Account.php

<?php
	namespace Pdsinterop\PhpSolid\Routes;

	use Pdsinterop\PhpSolid\Server;
	use Pdsinterop\PhpSolid\ClientRegistration;
	use Pdsinterop\PhpSolid\User;
	use Pdsinterop\PhpSolid\Session;
	use Pdsinterop\PhpSolid\Mailer;
	use Pdsinterop\PhpSolid\IpAttempts;
	use Pdsinterop\PhpSolid\StorageServer;
	
	class Account {
		public static function requireLoggedInUser() {
			$user = User::getUser(Session::getLoggedInUser());
			if (!$user) {
				switch ($_SERVER['REQUEST_METHOD']) {
					case "GET":
						header("Location: /login/?redirect_uri=" . urlencode($_SERVER['REQUEST_URI']));
						exit();
					break;
					default:
						header("HTTP/1.0 400 Bad Request");
						exit();
					break;
				}
			}
		}

		public static function respondToDashboard() {
			$user = User::getUser(Session::getLoggedInUser());
			include_once(FRONTENDDIR . "bootloader.html");
		}

		public static function respondToLogout() {
			$user = User::getUser(Session::getLoggedInUser());
			if ($user) {
				session_destroy();
			}
			header("Location: /login/");
			exit();
		}

		public static function respondToAccountVerify() {
			$verifyData = [
				'email' => $_POST['email']
			];

			$verifyToken = User::saveVerifyToken('verify', $verifyData);
			Mailer::sendVerify($verifyToken);

			$responseData = "OK";
			header("HTTP/1.1 201 Created");
			header("Content-type: application/json");
			echo json_encode($responseData, JSON_PRETTY_PRINT | JSON_THROW_ON_ERROR);
		}

		public static function respondToAccountNew() {
			$verifyToken = User::getVerifyToken($_POST['confirm']);
			if (!$verifyToken) {
				error_log("Could not read verify token");
				header("HTTP/1.1 400 Bad Request");
				exit();
			}
			if ($verifyToken['email'] !== $_POST['email']) {
				error_log("Verify token does not match email");
				header("HTTP/1.1 400 Bad Request");
				exit();
			}
			if (User::userEmailExists($_POST['email'])) {
				error_log("Account already exists");
				header("HTTP/1.1 400 Bad Request");
				exit();
			}
			if (!$_POST['password'] === $_POST['repeat_password']) {
				error_log("Password repeat does not match");
				header("HTTP/1.1 400 Bad Request");
				exit();
			}

			$newUser = [
				"email" => $_POST['email'],
				"password" => $_POST['password']
			];

			$createdUser = User::createUser($newUser);
			if (!$createdUser) {
				error_log("Failed to create user");
				header("HTTP/1.1 400 Bad Request");
				exit();
			}
			$createdStorage = StorageServer::createStorage($createdUser['webId']);
			User::setStorage($createdUser['userId'], $createdStorage['storageUrl']);

			Mailer::sendAccountCreated($createdUser);

			$responseData = array(
				"webId" => $createdUser['webId'],
				"storageUrl" => $createdStorage['storageUrl']
			);

			header("HTTP/1.1 201 Created");
			header("Content-type: application/json");
			Session::start($_POST['email']);
			echo json_encode($responseData, JSON_PRETTY_PRINT | JSON_THROW_ON_ERROR);
		}
		
		public static function respondToAccountResetPassword() {
			if (!User::userEmailExists($_POST['email'])) {
				header("HTTP/1.1 200 OK"); // Return OK even when user is not found;
				header("Content-type: application/json");
				echo json_encode("OK");
				exit();
			}
			$verifyData = [
				'email' => $_POST['email']
			];

			$verifyToken = User::saveVerifyToken('passwordReset', $verifyData);
			Mailer::sendResetPassword($verifyToken);
			header("HTTP/1.1 200 OK");
			header("Content-type: application/json");
			echo json_encode("OK");
		}
		
		public static function respondToAccountChangePassword() {
			$verifyToken = User::getVerifyToken($_POST['token']);
			if (!$verifyToken) {
				header("HTTP/1.1 400 Bad Request");
				exit();
			}
			$result = User::setUserPassword($verifyToken['email'], $_POST['newPassword']);
			if (!$result) {
				header("HTTP/1.1 400 Bad Request");
				exit();
			}
			header("HTTP/1.1 200 OK");
			header("Content-type: application/json");
			echo json_encode("OK");
		}
		
		public static function respondToAccountDelete() {
			if (!User::userEmailExists($_POST['email'])) {
				header("HTTP/1.1 200 OK"); // Return OK even when user is not found;
				header("Content-type: application/json");
				echo json_encode("OK");
				exit();
			}
			$verifyData = [
				'email' => $_POST['email']
			];

			$verifyToken = User::saveVerifyToken('deleteAccount', $verifyData);
			Mailer::sendDeleteAccount($verifyToken);
			header("HTTP/1.1 200 OK");
			header("Content-type: application/json");
			echo json_encode("OK");
		}
		
		public static function respondToAccountDeleteConfirm() {
			$verifyToken = User::getVerifyToken($_POST['token']);
			if (!$verifyToken) {
				header("HTTP/1.1 400 Bad Request");
				exit();
			}
			User::deleteAccount($verifyToken['email']);
			header("HTTP/1.1 200 OK");
			header("Content-type: application/json");
			echo json_encode("OK");
		}
		
		public static function respondToLogin() {
			$failureCount = IpAttempts::getAttemptsCount($_SERVER['REMOTE_ADDR'], "login");
			if ($failureCount > 5) {
				header("HTTP/1.1 400 Bad Request");
				exit();
			}
			if (User::checkPassword($_POST['username'], $_POST['password'])) {
				Session::start($_POST['username']);
				$user = User::getUser($_POST['username']);
				if (!isset($_POST['redirect_uri']) || $_POST['redirect_uri'] === '') {
					header("Location: /dashboard/#autologin/" . urlencode($user['webId']));
					exit();
				}
				header("Location: " . urldecode($_POST['redirect_uri'])); // FIXME: Do we need to harden this?
			} else {
				IpAttempts::logFailedAttempt($_SERVER['REMOTE_ADDR'], "login", time() + 3600);
				header("Location: /login/");
			}
		}
	}