275 lines
12 KiB
PHP
275 lines
12 KiB
PHP
<?php
|
|
/**
|
|
* Fociz Veilige Login met Tweestapsverificatie (2FA)
|
|
*/
|
|
|
|
require_once __DIR__ . '/../includes/auth.php';
|
|
start_secure_session();
|
|
|
|
// Als er nog geen admin is, direct naar setup
|
|
if (!has_admin_user()) {
|
|
header('Location: /auth/setup.php');
|
|
exit;
|
|
}
|
|
|
|
// Als al ingelogd (via actieve sessie of persistente cookie), ga direct naar planner
|
|
$currentUser = get_logged_in_user();
|
|
if ($currentUser) {
|
|
header('Location: /planner.php');
|
|
exit;
|
|
}
|
|
|
|
$error = null;
|
|
$infoMessage = null;
|
|
if (isset($_GET['expired'])) {
|
|
$infoMessage = "Uw dagsessie is om 23:59 beëindigd. Log opnieuw in om een nieuwe werkdag te starten.";
|
|
}
|
|
$step = isset($_SESSION['pending_2fa_user_id']) ? 2 : 1;
|
|
|
|
// Terug naar stap 1
|
|
if (isset($_GET['action']) && $_GET['action'] === 'restart') {
|
|
unset($_SESSION['pending_2fa_user_id'], $_SESSION['pending_2fa_user_email']);
|
|
header('Location: /auth/login.php');
|
|
exit;
|
|
}
|
|
|
|
// POST Verwerking
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
|
$db = get_db_connection();
|
|
|
|
// STAP 1: Wachtwoord verificatie
|
|
if ($step === 1) {
|
|
$email = strtolower(trim($_POST['email'] ?? ''));
|
|
$password = $_POST['password'] ?? '';
|
|
|
|
if (empty($email) || empty($password)) {
|
|
$error = "Vul e-mailadres en wachtwoord in.";
|
|
} else {
|
|
$stmt = $db->prepare("SELECT id, name, email, password_hash, two_factor_secret, two_factor_enabled FROM users WHERE email = ?");
|
|
$stmt->execute([$email]);
|
|
$user = $stmt->fetch();
|
|
|
|
if ($user && password_verify($password, $user['password_hash'])) {
|
|
// Succesvol stap 1: zet tijdelijke pending sessie voor 2FA
|
|
$_SESSION['pending_2fa_user_id'] = $user['id'];
|
|
$_SESSION['pending_2fa_user_email'] = $user['email'];
|
|
$_SESSION['pending_2fa_user_name'] = $user['name'];
|
|
$step = 2;
|
|
} else {
|
|
$error = "Onjuist e-mailadres of wachtwoord.";
|
|
}
|
|
}
|
|
}
|
|
// STAP 2: 2FA TOTP Code verificatie
|
|
elseif ($step === 2) {
|
|
$userId = $_SESSION['pending_2fa_user_id'] ?? null;
|
|
$totpCode = trim($_POST['totp_code'] ?? '');
|
|
|
|
if (!$userId) {
|
|
header('Location: /auth/login.php');
|
|
exit;
|
|
}
|
|
|
|
if (empty($totpCode)) {
|
|
$error = "Vul de 6-cijferige 2FA code in uit uw authenticator app.";
|
|
} else {
|
|
$stmt = $db->prepare("SELECT * FROM users WHERE id = ?");
|
|
$stmt->execute([$userId]);
|
|
$user = $stmt->fetch();
|
|
|
|
$isValid = false;
|
|
|
|
// Controleer reguliere TOTP code
|
|
if (!empty($user['two_factor_secret'])) {
|
|
try {
|
|
$isValid = TOTP::verifyCode($user['two_factor_secret'], $totpCode);
|
|
} catch (Throwable $t) {
|
|
error_log("TOTP verificatiefout: " . $t->getMessage());
|
|
$isValid = false;
|
|
}
|
|
}
|
|
|
|
// Fallback: controleer 8-karakter backup codes
|
|
if (!$isValid && !empty($user['backup_codes'])) {
|
|
$backupCodes = json_decode($user['backup_codes'], true) ?: [];
|
|
$codeUpper = strtoupper($totpCode);
|
|
$key = array_search($codeUpper, $backupCodes);
|
|
if ($key !== false) {
|
|
$isValid = true;
|
|
// Verbruik de backup code
|
|
unset($backupCodes[$key]);
|
|
$stmtUpdate = $db->prepare("UPDATE users SET backup_codes = ? WHERE id = ?");
|
|
$stmtUpdate->execute([json_encode(array_values($backupCodes)), $userId]);
|
|
}
|
|
}
|
|
|
|
if ($isValid) {
|
|
// Volledige login succesvol (geldig tot 23:59:59 van vandaag)
|
|
$_SESSION['user_id'] = $user['id'];
|
|
$_SESSION['user_name'] = $user['name'];
|
|
$_SESSION['user_email'] = $user['email'];
|
|
$_SESSION['user_role'] = $user['role'];
|
|
$_SESSION['is_2fa_verified'] = true;
|
|
$_SESSION['auth_date'] = date('Y-m-d');
|
|
$_SESSION['session_expires_at'] = strtotime('today 23:59:59');
|
|
|
|
// Zorg dat er geen persistente remember cookies worden gebruikt
|
|
clear_remember_cookie();
|
|
|
|
unset($_SESSION['pending_2fa_user_id'], $_SESSION['pending_2fa_user_email'], $_SESSION['pending_2fa_user_name']);
|
|
|
|
header('Location: /planner.php');
|
|
exit;
|
|
} else {
|
|
$error = "Onjuiste 2FA code. Controleer uw authenticator app en probeer opnieuw.";
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
$pageTitle = "Fociz — Inloggen";
|
|
?>
|
|
<!DOCTYPE html>
|
|
<html lang="nl" class="dark">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title><?= htmlspecialchars($pageTitle) ?></title>
|
|
<!-- Anti-flicker script: Laad direct het gekozen thema uit localStorage vóór DOM render -->
|
|
<script>
|
|
(function() {
|
|
var activeTheme = localStorage.getItem('fociz_theme') || 'dark';
|
|
var isDark = true;
|
|
if (activeTheme === 'dark') isDark = true;
|
|
else if (activeTheme === 'light') isDark = false;
|
|
else if (activeTheme === 'system') {
|
|
isDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
|
|
}
|
|
if (isDark) document.documentElement.classList.add('dark');
|
|
else document.documentElement.classList.remove('dark');
|
|
})();
|
|
</script>
|
|
<script src="https://cdn.tailwindcss.com"></script>
|
|
<script>
|
|
tailwind.config = {
|
|
darkMode: 'class',
|
|
theme: {
|
|
extend: {
|
|
colors: {
|
|
slate: {
|
|
850: '#151f32',
|
|
950: '#070b12',
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
</script>
|
|
<script src="https://unpkg.com/lucide@latest"></script>
|
|
<link rel="preconnect" href="https://fonts.googleapis.com">
|
|
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
|
|
<link href="https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:wght@300;400;500;600;700;800&display=swap" rel="stylesheet">
|
|
<style>
|
|
body { font-family: 'Plus Jakarta Sans', sans-serif; }
|
|
</style>
|
|
</head>
|
|
<body class="min-h-screen flex items-center justify-center p-4 bg-[#f8fafc] dark:bg-[#0c0f17] text-slate-900 dark:text-slate-100 transition-colors">
|
|
|
|
<?php require_once __DIR__ . '/../includes/env_badge.php'; ?>
|
|
|
|
<div class="w-full max-w-md bg-white dark:bg-[#111622] border border-slate-200 dark:border-slate-800/80 rounded-2xl shadow-xs backdrop-blur-xl p-8 transition">
|
|
<!-- Header -->
|
|
<div class="text-center mb-8">
|
|
<div class="inline-flex items-center justify-center w-14 h-14 rounded-2xl bg-indigo-50 dark:bg-indigo-950/40 border border-indigo-200 dark:border-indigo-800/60 text-indigo-600 dark:text-indigo-400 mb-3 shadow-xs">
|
|
<i data-lucide="shield-check" class="w-8 h-8"></i>
|
|
</div>
|
|
<h1 class="text-3xl font-black tracking-tight text-slate-900 dark:text-white">Fociz</h1>
|
|
<p class="text-slate-500 dark:text-slate-400 text-sm mt-1">
|
|
Veilig inloggen met tweestapsverificatie (2FA)
|
|
</p>
|
|
</div>
|
|
|
|
<?php if ($infoMessage): ?>
|
|
<div class="mb-6 p-4 rounded-2xl bg-sky-500/10 border border-sky-500/30 flex items-start space-x-3 text-sky-800 dark:text-sky-300 text-xs sm:text-sm">
|
|
<i data-lucide="info" class="w-5 h-5 flex-shrink-0 mt-0.5 text-sky-600 dark:text-sky-400"></i>
|
|
<span><?= htmlspecialchars($infoMessage) ?></span>
|
|
</div>
|
|
<?php endif; ?>
|
|
|
|
<?php if ($error): ?>
|
|
<div class="mb-6 p-4 rounded-2xl bg-red-500/10 border border-red-500/30 flex items-start space-x-3 text-red-700 dark:text-red-400 text-sm">
|
|
<i data-lucide="alert-triangle" class="w-5 h-5 flex-shrink-0 mt-0.5"></i>
|
|
<span><?= htmlspecialchars($error) ?></span>
|
|
</div>
|
|
<?php endif; ?>
|
|
|
|
<?php if ($step === 1): ?>
|
|
<!-- STAP 1: E-mail & Wachtwoord -->
|
|
<form method="POST" action="/auth/login.php" class="space-y-4">
|
|
<div>
|
|
<label class="block text-xs font-semibold text-slate-700 dark:text-slate-300 mb-1">E-mailadres</label>
|
|
<div class="relative">
|
|
<input type="email" name="email" required autofocus placeholder="uw.naam@bedrijf.nl" value="<?= htmlspecialchars($_POST['email'] ?? '') ?>" class="w-full bg-slate-50 dark:bg-[#0c0f17] border border-slate-300 dark:border-slate-800 rounded-xl px-4 py-2.5 text-slate-900 dark:text-white placeholder-slate-400 dark:placeholder-slate-500 focus:outline-none focus:ring-1 focus:ring-indigo-500 text-sm transition">
|
|
</div>
|
|
</div>
|
|
|
|
<div>
|
|
<label class="block text-xs font-semibold text-slate-700 dark:text-slate-300 mb-1">Wachtwoord</label>
|
|
<div class="relative">
|
|
<input type="password" name="password" required placeholder="••••••••" class="w-full bg-slate-50 dark:bg-[#0c0f17] border border-slate-300 dark:border-slate-800 rounded-xl px-4 py-2.5 text-slate-900 dark:text-white placeholder-slate-400 dark:placeholder-slate-500 focus:outline-none focus:ring-1 focus:ring-indigo-500 text-sm transition">
|
|
</div>
|
|
</div>
|
|
|
|
<button type="submit" class="w-full mt-4 bg-indigo-600 hover:bg-indigo-500 text-white font-bold py-3 px-4 rounded-xl transition shadow-xs flex items-center justify-center space-x-2 cursor-pointer">
|
|
<span>Verder naar 2FA</span>
|
|
<i data-lucide="arrow-right" class="w-4 h-4"></i>
|
|
</button>
|
|
</form>
|
|
|
|
<?php else: ?>
|
|
|
|
<!-- STAP 2: 2FA TOTP Code -->
|
|
<form method="POST" action="/auth/login.php" class="space-y-5">
|
|
<div class="text-center">
|
|
<div class="inline-flex items-center justify-center w-12 h-12 rounded-xl bg-indigo-50 dark:bg-indigo-950/40 text-indigo-600 dark:text-indigo-400 mb-2">
|
|
<i data-lucide="key" class="w-6 h-6"></i>
|
|
</div>
|
|
<p class="text-sm text-slate-800 dark:text-slate-300 font-semibold">
|
|
Voer uw 6-cijferige verificatiecode in
|
|
</p>
|
|
<p class="text-xs text-slate-500 dark:text-slate-400 mt-1">
|
|
Gekoppeld aan <strong class="text-slate-900 dark:text-slate-200"><?= htmlspecialchars($_SESSION['pending_2fa_user_email'] ?? '') ?></strong>
|
|
</p>
|
|
</div>
|
|
|
|
<div>
|
|
<input type="text" name="totp_code" required autofocus maxlength="9" placeholder="000 000" class="w-full text-center tracking-[0.4em] font-mono text-2xl bg-slate-50 dark:bg-[#0c0f17] border border-slate-300 dark:border-slate-800 rounded-xl py-3 text-slate-900 dark:text-white placeholder-slate-400 dark:placeholder-slate-600 focus:outline-none focus:ring-1 focus:ring-indigo-500 transition">
|
|
<span class="text-[11px] text-slate-500 dark:text-slate-500 text-center block mt-1">
|
|
Tip: U kunt ook een 8-cijferige herstelcode invoeren.
|
|
</span>
|
|
</div>
|
|
|
|
<div class="flex space-x-3">
|
|
<a href="/auth/login.php?action=restart" class="w-1/3 text-center bg-slate-100 hover:bg-slate-200 dark:bg-slate-800 dark:hover:bg-slate-700 text-slate-700 dark:text-slate-300 font-medium py-2.5 px-3 rounded-xl transition text-sm flex items-center justify-center cursor-pointer">
|
|
Terug
|
|
</a>
|
|
<button type="submit" class="w-2/3 bg-indigo-600 hover:bg-indigo-500 text-white font-bold py-2.5 px-4 rounded-xl transition shadow-xs flex items-center justify-center space-x-2 cursor-pointer">
|
|
<span>Inloggen</span>
|
|
<i data-lucide="check-circle-2" class="w-4 h-4"></i>
|
|
</button>
|
|
</div>
|
|
</form>
|
|
|
|
<?php endif; ?>
|
|
|
|
<div class="mt-8 pt-6 border-t border-slate-100 dark:border-slate-800/80 text-center text-xs text-slate-500">
|
|
Toegang tot Fociz is strikt op uitnodiging. Vraag uw beheerder om een uitnodigingslink.
|
|
</div>
|
|
</div>
|
|
|
|
<script>
|
|
if (typeof lucide !== 'undefined') lucide.createIcons();
|
|
</script>
|
|
</body>
|
|
</html>
|