Security hardening: invited user onboarding flow (C1–N7)

app/login/accept_invite.php

@@ -0,0 +1,158 @@
+<?php
+    require '../session.php';
+    require '../config.php';
+    require '../dbconn.php';
+
+    $token = trim($_GET['token'] ?? '');
+
+    if (!$token) {
+        header('Location: ' . $server_url . 'login/index.php');
+        exit;
+    }
+
+    // Reject if a user is already logged in — opening an invite link in an active
+    // session would bind invite state into the current session.
+    if (!empty($_SESSION['login_company_id'])) {
+        require '../include_header.php';
+?>
+<body>
+  <div class="container py-5" style="max-width:480px;">
+    <div class="text-center mb-5">
+      <a href="<?php echo $server_url?>login/index.php" class="d-inline-block mb-4">
+        <img src="<?php echo $server_url?>assets/images/favicon.png" alt="" width="40"/>
+        <span class="ms-2"><img src="<?php echo $server_url?>assets/images/logo.svg" alt=""></span>
+      </a>
+    </div>
+    <div class="card text-center">
+      <div class="card-body p-5">
+        <i class="ti ti-user-check text-warning mb-3" style="font-size:3rem;"></i>
+        <h2 class="fs-4 mb-2">Already Signed In</h2>
+        <p class="text-muted mb-4">You are already signed in. Please sign out first before accepting an invitation.</p>
+        <a href="<?php echo $server_url?>login/index.php" class="btn btn-primary">Go to Dashboard</a>
+      </div>
+    </div>
+  </div>
+</body>
+</html>
+<?php
+        exit;
+    }
+
+    // Look up token — must exist in company_map_user and not be expired
+    $sth = $pdo1->prepare(
+        "SELECT m.map_id, m.role, m.invite_expires_at,
+                c.company_name,
+                u.email, u.name, u.surname
+         FROM company_map_user m
+         JOIN company_list c ON c.company_id = m.company_id
+         JOIN user u ON u.user_id = m.user_id
+         WHERE m.invite_token = :token
+         LIMIT 1"
+    );
+    $sth->execute([':token' => $token]);
+    $row = $sth->fetch(PDO::FETCH_ASSOC);
+
+    $invite_error = null;
+    if (!$row) {
+        $invite_error = 'invalid';
+    } elseif ($row['invite_expires_at'] && strtotime($row['invite_expires_at']) <= time()) {
+        $invite_error = 'expired';
+    }
+
+    if ($invite_error) {
+        require '../include_header.php';
+        $msg = $invite_error === 'expired'
+            ? ['icon' => 'ti-clock-x', 'title' => 'Invitation Expired',
+               'body' => 'This invitation link has expired. Please contact the company administrator to resend your invitation.']
+            : ['icon' => 'ti-user-x',  'title' => 'Invalid Invitation',
+               'body' => 'This invitation link is invalid or has already been used.'];
+?>
+<body>
+  <div class="container py-5" style="max-width:480px;">
+    <div class="text-center mb-5">
+      <a href="<?php echo $server_url?>login/index.php" class="d-inline-block mb-4">
+        <img src="<?php echo $server_url?>assets/images/favicon.png" alt="" width="40"/>
+        <span class="ms-2"><img src="<?php echo $server_url?>assets/images/logo.svg" alt=""></span>
+      </a>
+    </div>
+    <div class="card text-center">
+      <div class="card-body p-5">
+        <i class="ti <?php echo $msg['icon']; ?> text-danger mb-3" style="font-size:3rem;"></i>
+        <h2 class="fs-4 mb-2"><?php echo $msg['title']; ?></h2>
+        <p class="text-muted mb-4"><?php echo $msg['body']; ?></p>
+        <a href="<?php echo $server_url?>login/index.php" class="btn btn-primary">Back to Sign In</a>
+      </div>
+    </div>
+  </div>
+</body>
+</html>
+<?php
+        exit;
+    }
+
+    // Regenerate session ID before binding invite identity to prevent session fixation
+    session_regenerate_id(true);
+
+    $_SESSION['accept_invite_token'] = $token;
+    $_SESSION['csrf_token']          = bin2hex(random_bytes(32));
+
+    $company_name = htmlspecialchars($row['company_name']);
+    $invite_email = htmlspecialchars($row['email']);
+    $invite_role  = htmlspecialchars(ucfirst($row['role']));
+
+    require '../include_header.php';
+?>
+
+<body>
+
+  <div class="container py-5" style="max-width:480px;">
+
+    <div class="text-center mb-5">
+      <a href="<?php echo $server_url?>login/index.php" class="d-inline-block mb-4">
+        <img src="<?php echo $server_url?>assets/images/favicon.png" alt="" width="40"/>
+        <span class="ms-2"><img src="<?php echo $server_url?>assets/images/logo.svg" alt=""></span>
+      </a>
+      <h1 class="h4 mb-1">You've been invited!</h1>
+      <p class="text-muted">Accept the invitation to join <strong><?php echo $company_name ?></strong>.</p>
+    </div>
+
+    <div class="card">
+      <div class="card-body p-5 text-center">
+        <i class="ti ti-building mb-3 text-primary" style="font-size:3rem;"></i>
+        <h2 class="fs-5 mb-1"><?php echo $company_name ?></h2>
+        <p class="text-muted mb-1">You are invited as: <strong><?php echo $invite_role ?></strong></p>
+        <p class="text-muted small">Account: <?php echo $invite_email ?></p>
+      </div>
+    </div>
+
+    <div class="d-flex justify-content-end mt-4">
+      <button class="btn btn-primary px-5" id="btn_accept" onclick="accept_invite()">
+        <i class="ti ti-check me-1"></i>Accept Invitation
+      </button>
+    </div>
+
+  </div>
+
+  <script>
+  function accept_invite() {
+    const $btn = $('#btn_accept');
+    $btn.prop('disabled', true).html('<i class="ti ti-loader-2 me-1"></i>Accepting…');
+
+    ajax_request({
+      url:         '<?php echo $server_url?>login/api/engine/accept_invite.php',
+      autoPrepare: false,
+      data:        { json: JSON.stringify({}) },
+      onSuccess: function () {
+        bootbox.alert('Invitation accepted! You can now sign in.', function () {
+          window.location.href = '<?php echo $server_url?>login/index.php';
+        });
+      },
+      onError: function () {
+        $btn.prop('disabled', false).html('<i class="ti ti-check me-1"></i>Accept Invitation');
+      },
+    });
+  }
+  </script>
+
+</body>
+</html>

app/login/api/engine/accept_invite.php

@@ -0,0 +1,90 @@
+<?php
+/**
+ * accept_invite.php — Accept a company invitation for an existing user.
+ *
+ * Called by accept_invite.php page AJAX after the user clicks Accept.
+ * The user already has an active account; this just clears the invite_token
+ * on their company_map_user row, making them a full member.
+ *
+ * Full flow:
+ *   1. Session guard — rejects if accept_invite_token is missing.
+ *   2. CSRF check.
+ *   3. Re-validate token against DB (not expired, invite_token still set).
+ *   4. Clear invite_token and invite_expires_at from company_map_user.
+ *   5. Verify exactly one row was updated.
+ *   6. Clear session keys.
+ *   7. Return { success: 1 }.
+ */
+
+require_once '../../../session.php';
+require_once '../../../config.php';
+require_once '../../../preset.php';
+define('UNAUTHENTICATED_ROUTE', true);
+require_once '../../../assets/utils/db_auth.php';
+
+header('Content-Type: application/json; charset=utf-8');
+
+$answer = ['success' => 0, 'message' => ''];
+
+// ── Step 1: Session guard ─────────────────────────────────────────────────────
+if (empty($_SESSION['accept_invite_token'])) {
+    $answer['message'] = 'Invalid session. Please use your invitation link.';
+    http_response_code(403);
+    exit(json_encode($answer));
+}
+
+$token = $_SESSION['accept_invite_token'];
+
+// ── Step 2: CSRF check ────────────────────────────────────────────────────────
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    $csrf = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
+    if (empty($csrf) || $csrf !== ($_SESSION['csrf_token'] ?? '')) {
+        http_response_code(403);
+        $answer['message'] = 'Invalid request.';
+        exit(json_encode($answer));
+    }
+}
+
+try {
+
+    // ── Step 3: Re-validate token ─────────────────────────────────────────────
+    $sth = $pdo1->prepare(
+        "SELECT map_id FROM company_map_user
+         WHERE invite_token      = :token
+           AND invite_expires_at > NOW()
+         LIMIT 1"
+    );
+    $sth->execute([':token' => $token]);
+    if (!$sth->fetchColumn()) {
+        $answer['message'] = 'Invitation has expired or already been used.';
+        http_response_code(403);
+        exit(json_encode($answer));
+    }
+
+    // ── Step 4–5: Activate membership ────────────────────────────────────────
+    $stmt = $pdo1->prepare(
+        "UPDATE company_map_user
+         SET invite_token      = NULL,
+             invite_expires_at = NULL
+         WHERE invite_token = :token"
+    );
+    $stmt->execute([':token' => $token]);
+
+    if ($stmt->rowCount() !== 1) {
+        $answer['message'] = 'Invitation is no longer valid.';
+        http_response_code(403);
+        exit(json_encode($answer));
+    }
+
+    // ── Step 6: Clear session keys ────────────────────────────────────────────
+    unset($_SESSION['accept_invite_token']);
+
+    $answer['success'] = 1;
+    $answer['message'] = 'Invitation accepted.';
+
+} catch (Exception $e) {
+    $answer['message'] = $e->getMessage();
+    http_response_code(400);
+}
+
+exit(json_encode($answer));

app/login/api/engine/invited_onboarding.php

@@ -12,15 +12,17 @@
  * Full flow:
  *   1. Session guard — rejects if 'invited_user_id' is missing.
  *   2. CSRF check.
- *   3. Re-validate token against DB (expiry + status='pending' + license='user').
- *   4. Validate and sanitise input fields.
- *   5. Username format and uniqueness check.
- *   6. Password match and strength check.
- *   7. Hash password.
+ *   3. Validate and sanitise input fields (before acquiring DB locks).
+ *   4. Username format check.
+ *   5. Password match and strength check.
+ *   6. Hash password.
+ *   7. BEGIN TRANSACTION — SELECT FOR UPDATE to atomically re-validate token
+ *      (expiry + status='pending' + license='user').
  *   8. UPDATE user: name, surname, username, password, status='active',
- *      verify_token=NULL, verify_expires_at=NULL.
- *   9. UPDATE company_map_user: invite_token=NULL.
- *   10. Return { success: 1 }.
+ *      verify_token=NULL, verify_expires_at=NULL. Catches SQLSTATE 23000
+ *      (duplicate username). Checks rowCount()=1.
+ *   9. UPDATE company_map_user: invite_token=NULL, invite_expires_at=NULL.
+ *   10. COMMIT. Return { success: 1 }.
  */
 
 require_once '../../../session.php';
@@ -58,43 +60,26 @@ $data = json_decode($_POST['json'] ?? '{}', true) ?: [];
 
 try {
 
-    // ── Step 3: Re-validate token ─────────────────────────────────────────────
-    $sth = $pdo1->prepare(
-        "SELECT user_id FROM user
-         WHERE user_id        = :uid
-           AND verify_token   = :token
-           AND status         = 'pending'
-           AND license        = 'user'
-           AND verify_expires_at > NOW()
-         LIMIT 1"
-    );
-    $sth->execute([':uid' => $user_id, ':token' => $token]);
-    if (!$sth->fetchColumn()) {
-        $answer['message'] = 'Invitation has expired or already been used. Please request a new invitation.';
-        http_response_code(403);
-        exit(json_encode($answer));
-    }
-
     // ── Step 4: Sanitise and validate input ───────────────────────────────────
-    $name     = trim($data['name']             ?? '');
-    $surname  = trim($data['surname']          ?? '');
+    // Done before the transaction so validation errors don't acquire DB locks.
+    $name     = trim($data['name']                ?? '');
+    $surname  = trim($data['surname']             ?? '');
     $username = strtolower(trim($data['username'] ?? ''));
-    $password = $data['password']              ?? '';
-    $confirm  = $data['confirm_password']      ?? '';
+    $password = $data['password']                 ?? '';
+    $confirm  = $data['confirm_password']         ?? '';
 
     if (!$name || !$surname || !$username || !$password || !$confirm) {
         throw new Exception('All fields are required.');
     }
 
-    // ── Step 5: Username format and uniqueness ────────────────────────────────
-    if (!preg_match('/^[a-z0-9_]+$/', $username)) {
-        throw new Exception('Username may only contain lowercase letters, numbers and underscores.');
+    // ── Step 5: Username format, length, and reserved names ──────────────────
+    if (!preg_match('/^[a-z0-9_]{3,32}$/', $username)) {
+        throw new Exception('Username must be 3–32 characters and may only contain lowercase letters, numbers and underscores.');
     }
 
-    $sth = $pdo1->prepare("SELECT user_id FROM user WHERE username = :u AND user_id != :uid LIMIT 1");
-    $sth->execute([':u' => $username, ':uid' => $user_id]);
-    if ($sth->fetchColumn()) {
-        throw new Exception('Username is already taken. Please choose another.');
+    $reserved = ['admin', 'owner', 'support', 'root', 'system', 'superuser', 'administrator'];
+    if (in_array($username, $reserved, true)) {
+        throw new Exception('That username is reserved. Please choose another.');
     }
 
     // ── Step 6: Password match and strength ───────────────────────────────────
@@ -109,32 +94,77 @@ try {
         throw new Exception('Password is too weak. ' . $msg);
     }
 
-    // ── Step 7–8: Hash and activate account ──────────────────────────────────
     $hashed = password_hash($password, PASSWORD_BCRYPT);
 
-    $pdo1->prepare(
+    // ── Steps 3 + 7–9: Atomic token re-validation and activation ─────────────
+    // SELECT FOR UPDATE locks the row so a concurrent resendInvite or removeUser
+    // cannot mutate the token between our check and the UPDATE.
+    $pdo1->beginTransaction();
+
+    $sth = $pdo1->prepare(
+        "SELECT user_id FROM user
+         WHERE user_id          = :uid
+           AND verify_token     = :token
+           AND status           = 'pending'
+           AND license          = 'user'
+           AND verify_expires_at > NOW()
+         LIMIT 1
+         FOR UPDATE"
+    );
+    $sth->execute([':uid' => $user_id, ':token' => $token]);
+    if (!$sth->fetchColumn()) {
+        $pdo1->rollBack();
+        $answer['message'] = 'Invitation has expired or already been used. Please request a new invitation.';
+        http_response_code(403);
+        exit(json_encode($answer));
+    }
+
+    // ── Step 7–8: Activate account ────────────────────────────────────────────
+    $stmt = $pdo1->prepare(
         "UPDATE user
-         SET name                = :name,
-             surname             = :surname,
-             username            = :username,
-             password            = :password,
-             status              = 'active',
-             verify_token        = NULL,
-             verify_expires_at   = NULL
+         SET name              = :name,
+             surname           = :surname,
+             username          = :username,
+             password          = :password,
+             status            = 'active',
+             verify_token      = NULL,
+             verify_expires_at = NULL
          WHERE user_id = :uid"
-    )->execute([
-        ':name'     => $name,
-        ':surname'  => $surname,
-        ':username' => $username,
-        ':password' => $hashed,
-        ':uid'      => $user_id,
-    ]);
+    );
+
+    try {
+        $stmt->execute([
+            ':name'     => $name,
+            ':surname'  => $surname,
+            ':username' => $username,
+            ':password' => $hashed,
+            ':uid'      => $user_id,
+        ]);
+    } catch (PDOException $e) {
+        $pdo1->rollBack();
+        // SQLSTATE 23000 = unique constraint violation (duplicate username)
+        if ($e->getCode() === '23000') {
+            throw new Exception('Username is already taken. Please choose another.');
+        }
+        throw $e;
+    }
+
+    if ($stmt->rowCount() !== 1) {
+        $pdo1->rollBack();
+        $answer['message'] = 'Invitation is no longer valid.';
+        http_response_code(403);
+        exit(json_encode($answer));
+    }
 
     // ── Step 9: Clear invite token from company_map_user ─────────────────────
     $pdo1->prepare(
-        "UPDATE company_map_user SET invite_token = NULL WHERE user_id = :uid"
+        "UPDATE company_map_user
+         SET invite_token = NULL, invite_expires_at = NULL
+         WHERE user_id = :uid"
     )->execute([':uid' => $user_id]);
 
+    $pdo1->commit();
+
     // ── Step 10: Clear session invite keys ────────────────────────────────────
     unset($_SESSION['invited_user_id'], $_SESSION['invited_token']);
 
@@ -142,6 +172,7 @@ try {
     $answer['message'] = 'Account setup complete.';
 
 } catch (Exception $e) {
+    if ($pdo1->inTransaction()) $pdo1->rollBack();
     $answer['message'] = $e->getMessage();
     http_response_code(400);
 }

app/login/api/engine/onboarding.php

@@ -68,6 +68,17 @@ if (empty($_SESSION['onboarding_user_id'])) {
 
 $user_id = (int)$_SESSION['onboarding_user_id'];
 
+// ── Step 1b: License guard ────────────────────────────────────────────────────
+// Invited users (license='user') must use invited_onboarding.php, not this flow.
+// If somehow an invited user's session reaches here, reject immediately.
+$sth = $pdo1->prepare("SELECT license FROM user WHERE user_id = :uid LIMIT 1");
+$sth->execute([':uid' => $user_id]);
+if ($sth->fetchColumn() !== 'owner') {
+    $answer['message'] = 'Invalid session.';
+    http_response_code(403);
+    exit(json_encode($answer));
+}
+
 // ── Step 2: CSRF check ────────────────────────────────────────────────────────
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     $csrf = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';

app/login/invited_onboarding.php

@@ -10,6 +10,34 @@
         exit;
     }
 
+    // Reject if a user is already logged in — opening an invite link in an active
+    // session would bind a different account's identity into the current session.
+    if (!empty($_SESSION['login_company_id'])) {
+        require '../include_header.php';
+?>
+<body>
+  <div class="container py-5" style="max-width:480px;">
+    <div class="text-center mb-5">
+      <a href="<?php echo $server_url?>login/index.php" class="d-inline-block mb-4">
+        <img src="<?php echo $server_url?>assets/images/favicon.png" alt="" width="40"/>
+        <span class="ms-2"><img src="<?php echo $server_url?>assets/images/logo.svg" alt=""></span>
+      </a>
+    </div>
+    <div class="card text-center">
+      <div class="card-body p-5">
+        <i class="ti ti-user-check text-warning mb-3" style="font-size:3rem;"></i>
+        <h2 class="fs-4 mb-2">Already Signed In</h2>
+        <p class="text-muted mb-4">You are already signed in. Please sign out first before accepting an invitation.</p>
+        <a href="<?php echo $server_url?>login/index.php" class="btn btn-primary">Go to Dashboard</a>
+      </div>
+    </div>
+  </div>
+</body>
+</html>
+<?php
+        exit;
+    }
+
     // Validate token — must match a pending invited user (license='user') that has not expired
     $sth = $pdo1->prepare(
         "SELECT u.user_id, u.email, u.verify_expires_at, c.company_name
@@ -65,12 +93,12 @@
         exit;
     }
 
+    // Regenerate session ID before binding invite identity to prevent session fixation
+    session_regenerate_id(true);
+
     $_SESSION['invited_user_id'] = (int)$row['user_id'];
     $_SESSION['invited_token']   = $token;
-
-    if (empty($_SESSION['csrf_token'])) {
-        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
-    }
+    $_SESSION['csrf_token']      = bin2hex(random_bytes(32));
 
     $company_name = htmlspecialchars($row['company_name']);
     $invite_email = htmlspecialchars($row['email']);
@@ -107,8 +135,8 @@
           </div>
           <div class="col-12">
             <label class="form-label">Username <span class="text-danger">*</span></label>
-            <input type="text" class="form-control" id="username" placeholder="Lowercase letters, numbers, underscores">
-            <div class="form-text">Used to log in. Cannot be changed later.</div>
+            <input type="text" class="form-control" id="username" placeholder="Lowercase letters, numbers, underscores" minlength="3" maxlength="32">
+            <div class="form-text">3–32 characters. Used to log in. Cannot be changed later.</div>
           </div>
           <div class="col-12">
             <label class="form-label">Password <span class="text-danger">*</span></label>

app/login/verify.php

@@ -15,10 +15,13 @@
     }
 
     // ── Look up token ─────────────────────────────────────────────
+    // license='owner' guard: invited users also have verify_token set, but they
+    // must use invited_onboarding.php — never this flow.
     $sth = $pdo1->prepare("
         SELECT user_id, name, status, verify_expires_at
         FROM user
         WHERE verify_token = :token
+          AND license      = 'owner'
         LIMIT 1
     ");
     $sth->execute([':token' => $token]);