Schone start na index corruptie

2026-09-09 14:31:23 +02:00
commit a5324548ec
41 changed files with 9351 additions and 0 deletions
@@ -0,0 +1,142 @@
+<?php
+/**
+ * Microsoft 365 OAuth 2.0 Callback Handler
+ * Verwerkt de autorisatiecode, wisselt tokens uit en slaat de verbinding op.
+ */
+
+require_once __DIR__ . '/../includes/auth.php';
+require_once __DIR__ . '/../includes/integrations/microsoft.php';
+
+start_secure_session();
+
+// 1. CSRF State validatie & Sessieherstel
+$receivedState = $_GET['state'] ?? '';
+$stateUserId = !empty($receivedState) ? verify_oauth_state($receivedState) : null;
+
+// Als de sessie verloren is gegaan tijdens de externe cross-site redirect vanaf Microsoft,
+// herstellen we de gebruiker veilig aan de hand van de cryptografisch ondertekende OAuth state!
+if (empty($_SESSION['user_id']) && $stateUserId) {
+    try {
+        $db = get_db_connection();
+        $stmtUser = $db->prepare("SELECT id, name, email, role, two_factor_enabled, created_at FROM users WHERE id = ?");
+        $stmtUser->execute([$stateUserId]);
+        $recoveredUser = $stmtUser->fetch();
+        if ($recoveredUser) {
+            $_SESSION['user_id'] = $recoveredUser['id'];
+            $_SESSION['user_name'] = $recoveredUser['name'];
+            $_SESSION['user_email'] = $recoveredUser['email'];
+            $_SESSION['user_role'] = $recoveredUser['role'];
+            $_SESSION['is_2fa_verified'] = true;
+            issue_remember_token((int)$recoveredUser['id']);
+        }
+    } catch (Throwable $e) {
+        // Foutafhandeling
+    }
+}
+
+// 2. Controleer authenticatie
+$user = get_logged_in_user();
+if (!$user) {
+    header('Location: /auth/login.php?error=' . urlencode('Sessie verlopen tijdens Microsoft koppeling. Log opnieuw in en probeer het nogmaals.'));
+    exit;
+}
+
+$db = get_db_connection();
+
+// 3. Foutafhandeling vanuit Microsoft (bijv. gebruiker weigerde machtiging)
+if (!empty($_GET['error'])) {
+    $errorDescription = $_GET['error_description'] ?? $_GET['error'];
+    header('Location: /profile.php?error=' . urlencode("Microsoft melding: {$errorDescription}"));
+    exit;
+}
+
+// 4. Valideer de state (via HMAC handtekening of fallback sessiestate)
+$expectedState = $_SESSION['ms_oauth_state'] ?? '';
+unset($_SESSION['ms_oauth_state'], $_SESSION['ms_oauth_user_id']);
+
+if (!$stateUserId && (empty($receivedState) || empty($expectedState) || !hash_equals($expectedState, $receivedState))) {
+    header('Location: /profile.php?error=' . urlencode('Ongeldige sessie of CSRF-controle mislukt. Probeer opnieuw in te loggen via Microsoft.'));
+    exit;
+}
+
+// Afhandeling van beheerderstoestemming (Admin Consent)
+if (!empty($_GET['admin_consent'])) {
+    header('Location: /admin.php?success=' . urlencode('Beheerdersgoedkeuring voor uw organisatie is succesvol verleend! U en uw collega\'s kunnen nu direct hun Outlook agenda koppelen via Mijn Profiel.'));
+    exit;
+}
+
+// 5. Autorisatiecode controleren
+$code = $_GET['code'] ?? '';
+if (empty($code)) {
+    header('Location: /profile.php?error=' . urlencode('Geen autorisatiecode ontvangen van Microsoft.'));
+    exit;
+}
+
+// 4. Centrale instellingen ophalen
+$appConfig = microsoft_get_app_config();
+
+$clientId     = $appConfig['client_id'];
+$clientSecret = $appConfig['client_secret'];
+$tenantId     = (!empty($appConfig['tenant_id']) && $appConfig['tenant_id'] !== 'common') ? $appConfig['tenant_id'] : 'planningsagenda.nl';
+
+if (empty($clientId) || empty($clientSecret)) {
+    header('Location: /profile.php?error=' . urlencode('Microsoft 365 configuratie (Client ID of Secret) ontbreekt in Fociz. Neem contact op met de beheerder.'));
+    exit;
+}
+
+$redirectUri = rtrim(APP_URL, '/') . '/auth/callback_microsoft.php';
+
+// 5. Code omwisselen voor access & refresh tokens
+$tokenResult = microsoft_exchange_code($code, $clientId, $clientSecret, $redirectUri, $tenantId);
+
+if (!$tokenResult['success']) {
+    header('Location: /profile.php?error=' . urlencode('Token uitwisseling mislukt: ' . $tokenResult['error']));
+    exit;
+}
+
+$accessToken  = $tokenResult['access_token'];
+$refreshToken = $tokenResult['refresh_token'];
+$expiresIn    = $tokenResult['expires_in'];
+$expiresAt    = time() + $expiresIn;
+
+// 6. Microsoft gebruikersprofiel ophalen
+$profile = microsoft_get_user_profile($accessToken);
+$accountEmail = $profile['mail'] ?? ($profile['userPrincipalName'] ?? $user['email']);
+$accountName  = $profile['displayName'] ?? 'Microsoft 365 Account';
+
+// 7. Opslaan in MariaDB
+$stmtExisting = $db->prepare("SELECT settings FROM integrations WHERE user_id = ? AND provider = 'OUTLOOK'");
+$stmtExisting->execute([$user['id']]);
+$existingRow = $stmtExisting->fetch();
+$existingSettings = json_decode($existingRow['settings'] ?? '{}', true) ?: [];
+
+$newSettings = array_merge($existingSettings, [
+    'expires_at'    => $expiresAt,
+    'account_email' => $accountEmail,
+    'account_name'  => $accountName,
+]);
+
+// Als de ingelogde gebruiker Beheerder (ADMIN) is, bewaren we ook de centrale app credentials
+if ($user['role'] === 'ADMIN') {
+    $newSettings['client_id']     = $clientId;
+    $newSettings['client_secret'] = $clientSecret;
+    $newSettings['tenant_id']     = $tenantId;
+}
+
+$saveStmt = $db->prepare("
+    INSERT INTO integrations (user_id, provider, is_enabled, is_demo_mode, access_token, refresh_token, settings, last_sync_at)
+    VALUES (?, 'OUTLOOK', 1, 0, ?, ?, ?, NOW())
+    ON DUPLICATE KEY UPDATE 
+        is_enabled = 1,
+        is_demo_mode = 0,
+        access_token = VALUES(access_token),
+        refresh_token = VALUES(refresh_token),
+        settings = VALUES(settings),
+        last_sync_at = NOW()
+");
+$saveStmt->execute([$user['id'], $accessToken, $refreshToken, json_encode($newSettings)]);
+
+// 8. Succesvol terugkeren naar de Persoonlijke Profiel Hub
+header('Location: /profile.php?success=' . urlencode("Microsoft Outlook succesvol gekoppeld als {$accountEmail}!"));
+exit;
+
@@ -0,0 +1,188 @@
+<?php
+/**
+ * Fociz Uitnodiging Accepteren & Account Registratie met 2FA
+ */
+
+require_once __DIR__ . '/../includes/auth.php';
+start_secure_session();
+
+$token = trim($_GET['token'] ?? ($_POST['token'] ?? ''));
+$invite = validate_invite($token);
+
+if (!$invite) {
+    die("
+        <!DOCTYPE html>
+        <html lang='nl' class='dark'>
+        <head><script src='https://cdn.tailwindcss.com'></script></head>
+        <body class='bg-[#090d16] text-white min-h-screen flex items-center justify-center p-4'>
+            <div class='max-w-md bg-slate-900 border border-slate-800 rounded-2xl p-8 text-center'>
+                <h2 class='text-xl font-bold text-red-400 mb-2'>Ongeldige Uitnodiging</h2>
+                <p class='text-sm text-slate-400 mb-6'>Deze uitnodigingslink is ongeldig, verlopen of al eerder gebruikt.</p>
+                <a href='/auth/login.php' class='px-4 py-2 bg-emerald-500 text-slate-950 font-bold rounded-xl text-xs'>Naar Inloggen</a>
+            </div>
+        </body>
+        </html>
+    ");
+}
+
+$error = null;
+if (empty($_SESSION['invite_totp_secret'])) {
+    $_SESSION['invite_totp_secret'] = TOTP::generateSecret(16);
+}
+$secret = $_SESSION['invite_totp_secret'];
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    $name = trim($_POST['name'] ?? '');
+    $password = $_POST['password'] ?? '';
+    $confirmPassword = $_POST['confirm_password'] ?? '';
+    $totpCode = trim($_POST['totp_code'] ?? '');
+
+    if (empty($name) || empty($password) || empty($totpCode)) {
+        $error = "Alle velden (inclusief 2FA verificatiecode) zijn verplicht.";
+    } elseif (strlen($password) < 8) {
+        $error = "Het wachtwoord moet minimaal 8 tekens lang zijn.";
+    } elseif ($password !== $confirmPassword) {
+        $error = "Wachtwoorden komen niet overeen.";
+    } elseif (!TOTP::verifyCode($secret, $totpCode)) {
+        $error = "Ongeldige 2FA verificatiecode. Controleer de tijd op uw smartphone.";
+    } else {
+        try {
+            $db = get_db_connection();
+            $passwordHash = password_hash($password, PASSWORD_DEFAULT);
+            $backupCodes = TOTP::generateBackupCodes(8);
+
+            $db->beginTransaction();
+
+            // 1. Maak gebruiker aan
+            $stmt = $db->prepare("
+                INSERT INTO users (name, email, password_hash, role, two_factor_secret, two_factor_enabled, backup_codes)
+                VALUES (?, ?, ?, ?, ?, 1, ?)
+            ");
+            $stmt->execute([
+                $name,
+                $invite['email'],
+                $passwordHash,
+                $invite['role'],
+                $secret,
+                json_encode($backupCodes)
+            ]);
+
+            $newUserId = (int)$db->lastInsertId();
+
+            // 2. Markeer invite als gebruikt
+            $stmtInvite = $db->prepare("UPDATE invites SET used_at = NOW() WHERE id = ?");
+            $stmtInvite->execute([$invite['id']]);
+
+            $db->commit();
+
+            // Start sessie
+            $_SESSION['user_id'] = $newUserId;
+            $_SESSION['user_name'] = $name;
+            $_SESSION['user_email'] = $invite['email'];
+            $_SESSION['user_role'] = $invite['role'];
+            $_SESSION['is_2fa_verified'] = true;
+            issue_remember_token($newUserId);
+            unset($_SESSION['invite_totp_secret']);
+
+            header('Location: /planner.php');
+            exit;
+        } catch (Exception $e) {
+            if ($db->inTransaction()) $db->rollBack();
+            $error = "Fout bij registreren: " . $e->getMessage();
+        }
+    }
+}
+
+$otpAuthUrl = TOTP::getOtpAuthUrl($invite['email'], $secret, 'Fociz');
+$qrCodeUrl = TOTP::getQrCodeUrl($otpAuthUrl, 180);
+$pageTitle = "Fociz — Uitnodiging Accepteren";
+?>
+<!DOCTYPE html>
+<html lang="nl" class="dark">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title><?= htmlspecialchars($pageTitle) ?></title>
+    <script src="https://cdn.tailwindcss.com"></script>
+    <script src="https://unpkg.com/lucide@latest"></script>
+    <style>body { background-color: #090d16; color: #f1f5f9; }</style>
+</head>
+<body class="min-h-screen flex items-center justify-center p-4 bg-gradient-to-br from-[#090d16] via-[#0f172a] to-[#090d16]">
+
+<?php require_once __DIR__ . '/../includes/env_badge.php'; ?>
+
+<div class="w-full max-w-lg bg-slate-900/90 border border-slate-800 rounded-2xl shadow-2xl backdrop-blur-xl p-8">
+    <div class="text-center mb-8">
+        <div class="inline-flex items-center justify-center w-14 h-14 rounded-2xl bg-emerald-500/10 border border-emerald-500/30 text-emerald-400 mb-3 shadow-lg shadow-emerald-500/10">
+            <i data-lucide="shield-check" class="w-8 h-8"></i>
+        </div>
+        <h1 class="text-2xl font-bold text-white">Welkom bij Fociz</h1>
+        <p class="text-slate-400 text-sm mt-1">
+            Uitgenodigd door <strong class="text-slate-200"><?= htmlspecialchars($invite['inviter_name']) ?></strong> voor <span class="text-emerald-400 font-mono text-xs bg-emerald-500/10 px-2 py-0.5 rounded"><?= htmlspecialchars($invite['email']) ?></span>
+        </p>
+    </div>
+
+    <?php if ($error): ?>
+        <div class="mb-6 p-4 rounded-xl bg-red-500/10 border border-red-500/30 flex items-start space-x-3 text-red-400 text-sm">
+            <i data-lucide="alert-triangle" class="w-5 h-5 flex-shrink-0 mt-0.5"></i>
+            <span><?= htmlspecialchars($error) ?></span>
+        </div>
+    <?php endif; ?>
+
+    <form method="POST" action="/auth/invite.php" class="space-y-4">
+        <input type="hidden" name="token" value="<?= htmlspecialchars($token) ?>">
+
+        <div>
+            <label class="block text-xs font-medium text-slate-300 mb-1">Uw naam</label>
+            <input type="text" name="name" required placeholder="Bijv. Sarah de Vries" value="<?= htmlspecialchars($_POST['name'] ?? '') ?>" class="w-full bg-slate-800/80 border border-slate-700 rounded-xl px-4 py-2.5 text-white placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-emerald-500/50 text-sm transition">
+        </div>
+
+        <div class="grid grid-cols-1 sm:grid-cols-2 gap-3">
+            <div>
+                <label class="block text-xs font-medium text-slate-300 mb-1">Wachtwoord (min. 8 tekens)</label>
+                <input type="password" name="password" required placeholder="••••••••" class="w-full bg-slate-800/80 border border-slate-700 rounded-xl px-4 py-2.5 text-white placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-emerald-500/50 text-sm transition">
+            </div>
+            <div>
+                <label class="block text-xs font-medium text-slate-300 mb-1">Bevestig wachtwoord</label>
+                <input type="password" name="confirm_password" required placeholder="••••••••" class="w-full bg-slate-800/80 border border-slate-700 rounded-xl px-4 py-2.5 text-white placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-emerald-500/50 text-sm transition">
+            </div>
+        </div>
+
+        <!-- 2FA Verplichting -->
+        <div class="mt-6 pt-6 border-t border-slate-800 text-center space-y-4">
+            <h3 class="text-sm font-bold text-white uppercase tracking-wider text-emerald-400">
+                Verplichte Tweestapsverificatie (2FA)
+            </h3>
+            <p class="text-xs text-slate-400">
+                Scan deze QR-code in uw authenticator app (Google Authenticator, Microsoft Authenticator of 1Password):
+            </p>
+
+            <div class="inline-block p-3 bg-white rounded-2xl shadow-xl">
+                <img src="<?= htmlspecialchars($qrCodeUrl) ?>" alt="2FA QR Code" class="w-40 h-40 mx-auto">
+            </div>
+
+            <div class="bg-slate-800/60 border border-slate-700/80 rounded-xl p-2.5 text-xs text-slate-400 max-w-sm mx-auto font-mono">
+                Sleutel: <strong class="text-slate-200"><?= htmlspecialchars($secret) ?></strong>
+            </div>
+
+            <div>
+                <label class="block text-xs font-medium text-slate-300 mb-1.5">
+                    Voer de 6-cijferige code uit uw app in:
+                </label>
+                <input type="text" name="totp_code" required maxlength="6" placeholder="123456" class="w-48 mx-auto block text-center tracking-[0.5em] font-mono text-xl bg-slate-800 border border-slate-700 rounded-xl py-2 text-white focus:outline-none focus:ring-2 focus:ring-emerald-500/50 transition">
+            </div>
+        </div>
+
+        <button type="submit" class="w-full mt-6 bg-emerald-500 hover:bg-emerald-600 text-slate-950 font-bold py-3 px-4 rounded-xl transition shadow-lg shadow-emerald-500/20 flex items-center justify-center space-x-2">
+            <span>Account Activeren & Inloggen</span>
+            <i data-lucide="check-circle-2" class="w-4 h-4"></i>
+        </button>
+    </form>
+</div>
+
+<script>
+    if (typeof lucide !== 'undefined') lucide.createIcons();
+</script>
+</body>
+</html>
+
@@ -0,0 +1,256 @@
+<?php
+/**
+ * Fociz Veilige Login met Tweestapsverificatie (2FA)
+ */
+
+require_once __DIR__ . '/../includes/auth.php';
+start_secure_session();
+
+// Als er nog geen admin is, direct naar setup
+if (!has_admin_user()) {
+    header('Location: /auth/setup.php');
+    exit;
+}
+
+// Als al ingelogd (via actieve sessie of persistente cookie), ga direct naar planner
+$currentUser = get_logged_in_user();
+if ($currentUser) {
+    header('Location: /planner.php');
+    exit;
+}
+
+$error = null;
+$step = isset($_SESSION['pending_2fa_user_id']) ? 2 : 1;
+
+// Terug naar stap 1
+if (isset($_GET['action']) && $_GET['action'] === 'restart') {
+    unset($_SESSION['pending_2fa_user_id'], $_SESSION['pending_2fa_user_email']);
+    header('Location: /auth/login.php');
+    exit;
+}
+
+// POST Verwerking
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    $db = get_db_connection();
+
+    // STAP 1: Wachtwoord verificatie
+    if ($step === 1) {
+        $email = strtolower(trim($_POST['email'] ?? ''));
+        $password = $_POST['password'] ?? '';
+
+        if (empty($email) || empty($password)) {
+            $error = "Vul e-mailadres en wachtwoord in.";
+        } else {
+            $stmt = $db->prepare("SELECT id, name, email, password_hash, two_factor_secret, two_factor_enabled FROM users WHERE email = ?");
+            $stmt->execute([$email]);
+            $user = $stmt->fetch();
+
+            if ($user && password_verify($password, $user['password_hash'])) {
+                // Succesvol stap 1: zet tijdelijke pending sessie voor 2FA
+                $_SESSION['pending_2fa_user_id'] = $user['id'];
+                $_SESSION['pending_2fa_user_email'] = $user['email'];
+                $_SESSION['pending_2fa_user_name'] = $user['name'];
+                $step = 2;
+            } else {
+                $error = "Onjuist e-mailadres of wachtwoord.";
+            }
+        }
+    }
+    // STAP 2: 2FA TOTP Code verificatie
+    elseif ($step === 2) {
+        $userId = $_SESSION['pending_2fa_user_id'] ?? null;
+        $totpCode = trim($_POST['totp_code'] ?? '');
+
+        if (!$userId) {
+            header('Location: /auth/login.php');
+            exit;
+        }
+
+        if (empty($totpCode)) {
+            $error = "Vul de 6-cijferige 2FA code in uit uw authenticator app.";
+        } else {
+            $stmt = $db->prepare("SELECT * FROM users WHERE id = ?");
+            $stmt->execute([$userId]);
+            $user = $stmt->fetch();
+
+            $isValid = false;
+
+            // Controleer reguliere TOTP code
+            if (!empty($user['two_factor_secret'])) {
+                $isValid = verify_totp($user['two_factor_secret'], $totpCode);
+            }
+
+            // Fallback: controleer 8-karakter backup codes
+            if (!$isValid && !empty($user['backup_codes'])) {
+                $backupCodes = json_decode($user['backup_codes'], true) ?: [];
+                $codeUpper = strtoupper($totpCode);
+                $key = array_search($codeUpper, $backupCodes);
+                if ($key !== false) {
+                    $isValid = true;
+                    // Verbruik de backup code
+                    unset($backupCodes[$key]);
+                    $stmtUpdate = $db->prepare("UPDATE users SET backup_codes = ? WHERE id = ?");
+                    $stmtUpdate->execute([json_encode(array_values($backupCodes)), $userId]);
+                }
+            }
+
+            if ($isValid) {
+                // Volledige login succesvol
+                $_SESSION['user_id'] = $user['id'];
+                $_SESSION['user_name'] = $user['name'];
+                $_SESSION['user_email'] = $user['email'];
+                $_SESSION['user_role'] = $user['role'];
+                $_SESSION['is_2fa_verified'] = true;
+
+                // Activeer persistente remember token (30 dagen blijf ingelogd)
+                issue_remember_token((int)$user['id']);
+
+                unset($_SESSION['pending_2fa_user_id'], $_SESSION['pending_2fa_user_email'], $_SESSION['pending_2fa_user_name']);
+
+                header('Location: /planner.php');
+                exit;
+            } else {
+                $error = "Onjuiste 2FA code. Controleer uw authenticator app en probeer opnieuw.";
+            }
+        }
+    }
+}
+
+$pageTitle = "Fociz — Inloggen";
+?>
+<!DOCTYPE html>
+<html lang="nl" class="dark">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title><?= htmlspecialchars($pageTitle) ?></title>
+    <!-- Anti-flicker script: Laad direct het gekozen thema uit localStorage vóór DOM render -->
+    <script>
+        (function() {
+            var activeTheme = localStorage.getItem('fociz_theme') || 'dark';
+            var isDark = true;
+            if (activeTheme === 'dark') isDark = true;
+            else if (activeTheme === 'light') isDark = false;
+            else if (activeTheme === 'system') {
+                isDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
+            }
+            if (isDark) document.documentElement.classList.add('dark');
+            else document.documentElement.classList.remove('dark');
+        })();
+    </script>
+    <script src="https://cdn.tailwindcss.com"></script>
+    <script>
+        tailwind.config = {
+            darkMode: 'class',
+            theme: {
+                extend: {
+                    colors: {
+                        slate: {
+                            850: '#151f32',
+                            950: '#070b12',
+                        }
+                    }
+                }
+            }
+        }
+    </script>
+    <script src="https://unpkg.com/lucide@latest"></script>
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:wght@300;400;500;600;700;800&display=swap" rel="stylesheet">
+    <style>
+        body { font-family: 'Plus Jakarta Sans', sans-serif; }
+    </style>
+</head>
+<body class="min-h-screen flex items-center justify-center p-4 bg-slate-50 dark:bg-gradient-to-br dark:from-[#090d16] dark:via-[#0f172a] dark:to-[#090d16] text-slate-900 dark:text-slate-100 transition-colors">
+
+<?php require_once __DIR__ . '/../includes/env_badge.php'; ?>
+
+<div class="w-full max-w-md bg-white dark:bg-slate-900/90 border border-slate-200 dark:border-slate-800 rounded-3xl shadow-xl dark:shadow-2xl backdrop-blur-xl p-8 transition">
+    <!-- Header -->
+    <div class="text-center mb-8">
+        <div class="inline-flex items-center justify-center w-14 h-14 rounded-2xl bg-emerald-500/10 border border-emerald-500/30 text-emerald-600 dark:text-emerald-400 mb-3 shadow-lg shadow-emerald-500/10">
+            <i data-lucide="shield-check" class="w-8 h-8"></i>
+        </div>
+        <h1 class="text-3xl font-extrabold tracking-tight text-slate-900 dark:text-white">Fociz</h1>
+        <p class="text-slate-500 dark:text-slate-400 text-sm mt-1">
+            Veilig inloggen met tweestapsverificatie (2FA)
+        </p>
+    </div>
+
+    <?php if ($error): ?>
+        <div class="mb-6 p-4 rounded-2xl bg-red-500/10 border border-red-500/30 flex items-start space-x-3 text-red-700 dark:text-red-400 text-sm">
+            <i data-lucide="alert-triangle" class="w-5 h-5 flex-shrink-0 mt-0.5"></i>
+            <span><?= htmlspecialchars($error) ?></span>
+        </div>
+    <?php endif; ?>
+
+    <?php if ($step === 1): ?>
+        <!-- STAP 1: E-mail & Wachtwoord -->
+        <form method="POST" action="/auth/login.php" class="space-y-4">
+            <div>
+                <label class="block text-xs font-semibold text-slate-700 dark:text-slate-300 mb-1">E-mailadres</label>
+                <div class="relative">
+                    <input type="email" name="email" required autofocus placeholder="uw.naam@bedrijf.nl" value="<?= htmlspecialchars($_POST['email'] ?? '') ?>" class="w-full bg-slate-50 dark:bg-slate-800/80 border border-slate-300 dark:border-slate-700 rounded-xl px-4 py-2.5 text-slate-900 dark:text-white placeholder-slate-400 dark:placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-emerald-500/50 text-sm transition">
+                </div>
+            </div>
+
+            <div>
+                <label class="block text-xs font-semibold text-slate-700 dark:text-slate-300 mb-1">Wachtwoord</label>
+                <div class="relative">
+                    <input type="password" name="password" required placeholder="••••••••" class="w-full bg-slate-50 dark:bg-slate-800/80 border border-slate-300 dark:border-slate-700 rounded-xl px-4 py-2.5 text-slate-900 dark:text-white placeholder-slate-400 dark:placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-emerald-500/50 text-sm transition">
+                </div>
+            </div>
+
+            <button type="submit" class="w-full mt-4 bg-emerald-500 hover:bg-emerald-600 text-slate-950 font-bold py-3 px-4 rounded-xl transition shadow-lg shadow-emerald-500/20 flex items-center justify-center space-x-2 cursor-pointer">
+                <span>Verder naar 2FA</span>
+                <i data-lucide="arrow-right" class="w-4 h-4"></i>
+            </button>
+        </form>
+
+    <?php else: ?>
+
+        <!-- STAP 2: 2FA TOTP Code -->
+        <form method="POST" action="/auth/login.php" class="space-y-5">
+            <div class="text-center">
+                <div class="inline-flex items-center justify-center w-12 h-12 rounded-2xl bg-emerald-500/10 text-emerald-600 dark:text-emerald-400 mb-2">
+                    <i data-lucide="key" class="w-6 h-6"></i>
+                </div>
+                <p class="text-sm text-slate-800 dark:text-slate-300 font-semibold">
+                    Voer uw 6-cijferige verificatiecode in
+                </p>
+                <p class="text-xs text-slate-500 dark:text-slate-400 mt-1">
+                    Gekoppeld aan <strong class="text-slate-900 dark:text-slate-200"><?= htmlspecialchars($_SESSION['pending_2fa_user_email'] ?? '') ?></strong>
+                </p>
+            </div>
+
+            <div>
+                <input type="text" name="totp_code" required autofocus maxlength="9" placeholder="000 000" class="w-full text-center tracking-[0.4em] font-mono text-2xl bg-slate-50 dark:bg-slate-800/80 border border-slate-300 dark:border-slate-700 rounded-xl py-3 text-slate-900 dark:text-white placeholder-slate-400 dark:placeholder-slate-600 focus:outline-none focus:ring-2 focus:ring-emerald-500/50 transition">
+                <span class="text-[11px] text-slate-500 dark:text-slate-500 text-center block mt-1">
+                    Tip: U kunt ook een 8-cijferige herstelcode invoeren.
+                </span>
+            </div>
+
+            <div class="flex space-x-3">
+                <a href="/auth/login.php?action=restart" class="w-1/3 text-center bg-slate-100 hover:bg-slate-200 dark:bg-slate-800 dark:hover:bg-slate-700 text-slate-700 dark:text-slate-300 font-medium py-2.5 px-3 rounded-xl transition text-sm flex items-center justify-center cursor-pointer">
+                    Terug
+                </a>
+                <button type="submit" class="w-2/3 bg-emerald-500 hover:bg-emerald-600 text-slate-950 font-bold py-2.5 px-4 rounded-xl transition shadow-lg shadow-emerald-500/20 flex items-center justify-center space-x-2 cursor-pointer">
+                    <span>Inloggen</span>
+                    <i data-lucide="check-circle-2" class="w-4 h-4"></i>
+                </button>
+            </div>
+        </form>
+
+    <?php endif; ?>
+
+    <div class="mt-8 pt-6 border-t border-slate-100 dark:border-slate-800/80 text-center text-xs text-slate-500">
+        Toegang tot Fociz is strikt op uitnodiging. Vraag uw beheerder om een uitnodigingslink.
+    </div>
+</div>
+
+<script>
+    if (typeof lucide !== 'undefined') lucide.createIcons();
+</script>
+</body>
+</html>
@@ -0,0 +1,44 @@
+<?php
+/**
+ * Fociz Uitloggen
+ */
+
+require_once __DIR__ . '/../includes/auth.php';
+start_secure_session();
+
+// Vernietig persistente login in database
+if (!empty($_SESSION['user_id'])) {
+    try {
+        $db = get_db_connection();
+        ensure_remember_token_columns($db);
+        $stmt = $db->prepare("UPDATE users SET remember_token = NULL, remember_token_expires_at = NULL WHERE id = ?");
+        $stmt->execute([$_SESSION['user_id']]);
+    } catch (Throwable $e) {
+        // Stil negeren bij uitloggen
+    }
+}
+
+// Verwijder remember cookie
+clear_remember_cookie();
+
+// Vernietig alle sessie variabelen
+$_SESSION = [];
+
+if (ini_get("session.use_cookies")) {
+    $params = session_get_cookie_params();
+    setcookie(
+        session_name(),
+        '',
+        time() - 42000,
+        $params["path"],
+        $params["domain"],
+        $params["secure"],
+        $params["httponly"]
+    );
+}
+
+session_destroy();
+
+header('Location: /auth/login.php');
+exit;
+
@@ -0,0 +1,50 @@
+<?php
+/**
+ * Startpunt voor Microsoft 365 OAuth 2.0 Flow
+ */
+
+require_once __DIR__ . '/../includes/auth.php';
+require_once __DIR__ . '/../includes/integrations/microsoft.php';
+
+$user = require_auth();
+$db = get_db_connection();
+
+// Haal centrale Microsoft app configuratie op (env of admin instellingen)
+$appConfig = microsoft_get_app_config();
+
+$clientId = !empty($_GET['client_id']) ? trim($_GET['client_id']) : $appConfig['client_id'];
+$tenantId = !empty($_GET['tenant_id']) ? trim($_GET['tenant_id']) : $appConfig['tenant_id'];
+
+// Voorkom AADSTS50194: single-tenant Azure applicaties mogen NOOIT het /common endpoint gebruiken
+if (empty($tenantId) || $tenantId === 'common') {
+    $userEmail = $user['email'] ?? '';
+    $parts = explode('@', $userEmail);
+    $domain = strtolower(trim(end($parts)));
+    if (!empty($domain) && !in_array($domain, ['gmail.com', 'outlook.com', 'hotmail.com', 'live.com', 'yahoo.com', 'icloud.com'])) {
+        $tenantId = $domain;
+    } else {
+        $tenantId = 'planningsagenda.nl';
+    }
+}
+
+if (empty($clientId)) {
+    $err = ($user['role'] === 'ADMIN')
+        ? 'Vul eerst de Application (Client) ID en het Client Secret in bij het Systeembeheer om te koppelen met Microsoft 365.'
+        : 'Microsoft 365 is nog niet geconfigureerd door de beheerder van uw organisatie. Vraag uw beheerder om de koppeling in te stellen.';
+    header('Location: /profile.php?error=' . urlencode($err));
+    exit;
+}
+
+// Bepaal de dynamische of geconfigureerde redirect URI
+$redirectUri = rtrim(APP_URL, '/') . '/auth/callback_microsoft.php';
+
+// Genereer cryptografisch ondertekende OAuth state waarin de user_id en timestamp veilig zijn opgeslagen
+$state = generate_oauth_state((int)$user['id']);
+$_SESSION['ms_oauth_state'] = $state;
+$_SESSION['ms_oauth_user_id'] = (int)$user['id'];
+
+// Stuur gebruiker door naar Microsoft login
+$authUrl = microsoft_get_auth_url($clientId, $redirectUri, $tenantId, $state);
+header("Location: {$authUrl}");
+exit;
+
@@ -0,0 +1,213 @@
+<?php
+/**
+ * Fociz First-Run Admin Initialisatie Wizard
+ */
+
+require_once __DIR__ . '/../includes/auth.php';
+start_secure_session();
+
+// Als er al een beheerder bestaat, sluit deze pagina direct af
+if (has_admin_user()) {
+    header('Location: /auth/login.php');
+    exit;
+}
+
+$error = null;
+$success = false;
+$backupCodes = [];
+$email = '';
+
+// Haal of genereer een tijdelijke sessie-sleutel voor de 2FA configuratie
+if (empty($_SESSION['setup_totp_secret'])) {
+    $_SESSION['setup_totp_secret'] = TOTP::generateSecret(16);
+}
+$secret = $_SESSION['setup_totp_secret'];
+
+// Formulierverwerking
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    $name = trim($_POST['name'] ?? '');
+    $email = strtolower(trim($_POST['email'] ?? ''));
+    $password = $_POST['password'] ?? '';
+    $confirmPassword = $_POST['confirm_password'] ?? '';
+    $totpCode = trim($_POST['totp_code'] ?? '');
+
+    if (empty($name) || empty($email) || empty($password) || empty($totpCode)) {
+        $error = "Alle velden (inclusief de 2FA verificatiecode) zijn verplicht.";
+    } elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
+        $error = "Voer een geldig e-mailadres in.";
+    } elseif (strlen($password) < 8) {
+        $error = "Het wachtwoord moet minimaal 8 tekens bevatten.";
+    } elseif ($password !== $confirmPassword) {
+        $error = "De ingevoerde wachtwoorden komen niet overeen.";
+    } elseif (!TOTP::verifyCode($secret, $totpCode)) {
+        $error = "Ongeldige 2FA verificatiecode. Zorg dat de tijd op uw telefoon gelijk loopt en probeer opnieuw.";
+    } else {
+        // Alles klopt: maak de allereerste Admin gebruiker aan in MariaDB!
+        try {
+            $db = get_db_connection();
+            $passwordHash = password_hash($password, PASSWORD_DEFAULT);
+            $backupCodes = TOTP::generateBackupCodes(8);
+
+            $stmt = $db->prepare("
+                INSERT INTO users (name, email, password_hash, role, two_factor_secret, two_factor_enabled, backup_codes)
+                VALUES (?, ?, ?, 'ADMIN', ?, 1, ?)
+            ");
+            $stmt->execute([
+                $name,
+                $email,
+                $passwordHash,
+                $secret,
+                json_encode($backupCodes)
+            ]);
+
+            $adminId = (int)$db->lastInsertId();
+
+            // Automatische sessie starten
+            $_SESSION['user_id'] = $adminId;
+            $_SESSION['user_name'] = $name;
+            $_SESSION['user_email'] = $email;
+            $_SESSION['user_role'] = 'ADMIN';
+            $_SESSION['is_2fa_verified'] = true;
+            issue_remember_token($adminId);
+            unset($_SESSION['setup_totp_secret']);
+
+            $success = true;
+        } catch (Exception $e) {
+            $error = "Fout bij aanmaken beheerder in MariaDB: " . $e->getMessage();
+        }
+    }
+}
+
+$otpAuthUrl = TOTP::getOtpAuthUrl(!empty($email) ? $email : 'admin@fociz.local', $secret, 'Fociz');
+$qrCodeUrl = TOTP::getQrCodeUrl($otpAuthUrl, 200);
+$pageTitle = "Fociz — Eerste Initialisatie";
+?>
+<!DOCTYPE html>
+<html lang="nl" class="dark">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title><?= htmlspecialchars($pageTitle) ?></title>
+    <script src="https://cdn.tailwindcss.com"></script>
+    <script src="https://unpkg.com/lucide@latest"></script>
+    <style>body { background-color: #090d16; color: #f1f5f9; }</style>
+</head>
+<body class="min-h-screen flex items-center justify-center p-4 bg-gradient-to-br from-[#090d16] via-[#0f172a] to-[#090d16]">
+
+<?php require_once __DIR__ . '/../includes/env_badge.php'; ?>
+
+<div class="w-full max-w-xl bg-slate-900/90 border border-slate-800 rounded-2xl shadow-2xl backdrop-blur-xl p-8">
+    <!-- Header -->
+    <div class="text-center mb-8">
+        <div class="inline-flex items-center justify-center w-14 h-14 rounded-2xl bg-emerald-500/10 border border-emerald-500/30 text-emerald-400 mb-3 shadow-lg shadow-emerald-500/10">
+            <i data-lucide="shield-check" class="w-8 h-8"></i>
+        </div>
+        <h1 class="text-3xl font-bold tracking-tight text-white">Fociz Initialisatie</h1>
+        <p class="text-slate-400 text-sm mt-1">
+            Eenmalige configuratie van het hoofdbeheerdersaccount met verplichte 2FA
+        </p>
+    </div>
+
+    <?php if ($error): ?>
+        <div class="mb-6 p-4 rounded-xl bg-red-500/10 border border-red-500/30 flex items-start space-x-3 text-red-400 text-sm">
+            <i data-lucide="alert-triangle" class="w-5 h-5 flex-shrink-0 mt-0.5"></i>
+            <span><?= htmlspecialchars($error) ?></span>
+        </div>
+    <?php endif; ?>
+
+    <?php if ($success): ?>
+        <!-- Stap 3: Voltooid met backup codes -->
+        <div class="text-center space-y-6">
+            <div class="w-16 h-16 bg-emerald-500/20 text-emerald-400 rounded-full flex items-center justify-center mx-auto border border-emerald-500/40">
+                <i data-lucide="check-circle-2" class="w-10 h-10"></i>
+            </div>
+            <div>
+                <h2 class="text-2xl font-bold text-white mb-1">Beheerder Geïnstalleerd!</h2>
+                <p class="text-slate-400 text-sm">
+                    Uw account is aangemaakt en direct beveiligd met 2FA. Bewaar deze eenmalige herstelcodes veilig:
+                </p>
+            </div>
+
+            <div class="bg-slate-950/90 border border-slate-800 rounded-xl p-4 text-left">
+                <div class="text-xs font-semibold text-slate-400 mb-2">HERSTELCODES (NOODGEBRUIK):</div>
+                <div class="grid grid-cols-2 gap-2 font-mono text-xs text-slate-300">
+                    <?php foreach ($backupCodes as $code): ?>
+                        <span class="bg-slate-900 px-2.5 py-1.5 rounded border border-slate-800 text-center"><?= htmlspecialchars($code) ?></span>
+                    <?php endforeach; ?>
+                </div>
+            </div>
+
+            <a href="/planner.php" class="inline-flex items-center justify-center w-full bg-emerald-500 hover:bg-emerald-600 text-slate-950 font-bold py-3 px-4 rounded-xl transition shadow-lg shadow-emerald-500/20 space-x-2">
+                <span>Start met Fociz Dagplanning</span>
+                <i data-lucide="arrow-right" class="w-4 h-4"></i>
+            </a>
+        </div>
+
+    <?php else: ?>
+
+        <form method="POST" action="/auth/setup.php" class="space-y-5">
+            <!-- Account Info -->
+            <div class="space-y-4">
+                <div>
+                    <label class="block text-xs font-medium text-slate-300 mb-1">Volledige naam</label>
+                    <input type="text" name="name" required placeholder="Bijv. Jan de Vries" value="<?= htmlspecialchars($_POST['name'] ?? '') ?>" class="w-full bg-slate-800/80 border border-slate-700 rounded-xl px-4 py-2.5 text-white placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-emerald-500/50 text-sm transition">
+                </div>
+
+                <div>
+                    <label class="block text-xs font-medium text-slate-300 mb-1">Beheerder E-mailadres</label>
+                    <input type="email" name="email" required placeholder="admin@bedrijf.nl" value="<?= htmlspecialchars($_POST['email'] ?? '') ?>" class="w-full bg-slate-800/80 border border-slate-700 rounded-xl px-4 py-2.5 text-white placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-emerald-500/50 text-sm transition">
+                </div>
+
+                <div class="grid grid-cols-1 sm:grid-cols-2 gap-3">
+                    <div>
+                        <label class="block text-xs font-medium text-slate-300 mb-1">Wachtwoord (min. 8 tekens)</label>
+                        <input type="password" name="password" required placeholder="••••••••" class="w-full bg-slate-800/80 border border-slate-700 rounded-xl px-4 py-2.5 text-white placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-emerald-500/50 text-sm transition">
+                    </div>
+                    <div>
+                        <label class="block text-xs font-medium text-slate-300 mb-1">Bevestig wachtwoord</label>
+                        <input type="password" name="confirm_password" required placeholder="••••••••" class="w-full bg-slate-800/80 border border-slate-700 rounded-xl px-4 py-2.5 text-white placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-emerald-500/50 text-sm transition">
+                    </div>
+                </div>
+            </div>
+
+            <!-- 2FA QR Code & Koppeling -->
+            <div class="mt-6 pt-6 border-t border-slate-800 text-center space-y-4">
+                <h3 class="text-sm font-bold text-white uppercase tracking-wider flex items-center justify-center space-x-1.5 text-emerald-400">
+                    <i data-lucide="key" class="w-4 h-4"></i>
+                    <span>Tweestapsverificatie (2FA) Koppelen</span>
+                </h3>
+                <p class="text-xs text-slate-400 max-w-md mx-auto">
+                    Scan onderstaande QR-code met uw authenticator app (Google Authenticator, Microsoft Authenticator of 1Password):
+                </p>
+
+                <div class="inline-block p-3 bg-white rounded-2xl shadow-xl">
+                    <img src="<?= htmlspecialchars($qrCodeUrl) ?>" alt="2FA QR Code" class="w-44 h-44 mx-auto">
+                </div>
+
+                <div class="bg-slate-800/60 border border-slate-700/80 rounded-xl p-2.5 text-xs text-slate-400 max-w-sm mx-auto font-mono flex items-center justify-between">
+                    <span>Sleutel: <strong class="text-slate-200"><?= htmlspecialchars($secret) ?></strong></span>
+                </div>
+
+                <div>
+                    <label class="block text-xs font-medium text-slate-300 mb-1.5">
+                        Voer de 6-cijferige verificatiecode uit uw app in:
+                    </label>
+                    <input type="text" name="totp_code" required maxlength="6" placeholder="123456" class="w-48 mx-auto block text-center tracking-[0.5em] font-mono text-xl bg-slate-800 border border-slate-700 rounded-xl py-2 text-white focus:outline-none focus:ring-2 focus:ring-emerald-500/50 transition">
+                </div>
+            </div>
+
+            <button type="submit" class="w-full mt-6 bg-emerald-500 hover:bg-emerald-600 text-slate-950 font-bold py-3 px-4 rounded-xl transition shadow-lg shadow-emerald-500/20 flex items-center justify-center space-x-2">
+                <span>Account & 2FA Bevestigen</span>
+                <i data-lucide="check-circle-2" class="w-4 h-4"></i>
+            </button>
+        </form>
+
+    <?php endif; ?>
+</div>
+
+<script>
+    if (typeof lucide !== 'undefined') lucide.createIcons();
+</script>
+</body>
+</html>
+