257 lines
11 KiB
PHP
257 lines
11 KiB
PHP
<?php
|
||
|
||
/**
|
||
* PasswordManager
|
||
*
|
||
* Handles all password operations using zxcvbn-php for strength enforcement.
|
||
* Designed to be reused across:
|
||
* - Profile: change password (requires current password verification)
|
||
* - Login: forced password reset (no current password needed)
|
||
* - Future: forgot password / admin reset flows
|
||
*
|
||
* Usage:
|
||
* $pm = new PasswordManager($pdo1, $include_url);
|
||
*
|
||
* // Check strength only (for live UI feedback)
|
||
* $result = $pm->checkStrength('mypassword', ['john', 'john@example.com']);
|
||
*
|
||
* // Change password (profile page — verifies current password)
|
||
* $pm->change($user_id, $current_password, $new_password, $confirm_password);
|
||
*
|
||
* // Force set password (admin reset / login forced reset — no current password)
|
||
* $pm->forceSet($user_id, $new_password, $confirm_password);
|
||
*/
|
||
class PasswordManager {
|
||
|
||
private $pdo;
|
||
private $zxcvbn_path;
|
||
|
||
/** Minimum zxcvbn score required (0–4). 3 = "safely unguessable" */
|
||
const MIN_SCORE = 3;
|
||
|
||
public function __construct($pdo, string $include_url) {
|
||
$this->pdo = $pdo;
|
||
$this->zxcvbn_path = rtrim($include_url, '/') . '/assets/zxcvbn-php-master/vendor/autoload.php';
|
||
}
|
||
|
||
// ─────────────────────────────────────────────────────────────
|
||
// Public: strength check (used by live AJAX feedback endpoint)
|
||
// ─────────────────────────────────────────────────────────────
|
||
|
||
/**
|
||
* Run zxcvbn strength analysis.
|
||
*
|
||
* @param string $password
|
||
* @param array $user_inputs Personal data to penalise (name, email, username…)
|
||
* @return array ['score' => 0-4, 'warning' => string, 'suggestions' => array]
|
||
*/
|
||
public function checkStrength(string $password, array $user_inputs = []): array {
|
||
|
||
$this->loadZxcvbn();
|
||
|
||
$zxcvbn = new \ZxcvbnPhp\Zxcvbn();
|
||
$result = $zxcvbn->passwordStrength($password, $user_inputs);
|
||
|
||
return [
|
||
'score' => (int) $result['score'],
|
||
'warning' => $result['feedback']['warning'] ?? '',
|
||
'suggestions' => $result['feedback']['suggestions'] ?? [],
|
||
];
|
||
}
|
||
|
||
// ─────────────────────────────────────────────────────────────
|
||
// Public: change password (profile — verifies current password)
|
||
// ─────────────────────────────────────────────────────────────
|
||
|
||
/**
|
||
* Change password for an authenticated user.
|
||
* Verifies current password before applying the new one.
|
||
*
|
||
* @throws InvalidArgumentException on validation failure (safe to show user)
|
||
* @throws RuntimeException on DB failure (log internally, show generic message)
|
||
*/
|
||
public function change(int $user_id, string $current_password, string $new_password, string $confirm_password): void {
|
||
|
||
// ── Basic field validation ────────────────────────────────
|
||
if (empty($current_password) || empty($new_password) || empty($confirm_password)) {
|
||
throw new \InvalidArgumentException('All password fields are required.');
|
||
}
|
||
|
||
if ($new_password !== $confirm_password) {
|
||
throw new \InvalidArgumentException('New passwords do not match.');
|
||
}
|
||
|
||
// ── Load user record ──────────────────────────────────────
|
||
$user = $this->fetchUser($user_id);
|
||
|
||
// ── Verify current password ───────────────────────────────
|
||
if (!password_verify($current_password, $user['password'])) {
|
||
throw new \InvalidArgumentException('Current password is incorrect.');
|
||
}
|
||
|
||
// ── Strength check ────────────────────────────────────────
|
||
$this->enforceStrength($new_password, $user);
|
||
|
||
// ── Hash and persist ──────────────────────────────────────
|
||
$this->persist($user_id, $new_password);
|
||
}
|
||
|
||
// ─────────────────────────────────────────────────────────────
|
||
// Public: force set password (admin reset / login forced reset)
|
||
// ─────────────────────────────────────────────────────────────
|
||
|
||
/**
|
||
* Force-set a new password without requiring the current password.
|
||
* Use for: admin-initiated reset, forgot-password flow, first-login forced change.
|
||
*
|
||
* @throws InvalidArgumentException on validation failure
|
||
* @throws RuntimeException on DB failure
|
||
*/
|
||
public function forceSet(int $user_id, string $new_password, string $confirm_password): void {
|
||
|
||
if (empty($new_password) || empty($confirm_password)) {
|
||
throw new \InvalidArgumentException('Password fields are required.');
|
||
}
|
||
|
||
if ($new_password !== $confirm_password) {
|
||
throw new \InvalidArgumentException('Passwords do not match.');
|
||
}
|
||
|
||
$user = $this->fetchUser($user_id);
|
||
|
||
$this->enforceStrength($new_password, $user);
|
||
$this->persist($user_id, $new_password);
|
||
}
|
||
|
||
// ─────────────────────────────────────────────────────────────
|
||
// Public: HTTP handlers (call from thin API endpoint files)
|
||
// ─────────────────────────────────────────────────────────────
|
||
|
||
/**
|
||
* Handle AJAX strength-check request and echo JSON response.
|
||
* Endpoint: setting/api/engine/check_password.php
|
||
*
|
||
* Expected $data keys: password
|
||
*/
|
||
public function handleCheck(array $data): void {
|
||
|
||
$password = $data['password'] ?? '';
|
||
|
||
if (empty($password)) {
|
||
echo json_encode(['success' => 1, 'score' => -1, 'feedback' => '']);
|
||
exit;
|
||
}
|
||
|
||
$result = $this->checkStrength($password);
|
||
$feedback = $result['warning'] ?: ($result['suggestions'][0] ?? '');
|
||
|
||
echo json_encode([
|
||
'success' => 1,
|
||
'score' => $result['score'],
|
||
'feedback' => $feedback,
|
||
]);
|
||
exit;
|
||
}
|
||
|
||
/**
|
||
* Handle AJAX change-password request and echo JSON response.
|
||
* Endpoint: setting/api/engine/change_password.php
|
||
*
|
||
* Expected $data keys: current_password, new_password, confirm_password
|
||
*/
|
||
public function handleChange(int $user_id, array $data): void {
|
||
|
||
try {
|
||
|
||
$this->change(
|
||
$user_id,
|
||
$data['current_password'] ?? '',
|
||
$data['new_password'] ?? '',
|
||
$data['confirm_password'] ?? ''
|
||
);
|
||
|
||
session_destroy();
|
||
echo json_encode(['success' => 1, 'message' => 'Password changed successfully.']);
|
||
|
||
} catch (\InvalidArgumentException $e) {
|
||
http_response_code(400);
|
||
echo json_encode(['success' => 0, 'message' => $e->getMessage()]);
|
||
|
||
} catch (\Exception $e) {
|
||
error_log('[PasswordManager::handleChange] ' . $e->getMessage());
|
||
http_response_code(500);
|
||
echo json_encode(['success' => 0, 'message' => 'Failed to change password. Please try again.']);
|
||
}
|
||
|
||
exit;
|
||
}
|
||
|
||
// ─────────────────────────────────────────────────────────────
|
||
// Private helpers
|
||
// ─────────────────────────────────────────────────────────────
|
||
|
||
private function loadZxcvbn(): void {
|
||
if (!file_exists($this->zxcvbn_path)) {
|
||
throw new \RuntimeException('zxcvbn autoloader not found at: ' . $this->zxcvbn_path);
|
||
}
|
||
require_once $this->zxcvbn_path;
|
||
}
|
||
|
||
private function fetchUser(int $user_id): array {
|
||
$sth = $this->pdo->prepare(
|
||
'SELECT user_id, username, name, surname, email, password
|
||
FROM user WHERE user_id = :id LIMIT 1'
|
||
);
|
||
$sth->execute([':id' => $user_id]);
|
||
$user = $sth->fetch(\PDO::FETCH_ASSOC);
|
||
|
||
if (!$user) {
|
||
throw new \RuntimeException('User not found.');
|
||
}
|
||
|
||
return $user;
|
||
}
|
||
|
||
/**
|
||
* Run zxcvbn and throw if score is below MIN_SCORE.
|
||
* Passes personal fields so zxcvbn penalises name/email use.
|
||
*/
|
||
private function enforceStrength(string $password, array $user): void {
|
||
|
||
$user_inputs = array_values(array_filter([
|
||
$user['username'] ?? '',
|
||
$user['name'] ?? '',
|
||
$user['surname'] ?? '',
|
||
$user['email'] ?? '',
|
||
]));
|
||
|
||
$result = $this->checkStrength($password, $user_inputs);
|
||
|
||
if ($result['score'] < self::MIN_SCORE) {
|
||
$msg = $result['warning'] ?: ($result['suggestions'][0] ?? 'Please choose a stronger password.');
|
||
throw new \InvalidArgumentException('Password is too weak. ' . $msg);
|
||
}
|
||
}
|
||
|
||
/**
|
||
* Hash and write the new password to the DB.
|
||
* The OTP session will invalidate automatically on the next
|
||
* request because db_auth.php re-derives the OTP from the
|
||
* stored password hash — changing it forces re-login.
|
||
*/
|
||
private function persist(int $user_id, string $password): void {
|
||
$hashed = password_hash($password, PASSWORD_BCRYPT);
|
||
|
||
$sth = $this->pdo->prepare(
|
||
'UPDATE user SET password = :password WHERE user_id = :user_id'
|
||
);
|
||
$sth->execute([
|
||
':password' => $hashed,
|
||
':user_id' => $user_id,
|
||
]);
|
||
|
||
if ($sth->rowCount() === 0) {
|
||
throw new \RuntimeException('Password update failed — no rows affected.');
|
||
}
|
||
}
|
||
} |