ï»¿
Your IP : 216.73.217.78

Current Path : /home/seto/888mirror.pm/includes/
Current File : /home/seto/888mirror.pm/includes/auth.php
<?php
require_once __DIR__ . '/../config.php';
require_once __DIR__ . '/db.php';

function auth_start(): void {
    if (session_status() === PHP_SESSION_NONE) {
        session_name(SESSION_NAME);
        session_start();
    }
}

function auth_check(): void {
    auth_start();
    if (empty($_SESSION['user_id'])) {
        header('Location: /admin/login.php');
        exit();
    }
}

function auth_login(string $login, string $password): bool {
    auth_start();

    $ip = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
    if (brute_is_blocked($ip)) {
        return false;
    }

    $desc = [0 => ['pipe', 'r'], 1 => ['pipe', 'w'], 2 => ['pipe', 'w']];
    $proc = proc_open(['/usr/bin/python3', '/usr/local/bin/verify_password.py', trim($login)], $desc, $pipes);
    if (!is_resource($proc)) {
        brute_record($ip);
        return false;
    }
    fwrite($pipes[0], $password);
    fclose($pipes[0]);
    $result = trim(stream_get_contents($pipes[1]));
    fclose($pipes[1]);
    fclose($pipes[2]);
    proc_close($proc);

    if ($result === 'ok') {
        brute_clear($ip);
        $_SESSION['user_id'] = 1;
        $_SESSION['login']   = trim($login);
        $_SESSION['role']    = 'admin';
        session_regenerate_id(true);
        return true;
    }

    brute_record($ip);
    return false;
}

function auth_role(): string {
    auth_start();
    return $_SESSION['role'] ?? 'admin';
}

// Проверяет, есть ли у текущего пользователя доступ к разделу.
// 'admin' — полный доступ; 'limited' — запрещены: conversions, openai_key.
function auth_can(string $permission): bool {
    if (auth_role() === 'admin') return true;
    $denied = ['conversions', 'openai_key'];
    return !in_array($permission, $denied, true);
}

function auth_logout(): void {
    auth_start();
    $_SESSION = [];
    session_destroy();
}

function brute_is_blocked(string $ip): bool {
    $since = date('Y-m-d H:i:s', time() - BRUTE_WINDOW_SEC);
    $stmt  = db()->prepare(
        "SELECT COUNT(*) FROM login_attempts WHERE ip = ? AND created_at >= ?"
    );
    $stmt->execute([$ip, $since]);
    return (int)$stmt->fetchColumn() >= BRUTE_MAX_ATTEMPTS;
}

function brute_record(string $ip): void {
    db()->prepare("INSERT INTO login_attempts (ip) VALUES (?)")->execute([$ip]);
}

function brute_clear(string $ip): void {
    db()->prepare("DELETE FROM login_attempts WHERE ip = ?")->execute([$ip]);
}

function brute_attempts_left(string $ip): int {
    $since = date('Y-m-d H:i:s', time() - BRUTE_WINDOW_SEC);
    $stmt  = db()->prepare(
        "SELECT COUNT(*) FROM login_attempts WHERE ip = ? AND created_at >= ?"
    );
    $stmt->execute([$ip, $since]);
    $used = (int)$stmt->fetchColumn();
    return max(0, BRUTE_MAX_ATTEMPTS - $used);
}