783
commit de4bd6e366
61 changed files with 1996 additions and 1130 deletions
Download Patch File Download Diff File Expand all files Collapse all files

270
app/Config/Auth.php
View File

@@ -2,13 +2,28 @@
declare(strict_types=1);
/**
* This file is part of CodeIgniter Shield.
*
* (c) CodeIgniter Foundation <admin@codeigniter.com>
*
* For the full copyright and license information, please view
* the LICENSE file that was distributed with this source code.
*/
namespace Config;
use CodeIgniter\Shield\Config\Auth as ShieldAuth;
use CodeIgniter\Shield\Authentication\Actions\ActionInterface;
use CodeIgniter\Shield\Authentication\AuthenticatorInterface;
use CodeIgniter\Shield\Authentication\Authenticators\AccessTokens;
use CodeIgniter\Shield\Authentication\Authenticators\HmacSha256;
use CodeIgniter\Shield\Authentication\Authenticators\JWT;
use CodeIgniter\Shield\Authentication\Authenticators\Session;
use CodeIgniter\Shield\Authentication\Passwords\CompositionValidator;
use CodeIgniter\Shield\Authentication\Passwords\DictionaryValidator;
use CodeIgniter\Shield\Authentication\Passwords\NothingPersonalValidator;
use CodeIgniter\Shield\Authentication\Passwords\PwnedValidator;
use CodeIgniter\Shield\Authentication\Passwords\ValidatorInterface;
use CodeIgniter\Shield\Models\UserModel;
@@ -19,9 +34,20 @@ class Auth extends ShieldAuth
* AUTHENTICATION
* ////////////////////////////////////////////////////////////////////
*/
// Constants for Record Login Attempts. Do not change.
public const RECORD_LOGIN_ATTEMPT_NONE = 0; // Do not record at all
public const RECORD_LOGIN_ATTEMPT_FAILURE = 1; // Record only failures
public const RECORD_LOGIN_ATTEMPT_ALL = 2; // Record all login attempts
/**
* --------------------------------------------------------------------
* View files
* --------------------------------------------------------------------
*/
public array $views = [
'login' => '\CodeIgniter\Shield\Views\login',
'register' => '\CodeIgniter\Shield\Views\register',
'login' => 'auth/login',
'register' => 'auth/register',
'layout' => '\CodeIgniter\Shield\Views\layout',
'action_email_2fa' => '\CodeIgniter\Shield\Views\email_2fa_show',
'action_email_2fa_verify' => '\CodeIgniter\Shield\Views\email_2fa_verify',
@@ -35,16 +61,25 @@ class Auth extends ShieldAuth
/**
* --------------------------------------------------------------------
* Redirect urLs
* Redirect URLs
* --------------------------------------------------------------------
* The default URL that a user will be redirected to after
* various auth actions. If you need more flexibility you can
* override the `getUrl()` method to apply any logic you may need.
* The default URL that a user will be redirected to after various auth
* actions. This can be either of the following:
*
* 1. An absolute URL. E.g. http://example.com OR https://example.com
* 2. A named route that can be accessed using `route_to()` or `url_to()`
* 3. A URI path within the application. e.g 'admin', 'login', 'expath'
*
* If you need more flexibility you can override the `getUrl()` method
* to apply any logic you may need.
*/
public array $redirects = [
'register' => '/',
'login' => '/',
'logout' => 'login',
'register' => '/',
'login' => '/',
'logout' => 'login',
'force_reset' => '/',
'permission_denied' => '/',
'group_denied' => '/',
];
/**
@@ -57,13 +92,13 @@ class Auth extends ShieldAuth
* You must register actions in the order of the actions to be performed.
*
* Available actions with Shield:
* - register: 'CodeIgniter\Shield\Authentication\Actions\EmailActivator'
* - login: 'CodeIgniter\Shield\Authentication\Actions\Email2FA'
* - register: \CodeIgniter\Shield\Authentication\Actions\EmailActivator::class
* - login: \CodeIgniter\Shield\Authentication\Actions\Email2FA::class
*
* @var array<string, class-string<ActionInterface>|null>
*/
public array $actions = [
'register' => null,
'register' => \CodeIgniter\Shield\Authentication\Actions\EmailActivator::class,
'login' => null,
];
@@ -81,29 +116,10 @@ class Auth extends ShieldAuth
public array $authenticators = [
'tokens' => AccessTokens::class,
'session' => Session::class,
'hmac' => HmacSha256::class,
// 'jwt' => JWT::class,
];
/**
* --------------------------------------------------------------------
* Name of Authenticator Header
* --------------------------------------------------------------------
* The name of Header that the Authorization token should be found.
* According to the specs, this should be `Authorization`, but rare
* circumstances might need a different header.
*/
public array $authenticatorHeader = [
'tokens' => 'Authorization',
];
/**
* --------------------------------------------------------------------
* Unused Token Lifetime
* --------------------------------------------------------------------
* Determines the amount of time, in seconds, that an unused
* access token can be used.
*/
public int $unusedTokenLifetime = YEAR;
/**
* --------------------------------------------------------------------
* Default Authenticator
@@ -121,12 +137,13 @@ class Auth extends ShieldAuth
* when using the 'chain' filter. Each Authenticator listed will be checked.
* If no match is found, then the next in the chain will be checked.
*
* @var string[]
* @phpstan-var list<string>
* @var list<string>
*/
public array $authenticationChain = [
'session',
'tokens',
'hmac',
// 'jwt',
];
/**
@@ -142,7 +159,10 @@ class Auth extends ShieldAuth
* Record Last Active Date
* --------------------------------------------------------------------
* If true, will always update the `last_active` datetime for the
* logged in user on every page request.
* logged-in user on every page request.
* This feature only works when session/tokens filter is active.
*
* @see https://codeigniter4.github.io/shield/quick_start_guide/using_session_auth/#protecting-pages for set filters.
*/
public bool $recordActiveDate = true;
@@ -188,6 +208,43 @@ class Auth extends ShieldAuth
'rememberLength' => 30 * DAY,
];
/**
* --------------------------------------------------------------------
* The validation rules for username
* --------------------------------------------------------------------
*
* Do not use string rules like `required|valid_email`.
*
* @var array<string, array<int, string>|string>
*/
public array $usernameValidationRules = [
'label' => 'Auth.username',
'rules' => [
'required',
'max_length[30]',
'min_length[3]',
'regex_match[/\A[a-zA-Z0-9\.]+\z/]',
],
];
/**
* --------------------------------------------------------------------
* The validation rules for email
* --------------------------------------------------------------------
*
* Do not use string rules like `required|valid_email`.
*
* @var array<string, array<int, string>|string>
*/
public array $emailValidationRules = [
'label' => 'Auth.email',
'rules' => [
'required',
'max_length[254]',
'valid_email',
],
];
/**
* --------------------------------------------------------------------
* Minimum Password Length
@@ -206,13 +263,13 @@ class Auth extends ShieldAuth
* You can add custom classes as long as they adhere to the
* CodeIgniter\Shield\Authentication\Passwords\ValidatorInterface.
*
* @var class-string<ValidatorInterface>[]
* @var list<class-string<ValidatorInterface>>
*/
public array $passwordValidators = [
'CodeIgniter\Shield\Authentication\Passwords\CompositionValidator',
'CodeIgniter\Shield\Authentication\Passwords\NothingPersonalValidator',
'CodeIgniter\Shield\Authentication\Passwords\DictionaryValidator',
//'CodeIgniter\Shield\Authentication\Passwords\PwnedValidator',
CompositionValidator::class,
NothingPersonalValidator::class,
DictionaryValidator::class,
// PwnedValidator::class,
];
/**
@@ -278,56 +335,87 @@ class Auth extends ShieldAuth
/**
* --------------------------------------------------------------------
* Encryption Algorithm to use
* Hashing Algorithm to use
* --------------------------------------------------------------------
* Valid values are
* - PASSWORD_DEFAULT (default)
* - PASSWORD_BCRYPT
* - PASSWORD_ARGON2I - As of PHP 7.2 only if compiled with support for it
* - PASSWORD_ARGON2ID - As of PHP 7.3 only if compiled with support for it
*
* If you choose to use any ARGON algorithm, then you might want to
* uncomment the "ARGON2i/D Algorithm" options to suit your needs
*/
public string $hashAlgorithm = PASSWORD_DEFAULT;
/**
* --------------------------------------------------------------------
* ARGON2i/D Algorithm options
* ARGON2I/ARGON2ID Algorithm options
* --------------------------------------------------------------------
* The ARGON2I method of encryption allows you to define the "memory_cost",
* The ARGON2I method of hashing allows you to define the "memory_cost",
* the "time_cost" and the number of "threads", whenever a password hash is
* created.
* This defaults to a value of 10 which is an acceptable number.
* However, depending on the security needs of your application
* and the power of your hardware, you might want to increase the
* cost. This makes the hashing process takes longer.
*/
public int $hashMemoryCost = 2048; // PASSWORD_ARGON2_DEFAULT_MEMORY_COST;
public int $hashMemoryCost = 65536; // PASSWORD_ARGON2_DEFAULT_MEMORY_COST;
public int $hashTimeCost = 4; // PASSWORD_ARGON2_DEFAULT_TIME_COST;
public int $hashThreads = 4; // PASSWORD_ARGON2_DEFAULT_THREADS;
public int $hashTimeCost = 4; // PASSWORD_ARGON2_DEFAULT_TIME_COST;
public int $hashThreads = 1; // PASSWORD_ARGON2_DEFAULT_THREADS;
/**
* --------------------------------------------------------------------
* Password Hashing Cost
* BCRYPT Algorithm options
* --------------------------------------------------------------------
* The BCRYPT method of encryption allows you to define the "cost"
* The BCRYPT method of hashing allows you to define the "cost"
* or number of iterations made, whenever a password hash is created.
* This defaults to a value of 10 which is an acceptable number.
* This defaults to a value of 12 which is an acceptable number.
* However, depending on the security needs of your application
* and the power of your hardware, you might want to increase the
* cost. This makes the hashing process takes longer.
*
* Valid range is between 4 - 31.
*/
public int $hashCost = 10;
public int $hashCost = 12;
/**
* ////////////////////////////////////////////////////////////////////
* OTHER SETTINGS
* ////////////////////////////////////////////////////////////////////
*/
/**
* --------------------------------------------------------------------
* Customize the DB group used for each model
* --------------------------------------------------------------------
*/
public ?string $DBGroup = null;
/**
* --------------------------------------------------------------------
* Customize Name of Shield Tables
* --------------------------------------------------------------------
* Only change if you want to rename the default Shield table names
*
* It may be necessary to change the names of the tables for
* security reasons, to prevent the conflict of table names,
* the internal policy of the companies or any other reason.
*
* - users Auth Users Table, the users info is stored.
* - auth_identities Auth Identities Table, Used for storage of passwords, access tokens, social login identities, etc.
* - auth_logins Auth Login Attempts, Table records login attempts.
* - auth_token_logins Auth Token Login Attempts Table, Records Bearer Token type login attempts.
* - auth_remember_tokens Auth Remember Tokens (remember-me) Table.
* - auth_groups_users Groups Users Table.
* - auth_permissions_users Users Permissions Table.
*
* @var array<string, string>
*/
public array $tables = [
'users' => 'users',
'identities' => 'auth_identities',
'logins' => 'auth_logins',
'token_logins' => 'auth_token_logins',
'remember_tokens' => 'auth_remember_tokens',
'groups_users' => 'auth_groups_users',
'permissions_users' => 'auth_permissions_users',
];
/**
* --------------------------------------------------------------------
* User Provider
@@ -340,7 +428,7 @@ class Auth extends ShieldAuth
*
* @var class-string<UserModel>
*/
public string $userProvider = 'CodeIgniter\Shield\Models\UserModel';
public string $userProvider = UserModel::class;
/**
* Returns the URL that a user should be redirected
@@ -348,7 +436,8 @@ class Auth extends ShieldAuth
*/
public function loginRedirect(): string
{
$url = setting('Auth.redirects')['login'];
$session = session();
$url = $session->getTempdata('beforeLoginUrl') ?? setting('Auth.redirects')['login'];
return $this->getUrl($url);
}
@@ -375,10 +464,65 @@ class Auth extends ShieldAuth
return $this->getUrl($url);
}
/**
* Returns the URL the user should be redirected to
* if force_reset identity is set to true.
*/
public function forcePasswordResetRedirect(): string
{
$url = setting('Auth.redirects')['force_reset'];
return $this->getUrl($url);
}
/**
* Returns the URL the user should be redirected to
* if permission denied.
*/
public function permissionDeniedRedirect(): string
{
$url = setting('Auth.redirects')['permission_denied'];
return $this->getUrl($url);
}
/**
* Returns the URL the user should be redirected to
* if group denied.
*/
public function groupDeniedRedirect(): string
{
$url = setting('Auth.redirects')['group_denied'];
return $this->getUrl($url);
}
/**
* Accepts a string which can be an absolute URL or
* a named route or just a URI path, and returns the
* full path.
*
* @param string $url an absolute URL or a named route or just URI path
*/
protected function getUrl(string $url): string
{
return strpos($url, 'http') === 0
? $url
: rtrim(site_url($url), '/ ');
// To accommodate all url patterns
$final_url = '';
switch (true) {
case strpos($url, 'http://') === 0 || strpos($url, 'https://') === 0: // URL begins with 'http' or 'https'. E.g. http://example.com
$final_url = $url;
break;
case route_to($url) !== false: // URL is a named-route
$final_url = rtrim(url_to($url), '/ ');
break;
default: // URL is a route (URI path)
$final_url = rtrim(site_url($url), '/ ');
break;
}
return $final_url;
}
}