L4zyL4mb
76 lines
2.6 KiB
PHP
76 lines
2.6 KiB
PHP
<?php
|
|
// api/auth.php v2.0
|
|
// ============================================================
|
|
// Login / Logout / Session Check API
|
|
// ============================================================
|
|
require_once __DIR__ . '/../includes/config.php';
|
|
session_start();
|
|
|
|
header('Content-Type: application/json; charset=utf-8');
|
|
header('Access-Control-Allow-Origin: *');
|
|
header('Access-Control-Allow-Methods: GET, POST, DELETE, OPTIONS');
|
|
header('Access-Control-Allow-Headers: Content-Type');
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') exit;
|
|
|
|
$method = $_SERVER['REQUEST_METHOD'];
|
|
$db = getDB();
|
|
|
|
switch ($method) {
|
|
|
|
// ── POST /api/auth.php → Login ─────────────────────────
|
|
case 'POST':
|
|
$input = getInput();
|
|
$username = trim($input['username'] ?? '');
|
|
$password = $input['password'] ?? '';
|
|
|
|
if (!$username || !$password) {
|
|
jsonResponse(['success' => false, 'error' => 'Username dan password wajib diisi'], 400);
|
|
}
|
|
|
|
$stmt = $db->prepare("SELECT * FROM users WHERE username = ? AND aktif = 1 LIMIT 1");
|
|
$stmt->execute([$username]);
|
|
$user = $stmt->fetch();
|
|
|
|
if (!$user || !password_verify($password, $user['password'])) {
|
|
jsonResponse(['success' => false, 'error' => 'Username atau password salah'], 401);
|
|
}
|
|
|
|
// Simpan ke session
|
|
$_SESSION['user_id'] = $user['id'];
|
|
$_SESSION['user'] = [
|
|
'id' => $user['id'],
|
|
'nama' => $user['nama'],
|
|
'username' => $user['username'],
|
|
'role' => $user['role'],
|
|
];
|
|
|
|
// Update last_login
|
|
$db->prepare("UPDATE users SET last_login = NOW() WHERE id = ?")
|
|
->execute([$user['id']]);
|
|
|
|
jsonResponse([
|
|
'success' => true,
|
|
'message' => 'Login berhasil',
|
|
'user' => $_SESSION['user'],
|
|
]);
|
|
break;
|
|
|
|
// ── DELETE /api/auth.php → Logout ─────────────────────
|
|
case 'DELETE':
|
|
session_destroy();
|
|
jsonResponse(['success' => true, 'message' => 'Logout berhasil']);
|
|
break;
|
|
|
|
// ── GET /api/auth.php → Cek session ───────────────────
|
|
case 'GET':
|
|
if (!isset($_SESSION['user_id'])) {
|
|
jsonResponse(['success' => false, 'loggedIn' => false], 200);
|
|
}
|
|
jsonResponse(['success' => true, 'loggedIn' => true, 'user' => $_SESSION['user']]);
|
|
break;
|
|
|
|
default:
|
|
jsonResponse(['success' => false, 'error' => 'Method tidak diizinkan'], 405);
|
|
}
|