Whykioh/watchgether-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add JWT to enhance security

Browse Source
This commit is contained in:
Noah CIBOT NOËL
2026-07-11 09:28:49 +02:00
parent d7328ae9d3
commit 717dbd25b3
4 changed files with 116 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
index.php
+41 -27
View File
@@ -16,11 +16,14 @@ if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {
// --- CONFIGURATION ---
require_once __DIR__ . '/config/database.php';
require_once __DIR__ . '/controllers/UserController.php';
require_once __DIR__ . '/utils/JWT.php';
// Initialisation de la BDD et du contrôleur
$database = new Database();
$db = $database->getConnection();
$userController = new UserController($db);
$jwt_secret = $database->jwt_secret;
$userController = new UserController($db, $jwt_secret);
// On récupère la route épurée (ex: si on tape /register, $route vaudra 'register')
$request_uri = explode('?', $_SERVER['REQUEST_URI'], 2)[0];
@@ -30,52 +33,63 @@ $method = $_SERVER['REQUEST_METHOD'];
// Récupération des données JSON reçues (ex: les credentials d'inscription)
$data = json_decode(file_get_contents('php://input'), true) ?? [];
// --- FONCTION DE SÉCURISATION DES ROUTES ---
function getAuthenticatedUserId($secret) {
$headers = apache_request_headers();
// On gère les différentes casses possibles pour le header Authorization
$authHeader = $headers['Authorization'] ?? $headers['authorization'] ?? null;
if (!$authHeader || !preg_match('/Bearer\s(\S+)/', $authHeader, $matches)) {
http_response_code(401);
echo json_encode(["error" => "Accès refusé. Token manquant."]);
exit();
}
$token = $matches[1];
$decoded = JWT::validate($token, $secret);
if (!$decoded) {
http_response_code(401);
echo json_encode(["error" => "Session expirée ou token invalide."]);
exit();
}
return $decoded['user_id']; // Retourne le vrai user_id extrait du token
}
// --- ROUTEUR ---
switch ($route) {
case 'register':
if ($method === 'POST') {
$userController->register($data);
} else {
http_response_code(405);
echo json_encode(["error" => "Méthode non autorisée (POST requis)"]);
}
if ($method === 'POST') $userController->register($data);
else http_response_code(405);
break;
case 'login':
if ($method === 'POST') {
$userController->login($data);
} else {
http_response_code(405);
echo json_encode(["error" => "Méthode non autorisée (POST requis)"]);
}
if ($method === 'POST') $userController->login($data);
else http_response_code(405);
break;
// --- TOUTES LES ROUTES CI-DESSOUS DEVIENNENT SÉCURISÉES ---
case 'link-partner':
if ($method === 'POST') {
$data['user_id'] = getAuthenticatedUserId($jwt_secret); // Plus besoin d'envoyer user_id en clair, le token le donne !
$userController->link($data);
} else {
http_response_code(405);
echo json_encode(["error" => "Méthode non autorisée (POST requis)"]);
}
} else { http_response_code(405); }
break;
case 'pairing-status':
if ($method === 'POST') { // On utilise POST temporairement pour lire le user_id dans le JSON
if ($method === 'POST') {
$data['user_id'] = getAuthenticatedUserId($jwt_secret);
$userController->pairingStatus($data);
} else {
http_response_code(405);
echo json_encode(["error" => "Méthode non autorisée (POST requis)"]);
}
} else { http_response_code(405); }
break;
case 'unlink-partner':
if ($method === 'POST') {
$data['user_id'] = getAuthenticatedUserId($jwt_secret);
$userController->unlink($data);
} else {
http_response_code(405);
echo json_encode(["error" => "Méthode non autorisée (POST requis)"]);
}
} else { http_response_code(405); }
break;
default: