diff --git a/.gitignore b/.gitignore index 46ac4fb..0b74843 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ -config/database.php \ No newline at end of file +config/database.php +webhook.log \ No newline at end of file diff --git a/config/database.example.php b/config/database.example.php index ffc1d3f..ec306c8 100644 --- a/config/database.example.php +++ b/config/database.example.php @@ -7,6 +7,8 @@ class Database { private $username = "VOTRE_USER"; // N'utilisez par "root" private $password = "VOTRE_MDP"; public $jwt_secret = "VOTRE_CLE_SECRETE_POUR_JWT"; // Une passphrase est préférable + public $tmdb_api_key = "VOTRE_CLE_API_TMDB_V3"; + public $webhook_secret = "VOTRE_SECRET_WEBHOOK"; // Doit matcher le "Secret" configuré côté GitHub, ex: openssl rand -hex 32 public $conn; // Récupérer la connexion diff --git a/controllers/MovieController.php b/controllers/MovieController.php index 7960d46..194ff24 100644 --- a/controllers/MovieController.php +++ b/controllers/MovieController.php @@ -42,9 +42,29 @@ class MovieController { // 3. On renvoie le JSON echo json_encode([ - "success" => true, - "partner_id" => $realPartnerId, + "success" => true, + "partner_id" => $realPartnerId, "lists" => $lists ]); } + + public function remove($data) { + if (!isset($data['movie_id'])) { + http_response_code(400); + echo json_encode(["error" => "ID du film manquant"]); + return; + } + $res = $this->movieModel->remove($data['movie_id'], $data['user_id']); + echo json_encode(["success" => $res]); + } + + public function markWatched($data) { + if (!isset($data['movie_id'])) { + http_response_code(400); + echo json_encode(["error" => "ID du film manquant"]); + return; + } + $res = $this->movieModel->markWatched($data['movie_id'], $data['user_id']); + echo json_encode(["success" => $res]); + } } \ No newline at end of file diff --git a/controllers/TmdbController.php b/controllers/TmdbController.php new file mode 100644 index 0000000..6193015 --- /dev/null +++ b/controllers/TmdbController.php @@ -0,0 +1,61 @@ +apiKey = $apiKey; + } + + private function fetch($endpoint, $params = []) { + $params['api_key'] = $this->apiKey; + $url = $this->baseUrl . $endpoint . '?' . http_build_query($params); + + $ch = curl_init($url); + curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); + curl_setopt($ch, CURLOPT_TIMEOUT, 10); + $response = curl_exec($ch); + $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE) ?: 502; + curl_close($ch); + + return ['code' => $httpCode, 'body' => $response ?: json_encode(["error" => "TMDB injoignable"])]; + } + + public function search($data) { + $query = trim($data['query'] ?? ''); + if ($query === '') { + http_response_code(400); + echo json_encode(["error" => "Paramètre 'query' manquant"]); + return; + } + + $result = $this->fetch('/search/movie', [ + 'query' => $query, + 'language' => 'fr-FR', + 'page' => 1 + ]); + + http_response_code($result['code']); + echo $result['body']; + } + + public function details($data) { + $id = $data['id'] ?? null; + if (!$id || !ctype_digit((string)$id)) { + http_response_code(400); + echo json_encode(["error" => "ID de film invalide"]); + return; + } + + $result = $this->fetch("/movie/{$id}", [ + 'language' => 'fr-FR', + 'append_to_response' => 'credits' + ]); + + http_response_code($result['code']); + echo $result['body']; + } +} diff --git a/index.php b/index.php index dfaafaf..0c4fd9e 100644 --- a/index.php +++ b/index.php @@ -22,6 +22,7 @@ require_once __DIR__ . '/config/database.php'; require_once __DIR__ . '/controllers/UserController.php'; require_once __DIR__ . '/utils/JWT.php'; require_once __DIR__ . '/controllers/MovieController.php'; +require_once __DIR__ . '/controllers/TmdbController.php'; // Initialisation de la BDD et du contrôleur $database = new Database(); @@ -30,6 +31,7 @@ $jwt_secret = $database->jwt_secret; $userController = new UserController($db, $jwt_secret); $movieController = new MovieController($db); +$tmdbController = new TmdbController($database->tmdb_api_key); // On récupère la route épurée (ex: si on tape /register, $route vaudra 'register') $request_uri = explode('?', $_SERVER['REQUEST_URI'], 2)[0]; @@ -133,6 +135,20 @@ switch ($route) { } else { http_response_code(405); } break; + case 'tmdb-search': + if ($method === 'POST') { + getAuthenticatedUserId($jwt_secret); // On exige juste un token valide, pas d'usage anonyme du quota TMDB + $tmdbController->search($data); + } else { http_response_code(405); } + break; + + case 'tmdb-details': + if ($method === 'POST') { + getAuthenticatedUserId($jwt_secret); + $tmdbController->details($data); + } else { http_response_code(405); } + break; + default: http_response_code(404); echo json_encode(["error" => "Route /" . $route . " non trouvée"]); diff --git a/models/User.php b/models/User.php index ff2f4d1..bc7e491 100644 --- a/models/User.php +++ b/models/User.php @@ -120,8 +120,6 @@ class User { "); $stmt->execute([$current_user_id, $partner_id]); - return ["success" => true]; - $this->conn->commit(); return ["success" => true, "message" => "Comptes liés avec succès !"]; diff --git a/webhook.php b/webhook.php index 57e9ee1..b192ade 100755 --- a/webhook.php +++ b/webhook.php @@ -1,6 +1,28 @@ webhook_secret; + +$payload = file_get_contents('php://input'); +$signatureHeader = $_SERVER['HTTP_X_HUB_SIGNATURE_256'] ?? ''; +$expectedSignature = 'sha256=' . hash_hmac('sha256', $payload, $secret); + +// Comparaison en temps constant pour éviter les attaques par timing +if (!$signatureHeader || !hash_equals($expectedSignature, $signatureHeader)) { + http_response_code(403); + file_put_contents('webhook.log', date('Y-m-d H:i:s') . " - Tentative refusée (signature invalide)\n", FILE_APPEND); + exit('Forbidden'); +} // On récupère les modifs et on force l'écrasement pour éviter les conflits $output = shell_exec('git fetch origin && git reset --hard origin/main 2>&1'); @@ -9,4 +31,3 @@ $output = shell_exec('git fetch origin && git reset --hard origin/main 2>&1'); file_put_contents('webhook.log', date('Y-m-d H:i:s') . "\n" . $output . "\n---\n", FILE_APPEND); echo "Sync done."; -?>