nok/wms-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1) user invitation 2) app access control 3) txn quota guard

Browse Source
This commit is contained in:
Thanakorn S
2026-05-21 11:42:47 +07:00
parent 8ec2e89f79
commit 6eeebfeacb
50 changed files with 1062 additions and 113 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/login/invited_onboarding.php
+193
View File
@@ -0,0 +1,193 @@
<?php
require '../session.php';
require '../config.php';
require '../dbconn.php';
$token = trim($_GET['token'] ?? '');
if (!$token) {
header('Location: ' . $server_url . 'login/index.php');
exit;
}
// Validate token — must match a pending invited user (license='user') that has not expired
$sth = $pdo1->prepare(
"SELECT u.user_id, u.email, u.verify_expires_at, c.company_name
FROM user u
JOIN company_map_user m ON m.user_id = u.user_id
JOIN company_list c ON c.company_id = m.company_id
WHERE u.verify_token = :token
AND u.status = 'pending'
AND u.license = 'user'
LIMIT 1"
);
$sth->execute([':token' => $token]);
$row = $sth->fetch(PDO::FETCH_ASSOC);
// Determine error state: cancelled (no row) or expired (row found but past expiry)
$invite_error = null;
if (!$row) {
$invite_error = 'cancelled';
} elseif (strtotime($row['verify_expires_at']) <= time()) {
$invite_error = 'expired';
}
if ($invite_error) {
require '../include_header.php';
$msg = $invite_error === 'expired'
? ['icon' => 'ti-clock-x', 'title' => 'Invitation Expired',
'body' => 'This invitation link has expired. Please contact your administrator to send a new invitation.']
: ['icon' => 'ti-user-x', 'title' => 'Invitation Cancelled',
'body' => 'This invitation has been cancelled. Please contact your administrator if you believe this is a mistake.'];
?>
<body>
<div class="container py-5" style="max-width:480px;">
<div class="text-center mb-5">
<a href="<?php echo $server_url?>login/index.php" class="d-inline-block mb-4">
<img src="<?php echo $server_url?>assets/images/favicon.png" alt="" width="40"/>
<span class="ms-2"><img src="<?php echo $server_url?>assets/images/logo.svg" alt=""></span>
</a>
</div>
<div class="card text-center">
<div class="card-body p-5">
<i class="ti <?php echo $msg['icon']; ?> text-danger mb-3" style="font-size:3rem;"></i>
<h2 class="fs-4 mb-2"><?php echo $msg['title']; ?></h2>
<p class="text-muted mb-4"><?php echo $msg['body']; ?></p>
<a href="<?php echo $server_url?>login/index.php" class="btn btn-primary">
Back to Sign In
</a>
</div>
</div>
</div>
</body>
</html>
<?php
exit;
}
$_SESSION['invited_user_id'] = (int)$row['user_id'];
$_SESSION['invited_token'] = $token;
if (empty($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
$company_name = htmlspecialchars($row['company_name']);
$invite_email = htmlspecialchars($row['email']);
require '../include_header.php';
?>
<body>
<div class="container py-5" style="max-width:520px;">
<div class="text-center mb-5">
<a href="<?php echo $server_url?>login/index.php" class="d-inline-block mb-4">
<img src="<?php echo $server_url?>assets/images/favicon.png" alt="" width="40"/>
<span class="ms-2"><img src="<?php echo $server_url?>assets/images/logo.svg" alt=""></span>
</a>
<h1 class="h4 mb-1">You've been invited!</h1>
<p class="text-muted">Complete your account setup to join <strong><?php echo $company_name ?></strong>.</p>
</div>
<div class="card">
<div class="card-body p-5">
<h2 class="fs-5 mb-1"><i class="ti ti-user-check me-2"></i>Account Setup</h2>
<p class="text-muted small mb-4">Your email: <strong><?php echo $invite_email ?></strong></p>
<div class="row g-3">
<div class="col-md-6">
<label class="form-label">First Name <span class="text-danger">*</span></label>
<input type="text" class="form-control" id="name" placeholder="First name">
</div>
<div class="col-md-6">
<label class="form-label">Last Name <span class="text-danger">*</span></label>
<input type="text" class="form-control" id="surname" placeholder="Last name">
</div>
<div class="col-12">
<label class="form-label">Username <span class="text-danger">*</span></label>
<input type="text" class="form-control" id="username" placeholder="Lowercase letters, numbers, underscores">
<div class="form-text">Used to log in. Cannot be changed later.</div>
</div>
<div class="col-12">
<label class="form-label">Password <span class="text-danger">*</span></label>
<div class="input-group">
<input type="password" class="form-control" id="password" placeholder="Choose a strong password">
<button class="btn btn-outline-secondary toggle-pw" type="button" data-target="password">
<i class="ti ti-eye"></i>
</button>
</div>
</div>
<div class="col-12">
<label class="form-label">Confirm Password <span class="text-danger">*</span></label>
<div class="input-group">
<input type="password" class="form-control" id="confirm_password" placeholder="Repeat your password">
<button class="btn btn-outline-secondary toggle-pw" type="button" data-target="confirm_password">
<i class="ti ti-eye"></i>
</button>
</div>
</div>
</div>
</div>
</div>
<div class="d-flex justify-content-end mt-4">
<button class="btn btn-primary px-5" id="btn_finish" onclick="finish_setup()">
<i class="ti ti-rocket me-1"></i>Complete Setup
</button>
</div>
</div>
<script>
$(function () {
$(document).on('click', '.toggle-pw', function () {
const $input = $('#' + $(this).data('target'));
const isText = $input.attr('type') === 'text';
$input.attr('type', isText ? 'password' : 'text');
$(this).find('i').toggleClass('ti-eye ti-eye-off');
});
});
function finish_setup() {
const name = $('#name').val().trim();
const surname = $('#surname').val().trim();
const username = $('#username').val().trim();
const password = $('#password').val();
const confirm = $('#confirm_password').val();
if (!name || !surname || !username || !password || !confirm) {
bootbox.alert('All fields are required.');
return;
}
if (password !== confirm) {
bootbox.alert('Passwords do not match.');
return;
}
const $btn = $('#btn_finish');
$btn.prop('disabled', true).html('<i class="ti ti-loader-2 me-1"></i>Setting up…');
ajax_request({
url: '<?php echo $server_url?>login/api/engine/invited_onboarding.php',
autoPrepare: false,
data: { json: JSON.stringify({ name, surname, username, password, confirm_password: confirm }) },
onSuccess: function () {
bootbox.alert('Account setup complete! Please sign in.', function () {
window.location.href = '<?php echo $server_url?>login/index.php';
});
},
onError: function () {
$btn.prop('disabled', false).html('<i class="ti ti-rocket me-1"></i>Complete Setup');
},
});
}
</script>
</body>
</html>