File Manager

✏️ Edit File: /home/u625410797/domains/monothailand.com/public_html/smart_panel/api/v1/auth/login.php

<?php
/**
 * User Login Endpoint
 *
 * POST /api/v1/auth/login.php
 * Authenticates user with email and password, returns JWT tokens
 *
 * @package Smart_Panel\API\Auth
 * @version 1.0.0
 */

require_once '../../../config.php';
require_once '../../../core/PasswordHasher.php';
require_once '../../../core/JWTHandler.php';
require_once '../../../core/AuditLogger.php';

// Only accept POST requests
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    Response::error(405, "Method Not Allowed", "Only POST requests are accepted");
}

// Get JSON input
$input = json_decode(file_get_contents('php://input'), true);

// Validate required fields
$email = $input['email'] ?? '';
$password = $input['password'] ?? '';

if (empty($email) || empty($password)) {
    Response::error(400, "Bad Request", "Email and password are required");
}

// Rate limiting (5 attempts per 5 minutes)
$rateLimitKey = 'login_' . $_SERVER['REMOTE_ADDR'] . '_' . $email;
if (!Security::checkRateLimit($rateLimitKey, 5, 300)) {
    Response::error(429, "Too Many Requests", "Too many login attempts. Please try again in 5 minutes.");
}

try {
    // Find user by email
    $stmt = $pdo->prepare("
        SELECT id, email, display_name, password_hash,
               role, access_level, failed_login_attempts,
               account_locked_until, status, created_at
        FROM users
        WHERE email = ?
    ");

$stmt->execute([$email]);
    $user = $stmt->fetch();

if (!$user) {
        // Don't reveal if email exists
        Response::error(401, "Unauthorized", "Invalid email or password");
    }

// Check Account Status
    if (($user['status'] ?? 'active') !== 'active') {
        Response::error(403, "Forbidden", "Account is " . ($user['status'] ?: 'inactive') . ". Please contact system administrator.");
    }

// Verify password
    $hasher = new PasswordHasher();
    if (!$hasher->verify($password, $user['password_hash'])) {
        // Increment failed attempts
        $failedAttempts = ($user['failed_login_attempts'] ?? 0) + 1;

// Lock account after 5 failed attempts (15 minutes lockout)
        if ($failedAttempts >= 5) {
            $lockoutTime = date('Y-m-d H:i:s', time() + 900); // 15 minutes
            $stmt = $pdo->prepare("
                UPDATE users
                SET failed_login_attempts = ?,
                    account_locked_until = ?
                WHERE id = ?
            ");
            $stmt->execute([$failedAttempts, $lockoutTime, $user['id']]);

Response::error(403, "Forbidden", "Too many failed attempts. Account locked for 15 minutes.");
        } else {
            $stmt = $pdo->prepare("
                UPDATE users
                SET failed_login_attempts = ?
                WHERE id = ?
            ");
            $stmt->execute([$failedAttempts, $user['id']]);
        }

Response::error(401, "Unauthorized", "Invalid email or password");
    }

// Reset failed attempts on successful login
    $stmt = $pdo->prepare("
        UPDATE users
        SET failed_login_attempts = 0,
            account_locked_until = NULL,
            last_login = NOW()
        WHERE id = ?
    ");
    $stmt->execute([$user['id']]);

// [GOD MODE AUDIT] Track successful login
    $logger = new AuditLogger();
    $logger->logAuth($user['id'], true, "Successful authentication via v1/auth/login");

// Generate JWT tokens
    $jwt = new JWTHandler();

$payload = [
        'user_id' => $user['id'],
        'id' => $user['id'], // Alias
        'email' => $user['email'],
        'role' => $user['role']
    ];

$accessToken = $jwt->generateAccessToken($payload);
    $refreshToken = $jwt->generateRefreshToken($user['id']);

// Avoid updating users table with refresh_token logic (V13 schema constraint)
    $refreshTokenExpiry = date('Y-m-d H:i:s', time() + $jwt->getTokenExpiry('refresh'));

// Create session record
    $sessionId = bin2hex(random_bytes(18));
    $deviceFingerprint = $_SERVER['HTTP_USER_AGENT'] ?? 'unknown';

$stmt = $pdo->prepare("
        INSERT INTO user_sessions (
            id, user_id, device_fingerprint, refresh_token, expires_at, created_at
        ) VALUES (?, ?, ?, ?, ?, NOW())
    ");

$stmt->execute([
        $sessionId,
        $user['id'],
        substr($deviceFingerprint, 0, 255),
        $refreshToken,
        $refreshTokenExpiry
    ]);

// Check password age (90 days rotation policy)
    $passwordUpdatedAt = isset($user['created_at']) ? strtotime($user['created_at']) : 0;
    $passwordAgeDays = (time() - $passwordUpdatedAt) / (60 * 60 * 24);
    $rotationRequired = ($passwordAgeDays >= 90);

// Return success with tokens
    Response::success([
        'user' => [
            'id' => $user['id'],
            'email' => $user['email'],
            'display_name' => $user['display_name'],
            'role' => $user['role'],
            'access_level' => (int)$user['access_level'],
            'rotation_required' => $rotationRequired
        ],
        'tokens' => [
            'access_token' => $accessToken,
            'refresh_token' => $refreshToken,
            'expires_in' => $jwt->getTokenExpiry('access'),
            'token_type' => 'Bearer'
        ]
    ], "Login successful");

} catch (PDOException $e) {
    error_log("Login Error: " . $e->getMessage());
    Response::error(500, "Internal Server Error", "Login failed. Please try again.");
}

Batal

⬅ Naik ke v1 6 item

Nama	Tipe	Ukuran	Diubah	Aksi
🐘forgot_password.php	php	3.1 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘login.php	php	5.5 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘logout.php	php	1.7 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘refresh_token.php	php	3.7 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘register.php	php	4.2 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘reset_password.php	php	2.4 KB	2026-04-30 09:54	✏️ Edit 👁️ View