Improve session init and timeout handling

bbbeasy-backend/app/config/access.ini

@@ -49,10 +49,9 @@ allow GET  @settings_collect            = *
 allow PUT    @recording_publish        = *
 allow POST @settings_save_logo          = *
 
-
+allow GET  @getuser   = *
 
 
-
 allow GET  @file               = *
 
 ; notification routes

bbbeasy-backend/app/config/routes.ini

@@ -59,10 +59,10 @@ GET @roles_permissions_collect : /api/roles-permissions = Actions\RolesPermissio
 
 ; users routes
 GET     @users_index    : /api/users                 = Actions\Users\Index->show
+GET     @users_getuser    : /api/getuser                 = Actions\Users\Edit->getuser
 POST    @users_add      : /api/users                 = Actions\Users\Add->save
 PUT     @users_edit     : /api/users/@id             = Actions\Users\Edit->save
 DELETE  @user_delete    : /api/users/@id             = Actions\Users\Delete->execute
-
 ; presets routes
 GET     @presets_index              : /api/presets/@user_id             = Actions\Presets\Index->show
 POST    @presets_add                : /api/presets                      = Actions\Presets\Add->save

bbbeasy-backend/app/src/Actions/Account/Login.php

@@ -94,22 +94,22 @@ private function login($email, $password, $errorMessage): void
             --$user->password_attempts;
             $user->save();
             $this->logger->error($errorMessage, ['email' => $email]);
-            $this->renderJson(['message' => 'Invalid credentials provided, try again'], ResponseCode::HTTP_BAD_REQUEST);
+            $this->renderJson(['message' => 'Invalid credentials provided, try again'], ResponseCode::HTTP_OK);
         } elseif ($user->valid() && 0 === $user->password_attempts || 1 === $user->password_attempts) {
             $user->password_attempts = 0;
             $user->status            = UserStatus::INACTIVE;
             $user->save();
             $this->logger->error($errorMessage, ['email' => $email]);
-            $this->renderJson(['message' => 'Your account has been locked because you have reached the maximum number of invalid sign-in attempts. You can contact the administrator or click here to receive an email containing instructions on how to unlock your account'], ResponseCode::HTTP_BAD_REQUEST);
+            $this->renderJson(['message' => 'Your account has been locked because you have reached the maximum number of invalid sign-in attempts. You can contact the administrator or click here to receive an email containing instructions on how to unlock your account'], ResponseCode::HTTP_OK);
         } elseif ($user->valid() && (UserStatus::PENDING === $user->status || UserStatus::INACTIVE === $user->status)) {
             $this->logger->error($errorMessage, ['email' => $email]);
-            $this->renderJson(['message' => 'Your account is not active. Please contact your administrator'], ResponseCode::HTTP_BAD_REQUEST);
+            $this->renderJson(['message' => 'Your account is not active. Please contact your administrator'], ResponseCode::HTTP_OK);
         } elseif ($user->valid() && UserStatus::DELETED === $user->status) {
             $this->logger->error($errorMessage, ['email' => $email]);
-            $this->renderJson(['message' => 'Your account has been disabled for violating our terms'], ResponseCode::HTTP_BAD_REQUEST);
+            $this->renderJson(['message' => 'Your account has been disabled for violating our terms'], ResponseCode::HTTP_OK);
         } elseif (!$user->valid()) {
             $this->logger->error($errorMessage, ['email' => $email]);
-            $this->renderJson(['message' => 'Invalid credentials provided, try again'], ResponseCode::HTTP_BAD_REQUEST);
+            $this->renderJson(['message' => 'Invalid credentials provided, try again'], ResponseCode::HTTP_OK);
         }
     }
 }

bbbeasy-backend/app/src/Actions/Base.php

@@ -111,6 +111,15 @@ public function __construct()
 
     public function beforeroute(): void
     {
+
+
+    if($this->session->isLoggedIn()&&!$this->session->getSession(session_id())){
+
+     $this->session->revokeUser();
+
+     $this->f3->error(401);
+       die();
+    }
         $this->access->authorize($this->getRole(), function($route, $subject): void {
             $this->onAccessAuthorizeDeny($route, $subject);
         });
@@ -125,12 +134,15 @@ public function beforeroute(): void
             $uri = preg_replace('/\/' . $this->f3->get('PARAMS.page') . '$/', '/1', $uri);
             $this->f3->reroute($uri);
         }
+
     }
 
     public function onAccessAuthorizeDeny($route, $subject): void
     {
         $this->logger->warning('Access denied to route ' . $route . ' for subject ' . ($subject ?: 'unknown'));
-        $this->f3->error(404);
+   		$this->session->revokeUser();
+        $this->f3->error(401);
+       die();
     }
 
     /**

bbbeasy-backend/app/src/Actions/Roles/Add.php

@@ -35,7 +35,27 @@
 class Add extends BaseAction
 {
     use RequirePrivilegeTrait;
-
+    public function beforeroute(): void
+    {
+        if ( null === $this->session->get('user')) {
+            $this->logger->warning('Access denied to route ');
+            $this->f3->error(401);
+        }
+        else{
+            $user  = new User();
+            $user_id   = $this->session->get('user.id');
+
+            $Infos=$user->getById($user_id);
+
+            $permissions =  $Infos->role->getRolePermissions();
+
+            if(!is_array($permissions)||!isset($permissions['roles'])){
+                $this->logger->warning('Access denied to route ');
+                $this->f3->error(401);
+            }
+
+        }
+    }
     /**
      * @param mixed $f3
      * @param mixed $params

bbbeasy-backend/app/src/Actions/Roles/Delete.php

@@ -31,6 +31,26 @@
 class Delete extends DeleteAction
 {
     use RequirePrivilegeTrait;
-
+    public function beforeroute(): void
+    {
+        if ( null === $this->session->get('user')) {
+            $this->logger->warning('Access denied to route ');
+            $this->f3->error(401);
+        }
+        else{
+            $user  = new User();
+            $user_id   = $this->session->get('user.id');
+
+            $Infos=$user->getById($user_id);
+
+            $permissions =  $Infos->role->getRolePermissions();
+
+            if(!is_array($permissions)||!isset($permissions['roles'])){
+                $this->logger->warning('Access denied to route ');
+                $this->f3->error(401);
+            }
+
+        }
+    }
     protected $deleteMethodName = 'delete';
 }

bbbeasy-backend/app/src/Actions/Roles/Edit.php

@@ -36,7 +36,27 @@
 class Edit extends BaseAction
 {
     use RequirePrivilegeTrait;
-
+    public function beforeroute(): void
+    {
+        if ( null === $this->session->get('user')) {
+            $this->logger->warning('Access denied to route ');
+            $this->f3->error(401);
+        }
+        else{
+            $user  = new User();
+            $user_id   = $this->session->get('user.id');
+
+            $Infos=$user->getById($user_id);
+
+            $permissions =  $Infos->role->getRolePermissions();
+
+            if(!is_array($permissions)||!isset($permissions['roles'])){
+                $this->logger->warning('Access denied to route ');
+                $this->f3->error(401);
+            }
+
+        }
+    }
     /**
      * @param mixed $f3
      * @param mixed $params

bbbeasy-backend/app/src/Actions/Roles/Index.php

@@ -25,14 +25,34 @@
 use Actions\Base as BaseAction;
 use Actions\RequirePrivilegeTrait;
 use Models\Role;
-
+use Models\User;
 /**
  * Class Index.
  */
 class Index extends BaseAction
 {
     use RequirePrivilegeTrait;
-
+    public function beforeroute(): void
+    {
+        if ( null === $this->session->get('user')) {
+            $this->logger->warning('Access denied to route ');
+            $this->f3->error(401);
+        }
+        else{
+            $user  = new User();
+            $user_id   = $this->session->get('user.id');
+
+            $Infos=$user->getById($user_id);
+
+            $permissions =  $Infos->role->getRolePermissions();
+
+            if(!is_array($permissions)||!isset($permissions['roles'])){
+                $this->logger->warning('Access denied to route ');
+                $this->f3->error(401);
+            }
+
+        }
+    }
     /**
      * @param mixed $f3
      * @param mixed $params

bbbeasy-backend/app/src/Actions/Users/Add.php

@@ -36,7 +36,27 @@
 class Add extends BaseAction
 {
     use RequirePrivilegeTrait;
-
+    public function beforeroute(): void
+    {
+        if ( null === $this->session->get('user')) {
+            $this->logger->warning('Access denied to route ');
+            $this->f3->error(401);
+        }
+        else{
+            $user  = new User();
+            $user_id   = $this->session->get('user.id');
+
+            $Infos=$user->getById($user_id);
+
+            $permissions =  $Infos->role->getRolePermissions();
+
+            if(!is_array($permissions)||!isset($permissions['users'])){
+                $this->logger->warning('Access denied to route ');
+                $this->f3->error(401);
+            }
+
+        }
+    }
     /**
      * @param \Base $f3
      * @param array $params

bbbeasy-backend/app/src/Actions/Users/Delete.php

@@ -31,6 +31,26 @@
 class Delete extends DeleteAction
 {
     use RequirePrivilegeTrait;
-
+    public function beforeroute(): void
+    {
+        if ( null === $this->session->get('user')) {
+            $this->logger->warning('Access denied to route ');
+            $this->f3->error(401);
+        }
+        else{
+            $user  = new User();
+            $user_id   = $this->session->get('user.id');
+
+            $Infos=$user->getById($user_id);
+
+            $permissions =  $Infos->role->getRolePermissions();
+
+            if(!is_array($permissions)||!isset($permissions['users'])){
+                $this->logger->warning('Access denied to route ');
+                $this->f3->error(401);
+            }
+
+        }
+    }
     protected $deleteMethodName = 'delete';
 }

bbbeasy-backend/app/src/Actions/Users/Edit.php

@@ -29,14 +29,34 @@
 use Models\User;
 use Respect\Validation\Validator;
 use Validation\DataChecker;
-
+use Models\UserSession;
 /**
  * Class Edit.
  */
 class Edit extends BaseAction
 {
     use RequirePrivilegeTrait;
-
+    public function beforeroute(): void
+    {
+        if ( null === $this->session->get('user')) {
+            $this->logger->warning('Access denied to route ');
+            $this->f3->error(401);
+        }
+        else{
+            $user  = new User();
+            $user_id   = $this->session->get('user.id');
+
+            $Infos=$user->getById($user_id);
+
+            $permissions =  $Infos->role->getRolePermissions();
+
+            /*if(!is_array($permissions)||!isset($permissions['users'])){
+                $this->logger->warning('Access denied to route ');
+                $this->f3->error(401);
+            }*/
+
+        }
+    }
     /**
      * @param \Base $f3
      * @param array $params
@@ -125,4 +145,28 @@ public function loadData($id): User
 
         return $user;
     }
+    public function getuser($f3, $params) 
+    {
+
+        $user  = new User();
+        $user_id   = $this->session->get('user.id');
+
+        $Infos=$user->getById($user_id);
+
+        $userInfos = [
+            'id'          => $Infos->id,
+            'username'    => $Infos->username,
+            'email'       => $Infos->email,
+            'role'        => $Infos->role->name,
+            'avatar'      => $Infos->avatar,
+            'permissions' => $Infos->role->getRolePermissions(),
+        ];
+        $userSession  = new UserSession();
+        $sessionInfos = [
+            'PHPSESSID' => session_id(),
+            'expires'   => $userSession->getSessionExpirationTime(session_id()),
+        ];
+
+        $this->renderJson(['user' => $userInfos, 'session' => $sessionInfos]);
+    }
 }

bbbeasy-backend/app/src/Actions/Users/Index.php

@@ -33,7 +33,27 @@
 class Index extends BaseAction
 {
     use RequirePrivilegeTrait;
-
+    public function beforeroute(): void
+    {
+        if ( null === $this->session->get('user')) {
+            $this->logger->warning('Access denied to route ');
+            $this->f3->error(401);
+        }
+        else{
+            $user  = new User();
+            $user_id   = $this->session->get('user.id');
+
+            $Infos=$user->getById($user_id);
+
+            $permissions =  $Infos->role->getRolePermissions();
+
+            if(!is_array($permissions)||!isset($permissions['users'])){
+                $this->logger->warning('Access denied to route ');
+                $this->f3->error(401);
+            }
+
+        }
+    }
     /**
      * @param \Base $f3
      * @param array $params
@@ -49,4 +69,5 @@ public function show($f3, $params): void
         $this->logger->debug('collecting users', ['users' => json_encode($users)]);
         $this->renderJson(['users' => $users, 'states' => $states]);
     }
+
 }

bbbeasy-backend/app/src/Core/Session.php

@@ -54,6 +54,7 @@ class Session extends \Prefab
      */
     public function __construct(SQL $db = null, $table = 'sessions', $force = false, $onsuspect = null, $key = null)
     {
+    $this->db = $db ?: \Registry::get('db');
         $this->f3 = \Base::instance();
         $this->initLogger();
         if ('CACHE' === $table) {
@@ -99,7 +100,18 @@ public function set($key, $value): void
         $this->f3->set('SESSION.' . $key, $value);
         $this->f3->sync('SESSION');
     }
+    public function getSession($sessionId)
+    {
+
+         $result  = $this->db->exec('SELECT expires FROM users_sessions where session_id = :session', [':session' => $sessionId]);
+
+
+        if (count($result)<1) {
+            return false;
+        }
 
+        return true;
+    }
     /**
      * @param mixed $key
      *