Fix: Convert 03PovertyMapping from submodule to regular folder

2026-06-10 19:36:55 +07:00
parent 1a9534757e
commit aed321d490
42 changed files with 11130 additions and 1 deletions
@@ -0,0 +1,95 @@
+<?php
+// ============================================================
+// api/auth/check.php — Session check & login/logout
+//
+// GET  /api/auth/check.php              → check session
+// POST /api/auth/check.php?action=login → login
+// POST /api/auth/check.php?action=logout→ logout
+// ============================================================
+declare(strict_types=1);
+require_once __DIR__ . '/../../config/bootstrap.php';
+
+$method = $_SERVER['REQUEST_METHOD'] ?? 'CLI';
+$action = $_GET['action'] ?? 'check';
+
+// ================================================================
+// CHECK — return current session state
+// ================================================================
+if ($method === 'GET' || $action === 'check') {
+    if (!empty($_SESSION['user_id']) && !empty($_SESSION['role'])) {
+        Response::success([
+            'logged_in' => true,
+            'user_id'   => (int)$_SESSION['user_id'],
+            'name'      => $_SESSION['name']  ?? '',
+            'email'     => $_SESSION['email'] ?? '',
+            'role'      => $_SESSION['role'],
+        ]);
+    } else {
+        Response::success(['logged_in' => false]);
+    }
+}
+
+// ================================================================
+// LOGIN
+// ================================================================
+if ($method === 'POST' && $action === 'login') {
+    $data = Validator::json();
+    $v    = Validator::make($data, [
+        'email'    => 'required',
+        'password' => 'required',
+    ]);
+    $v->validate_or_fail();
+
+    $pdo  = Database::get();
+    $stmt = $pdo->prepare(
+        'SELECT id, name, email, password_hash, role, is_active FROM users WHERE email = ? LIMIT 1'
+    );
+    $stmt->execute([strtolower(trim($data['email']))]);
+    $user = $stmt->fetch();
+
+    if (!$user || !$user['is_active']) {
+        AuditLog::record('auth.login_failed', 'users', null, null, ['email' => $data['email']]);
+        Response::error('Username atau password salah.', 401);
+    }
+
+    if (!password_verify($data['password'], $user['password_hash'])) {
+        AuditLog::record('auth.login_failed', 'users', null, null, ['email' => $data['email']]);
+        Response::error('Username atau password salah.', 401);
+    }
+
+    // Regenerate session ID to prevent fixation
+    session_regenerate_id(true);
+
+    $_SESSION['user_id'] = $user['id'];
+    $_SESSION['name']    = $user['name'];
+    $_SESSION['email']   = $user['email'];
+    $_SESSION['role']    = $user['role'];
+
+    // Update last_login_at
+    try {
+        $pdo->prepare('UPDATE users SET last_login_at = NOW() WHERE id = ?')
+            ->execute([$user['id']]);
+    } catch (\Throwable) {}
+
+    AuditLog::record('auth.login', 'users', (int)$user['id']);
+
+    Response::success([
+        'user_id' => (int)$user['id'],
+        'name'    => $user['name'],
+        'email'   => $user['email'],
+        'role'    => $user['role'],
+    ], 'Login berhasil.');
+}
+
+// ================================================================
+// LOGOUT
+// ================================================================
+if ($method === 'POST' && $action === 'logout') {
+    $userId = $_SESSION['user_id'] ?? null;
+    AuditLog::record('auth.logout', 'users', $userId ? (int)$userId : null);
+    $_SESSION = [];
+    session_destroy();
+    Response::success(null, 'Logout berhasil.');
+}
+
+Response::methodNotAllowed();