409 lines
12 KiB
PHP
409 lines
12 KiB
PHP
<?php
|
|
/**
|
|
* Authentication Middleware for MSAL / Azure AD
|
|
* Central authentication orchestrator with login UI
|
|
*/
|
|
|
|
require_once __DIR__ . '/config.php';
|
|
|
|
class AuthMiddleware {
|
|
private $validator;
|
|
private $tenantId;
|
|
private $clientId;
|
|
private $ssoEnabled;
|
|
|
|
public function __construct() {
|
|
$this->ssoEnabled = SSO_ENABLED;
|
|
$this->tenantId = SSO_TENANT_ID;
|
|
$this->clientId = SSO_CLIENT_ID;
|
|
|
|
// Only initialize validator if SSO is enabled
|
|
if ($this->ssoEnabled) {
|
|
require_once __DIR__ . '/JWTValidator.php';
|
|
$this->validator = new JWTValidator($this->tenantId, $this->clientId);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Check if SSO is enabled
|
|
*
|
|
* @return bool
|
|
*/
|
|
public function isSSOEnabled() {
|
|
return $this->ssoEnabled;
|
|
}
|
|
|
|
/**
|
|
* Check if user is authenticated
|
|
*
|
|
* @return array ['authenticated' => bool, 'user' => array|null, 'error' => string|null]
|
|
*/
|
|
public function isAuthenticated() {
|
|
// If SSO is disabled, return authenticated with mock user
|
|
if (!$this->ssoEnabled) {
|
|
return [
|
|
'authenticated' => true,
|
|
'user' => [
|
|
'name' => 'Local Developer',
|
|
'preferred_username' => 'dev@localhost'
|
|
]
|
|
];
|
|
}
|
|
|
|
// Get token from cookie
|
|
$token = $this->getTokenFromCookie();
|
|
if (!$token) {
|
|
return ['authenticated' => false, 'error' => 'No authentication token found'];
|
|
}
|
|
|
|
// Validate token
|
|
$validation = $this->validator->validateToken($token);
|
|
if (!$validation['valid']) {
|
|
return ['authenticated' => false, 'error' => $validation['error']];
|
|
}
|
|
|
|
return ['authenticated' => true, 'user' => $validation['payload']];
|
|
}
|
|
|
|
/**
|
|
* Require authentication - blocks if not authenticated
|
|
*
|
|
* @return array User data
|
|
*/
|
|
public function requireAuth() {
|
|
// If SSO is disabled, return mock user
|
|
if (!$this->ssoEnabled) {
|
|
return [
|
|
'name' => 'Local Developer',
|
|
'preferred_username' => 'dev@localhost'
|
|
];
|
|
}
|
|
|
|
// Check authentication
|
|
$auth = $this->isAuthenticated();
|
|
|
|
if (!$auth['authenticated']) {
|
|
$this->handleUnauthorized($auth['error'] ?? 'Authentication required');
|
|
exit;
|
|
}
|
|
|
|
return $auth['user'];
|
|
}
|
|
|
|
/**
|
|
* Set authentication token (after login)
|
|
*
|
|
* @param string $token JWT token from MSAL
|
|
* @return array ['success' => bool, 'user' => array|null, 'error' => string|null]
|
|
*/
|
|
public function setAuthToken($token) {
|
|
if (!$this->ssoEnabled) {
|
|
return ['success' => false, 'error' => 'SSO is disabled'];
|
|
}
|
|
|
|
// Validate token
|
|
$validation = $this->validator->validateToken($token);
|
|
if (!$validation['valid']) {
|
|
return ['success' => false, 'error' => $validation['error']];
|
|
}
|
|
|
|
// Set httpOnly cookie with security options
|
|
$cookieOptions = [
|
|
'expires' => time() + (24 * 60 * 60), // 24 hours
|
|
'path' => '/',
|
|
'domain' => '',
|
|
'secure' => isset($_SERVER['HTTPS']), // Only over HTTPS in production
|
|
'httponly' => true,
|
|
'samesite' => 'Lax'
|
|
];
|
|
|
|
setcookie('auth_token', $token, $cookieOptions);
|
|
|
|
return ['success' => true, 'user' => $validation['payload']];
|
|
}
|
|
|
|
/**
|
|
* Clear authentication token (logout)
|
|
*/
|
|
public function clearAuthToken() {
|
|
setcookie('auth_token', '', [
|
|
'expires' => time() - 3600,
|
|
'path' => '/',
|
|
'httponly' => true
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Get token from cookie
|
|
*
|
|
* @return string|null
|
|
*/
|
|
private function getTokenFromCookie() {
|
|
return isset($_COOKIE['auth_token']) ? $_COOKIE['auth_token'] : null;
|
|
}
|
|
|
|
/**
|
|
* Handle unauthorized access
|
|
*
|
|
* @param string $error Error message
|
|
*/
|
|
private function handleUnauthorized($error) {
|
|
if ($this->isAjaxRequest()) {
|
|
// For AJAX requests, return JSON
|
|
header('Content-Type: application/json');
|
|
http_response_code(401);
|
|
echo json_encode([
|
|
'error' => 'Authentication required',
|
|
'message' => $error,
|
|
'requiresAuth' => true
|
|
]);
|
|
} else {
|
|
// For page requests, show login interface
|
|
$this->showLoginPage($error);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Check if request is AJAX
|
|
*
|
|
* @return bool
|
|
*/
|
|
private function isAjaxRequest() {
|
|
return isset($_SERVER['HTTP_X_REQUESTED_WITH']) &&
|
|
strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest';
|
|
}
|
|
|
|
/**
|
|
* Show login page with MSAL integration
|
|
*
|
|
* @param string $error Optional error message
|
|
*/
|
|
public function showLoginPage($error = '') {
|
|
?>
|
|
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>Sign In - Nano Banana Pro</title>
|
|
<link rel="preconnect" href="https://fonts.googleapis.com">
|
|
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
|
|
<link href="https://fonts.googleapis.com/css2?family=Montserrat:wght@400;500;600;700&display=swap" rel="stylesheet">
|
|
<script src="https://alcdn.msauth.net/browser/2.15.0/js/msal-browser.min.js" crossorigin="anonymous"></script>
|
|
<style>
|
|
* {
|
|
margin: 0;
|
|
padding: 0;
|
|
box-sizing: border-box;
|
|
}
|
|
|
|
body {
|
|
font-family: 'Montserrat', sans-serif;
|
|
background: #000;
|
|
color: #fff;
|
|
min-height: 100vh;
|
|
display: flex;
|
|
align-items: center;
|
|
justify-content: center;
|
|
padding: 20px;
|
|
}
|
|
|
|
.login-container {
|
|
background: #1a1a1a;
|
|
border: 2px solid #FFC407;
|
|
border-radius: 12px;
|
|
padding: 50px 40px;
|
|
max-width: 450px;
|
|
width: 100%;
|
|
text-align: center;
|
|
box-shadow: 0 10px 50px rgba(255, 196, 7, 0.2);
|
|
}
|
|
|
|
.login-logo {
|
|
font-size: 4rem;
|
|
margin-bottom: 20px;
|
|
}
|
|
|
|
.login-title {
|
|
font-size: 2rem;
|
|
font-weight: 700;
|
|
color: #FFC407;
|
|
margin-bottom: 10px;
|
|
}
|
|
|
|
.login-subtitle {
|
|
font-size: 1rem;
|
|
color: #999;
|
|
margin-bottom: 40px;
|
|
}
|
|
|
|
.error-message {
|
|
background: #ff4444;
|
|
color: #fff;
|
|
padding: 15px;
|
|
border-radius: 8px;
|
|
margin-bottom: 20px;
|
|
font-size: 0.9rem;
|
|
}
|
|
|
|
.btn-login {
|
|
background: linear-gradient(135deg, #FFC407 0%, #ff9500 100%);
|
|
color: #000;
|
|
border: none;
|
|
padding: 18px 40px;
|
|
border-radius: 8px;
|
|
font-family: 'Montserrat', sans-serif;
|
|
font-weight: 700;
|
|
font-size: 1.1rem;
|
|
cursor: pointer;
|
|
transition: all 0.3s;
|
|
width: 100%;
|
|
display: flex;
|
|
align-items: center;
|
|
justify-content: center;
|
|
gap: 10px;
|
|
}
|
|
|
|
.btn-login:hover {
|
|
transform: translateY(-3px);
|
|
box-shadow: 0 5px 20px rgba(255, 196, 7, 0.4);
|
|
}
|
|
|
|
.btn-login:active {
|
|
transform: translateY(-1px);
|
|
}
|
|
|
|
.loading {
|
|
display: none;
|
|
}
|
|
|
|
.loading.show {
|
|
display: inline-block;
|
|
width: 20px;
|
|
height: 20px;
|
|
border: 3px solid #000;
|
|
border-top: 3px solid transparent;
|
|
border-radius: 50%;
|
|
animation: spin 1s linear infinite;
|
|
}
|
|
|
|
@keyframes spin {
|
|
0% { transform: rotate(0deg); }
|
|
100% { transform: rotate(360deg); }
|
|
}
|
|
|
|
.info-text {
|
|
margin-top: 30px;
|
|
font-size: 0.85rem;
|
|
color: #666;
|
|
}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<div class="login-container">
|
|
<div class="login-logo">🎨</div>
|
|
<h1 class="login-title">Nano Banana Pro</h1>
|
|
<p class="login-subtitle">AI Image Generation & Editing Tool</p>
|
|
|
|
<?php if ($error): ?>
|
|
<div class="error-message">
|
|
<?php echo htmlspecialchars($error); ?>
|
|
</div>
|
|
<?php endif; ?>
|
|
|
|
<button class="btn-login" onclick="signIn()" id="loginBtn">
|
|
<span id="lockIcon">🔒</span>
|
|
<span id="loadingIcon" class="loading"></span>
|
|
<span id="btnText">Sign In with Microsoft</span>
|
|
</button>
|
|
|
|
<div class="info-text">
|
|
Sign in with your Microsoft account to access the image generator
|
|
</div>
|
|
</div>
|
|
|
|
<script>
|
|
const msalConfig = {
|
|
auth: {
|
|
clientId: "<?php echo $this->clientId; ?>",
|
|
authority: "https://login.microsoftonline.com/<?php echo $this->tenantId; ?>",
|
|
redirectUri: window.location.origin + window.location.pathname
|
|
},
|
|
cache: {
|
|
cacheLocation: "sessionStorage",
|
|
storeAuthStateInCookie: true,
|
|
}
|
|
};
|
|
|
|
const loginRequest = {
|
|
scopes: ["openid", "profile", "email"],
|
|
prompt: "select_account"
|
|
};
|
|
|
|
const myMSALObj = new msal.PublicClientApplication(msalConfig);
|
|
|
|
function signIn() {
|
|
const loginBtn = document.getElementById('loginBtn');
|
|
const lockIcon = document.getElementById('lockIcon');
|
|
const loadingIcon = document.getElementById('loadingIcon');
|
|
const btnText = document.getElementById('btnText');
|
|
|
|
// Show loading state
|
|
loginBtn.disabled = true;
|
|
lockIcon.style.display = 'none';
|
|
loadingIcon.classList.add('show');
|
|
btnText.textContent = 'Signing in...';
|
|
|
|
myMSALObj.loginPopup(loginRequest)
|
|
.then(loginResponse => {
|
|
// Send token to server for validation and cookie setting
|
|
fetch('auth.php', {
|
|
method: 'POST',
|
|
headers: {
|
|
'Content-Type': 'application/json',
|
|
},
|
|
body: JSON.stringify({
|
|
action: 'login',
|
|
idToken: loginResponse.idToken,
|
|
accessToken: loginResponse.accessToken
|
|
})
|
|
})
|
|
.then(response => response.json())
|
|
.then(data => {
|
|
if (data.success) {
|
|
window.location.reload();
|
|
} else {
|
|
alert('Authentication failed: ' + (data.error || 'Unknown error'));
|
|
resetButton();
|
|
}
|
|
})
|
|
.catch(error => {
|
|
console.error('Authentication error:', error);
|
|
alert('Authentication failed. Please try again.');
|
|
resetButton();
|
|
});
|
|
})
|
|
.catch(error => {
|
|
console.error("Login failed:", error);
|
|
alert('Login failed: ' + error.message);
|
|
resetButton();
|
|
});
|
|
}
|
|
|
|
function resetButton() {
|
|
const loginBtn = document.getElementById('loginBtn');
|
|
const lockIcon = document.getElementById('lockIcon');
|
|
const loadingIcon = document.getElementById('loadingIcon');
|
|
const btnText = document.getElementById('btnText');
|
|
|
|
loginBtn.disabled = false;
|
|
lockIcon.style.display = 'inline';
|
|
loadingIcon.classList.remove('show');
|
|
btnText.textContent = 'Sign In with Microsoft';
|
|
}
|
|
</script>
|
|
</body>
|
|
</html>
|
|
<?php
|
|
}
|
|
}
|