File: /home/awaldron/_accomods/api.accomods.com/v1/auth.php
<?php
//**********************************************************************************************************//
// Method: POST
// Endpoint: user
// Params: email, password
function post_v1_auth_register( $args, $body, $uid, $is_admin, $db ) {
$rules = [
'email' => 'req,email',
'password' => 'req',
'fname' => 'req',
'lname' => 'req',
'school' => 'req',
'code' => 'req',
'phone' => 'req',
];
validate_body( $body, $rules );
$ins = "INSERT INTO users (`email`, `fname`, `lname`, `pass`, `phone`, `school_code`, `school_name`, `expires`) VALUES (";
$ins .= "'" . filter_var($body['email'], FILTER_VALIDATE_EMAIL) . "',";
$ins .= "'" . filter_var($body['fname'], FILTER_SANITIZE_STRING) . "',";
$ins .= "'" . filter_var($body['lname'], FILTER_SANITIZE_STRING) . "',";
$ins .= "'" . md5($body['password']) . "',";
$ins .= "'" . filter_var($body['phone'], FILTER_SANITIZE_STRING) . "',";
$ins .= "'" . filter_var($body['code'], FILTER_SANITIZE_STRING) . "',";
$ins .= "'" . filter_var($body['school'], FILTER_SANITIZE_STRING) . "',";
$ins .= "'" . date('Y-m-d', strtotime('+1 years')) . "'";
$ins .= ")";
if ($result = $db->query($ins)) {
$data = [
'success' => true,
//'access_token' => 'Ebp/iVQK1EOxtCuecMBxKQ==aNr0ihK0R0emRCdY30thfA==', // PROD
//'access_token' => 'OUhm7fV1QUakjmjZ1RRoRw==', // DEV OLD
'access_token' => 'zSBhDpRyLUCQYkzj5yrVyA==', //foGCov73nUaqpocpRfC+Vw==
'isCustomer' => true,
'organization' => 'accomods',
'token_type' => 'bearer',
'userId' => "620de376-1c35-4c1e-a147-58f9d3efa767", //a89d9a88-9847-41bf-bac9-932440003aa9",
'userName' => filter_var($body['email'], FILTER_VALIDATE_EMAIL)
];
response(200, ['success'=>true,'payload'=>$data]);
}
else {
response(200, ['success'=>false,'error'=>$db->error]);
}
}
//**********************************************************************************************************//
// Method: POST
// Endpoint: user
// Params: email, password
function post_v1_auth_token( $args, $body, $uid, $is_admin, $db ) {
$rules = [
'email' => 'req,email',
'password' => 'req',
];
validate_body( $body, $rules );
$sql = "SELECT * FROM users WHERE email='".$body['email']."' AND pass='" . md5($body['password']) . "'";
$user = qRow( $db, $sql );
$valid_login = !empty($user['id']);
if ($valid_login) {
$expire_date = str_replace('-', '', $user['expires']);
$user_expired = date('Ymd') > $expire_date;
if ($user_expired) {
response(200, ['success'=>false,'msg'=>'This subscription has expired.']);
}
else if ($user['billfail'] == 1) {
response(200, ['success'=>false,'msg'=>'This account has been disabled, subscription billing failed.']);
}
else if ($user['cancelled'] == 1) {
response(200, ['success'=>false,'msg'=>'This account subscription has been cancelled.']);
}
else if ($user['access'] == 0) {
response(200, ['success'=>false,'msg'=>'This account has been disabled by an administrator.']);
}
else {
$data = [
'success' => true,
//'access_token' => 'Ebp/iVQK1EOxtCuecMBxKQ==aNr0ihK0R0emRCdY30thfA==', // PROD
//'access_token' => 'OUhm7fV1QUakjmjZ1RRoRw==', // DEV OLD
'access_token' => 'zSBhDpRyLUCQYkzj5yrVyA==', //foGCov73nUaqpocpRfC+Vw==
'isCustomer' => true,
'organization' => 'accomods',
'token_type' => 'bearer',
'userId' => "620de376-1c35-4c1e-a147-58f9d3efa767", //a89d9a88-9847-41bf-bac9-932440003aa9",
'userName' => $user['email'],
'access' => $user['access'],
'expires' => $user['expires']
];
response(200, $data);
}
} else {
response(200, ['success'=>false,'msg'=>'The username and/or password supplied is invalid']);
}
}
//**********************************************************************************************************//
// Method: PUT
// Endpoint: auth/pwreset
// Params: u, p, p1, p2
function put_v1_auth_pwreset( $args, $body, $uid, $is_admin, $db ) {
$rules = [ 'u' => 'req', 'p' => 'req', 'p1' => 'req', 'p2' => 'req' ];
validate_body( $body, $rules );
$email = filter_var($body['u'], FILTER_VALIDATE_EMAIL);
if ($body['p1'] === $body['p2']) {
$sql = "SELECT * FROM users WHERE email='".$email."' AND pass='" . md5($body['p']) . "'";
$user = qRow( $db, $sql );
if ($user) {
$upd = $db->query("UPDATE users SET pass='" . md5($body['p1']) . "' WHERE email='" . $email . "'");
if ($upd === true) {
response(200, ['success' => true, 'msg' => 'Password updated successfully.'] );
} else {
response(200, ['success' => false, 'error' => 'An unexpected error occurred while updating your password.'] );
}
} else {
response(200, ['success' => false, 'error' => 'No matching users found.']);
}
} else {
response(200, ['success' => false, 'error' => 'Passwords do not match.']);
}
}
//**********************************************************************************************************//
// Method: GET
// Endpoint: auth/profile/$args[0]
// Params: email
function get_v1_auth_profile( $args, $body, $uid, $is_admin, $db ) {
$email = filter_var($args[0], FILTER_VALIDATE_EMAIL);
$sql = "SELECT * FROM users WHERE email='" . $email . "'";
$user = qRow($db, $sql);
if ($user) {
$data = [
'Id' => "a89d9a88-9847-41bf-bac9-932440003aa9",
'PictureUrl' => '/static/img/avatars/default.png',
'Name' => [
'First' => $user['fname'],
'Middle' => '',
'Last' => $user['lname']
],
'EmailAddress' => $email,
'Addresses' => null,
'IsExternalCreatingUserSettings' => null,
'Attributes' => null,
'School' => [
'Name' => $user['school_name'],
'Code' => $user['school_code'],
'Personnel' => null
]
];
// GET DISTRICT ASSOCIATES
if (strlen($user['school_code']) > 0 && $user['school_code'] !== 'INDIVIDUAL_ACCOUNT') {
$sql2 = "SELECT email, fname, lname FROM users WHERE school_code='".$user['school_code']."' AND id <> ".$user['id']." AND access=1 ORDER BY lname ASC, fname ASC";
$res = qSet($db, $sql2);
$associates = [];
foreach ($res as $assoc) {
$associates[] = [ 'First' => $assoc['fname'], 'Last' => $assoc['lname'], 'Email' => $assoc['email'] ];
}
$data['School']['Personnel'] = $associates;
}
response(200, ['success'=>true, 'profile'=>$data, 'msg'=>$db->last_error] );
} else {
response(200, ['success'=>false, 'msg'=>'No profile found.'] );
}
}
//**********************************************************************************************************//
// Method: POST
// Endpoint: pwreset
// Params: none
// Description: Send an email with the password reset link
function post_v1_auth_pwforget( $args, $body, $uid, $is_admin, $db ){
$rules = [
'email' => 'req,email',
];
validate_body( $body, $rules );
$user = qRow( $db, "SELECT * FROM users WHERE email='".$body['email']."'");
$user['reset_hash'] = generateHash(10);
if ($user['id']) {
$upd = "UPDATE users SET reset_hash='".$user['reset_hash']."' WHERE id=".$user['id'];
$db->query($upd);
send_pwreset_email( $user['email'], $user['reset_hash'] );
response(200, ['success' => true, 'msg'=>'Email sent to user']);
} else {
response(200, ['success' => true, 'msg'=>'Email sent to user']);
}
}
//**********************************************************************************************************//
// Method: POST
// Endpoint: pwresetsubmit
// Params: none
// Description: Submit a new password in the reset flow
function post_v1_auth_pwresetsubmit( $args, $body, $uid, $is_admin, $db ) {
$rules = [
'password' => 'req',
'reset_hash' => 'req',
];
validate_body( $body, $rules );
try {
$upd = "UPDATE users SET pass='".md5($body['password'])."', reset_hash='' WHERE reset_hash='".$body['reset_hash']."'";
$db->query($upd);
response(200, ['success' => true]);
}
catch (Exception $e) {
response(400, ['success' => false, 'error' => $e]);
}
}
//**********************************************************************************************************//
// Method: GET
// Endpoint: test
// Params: none
// Description: Submit a new password in the reset flow
function get_v1_auth_test( $args, $body, $uid, $is_admin, $db ) {
echo '<pre>', print_r($_SERVER), '</pre>';
//response(200, ['success' => true]);
}