261 lines
14 KiB
PHP
261 lines
14 KiB
PHP
<?php
|
|
/**
|
|
* Fociz First-Run Admin Initialisatie Wizard
|
|
*/
|
|
|
|
require_once __DIR__ . '/../includes/auth.php';
|
|
start_secure_session();
|
|
|
|
// Als er al een beheerder bestaat, sluit deze pagina direct af
|
|
if (has_admin_user()) {
|
|
header('Location: /auth/login.php');
|
|
exit;
|
|
}
|
|
|
|
$error = null;
|
|
$success = false;
|
|
$backupCodes = [];
|
|
$email = '';
|
|
|
|
// Haal of genereer een tijdelijke sessie-sleutel voor de 2FA configuratie
|
|
if (empty($_SESSION['setup_totp_secret'])) {
|
|
$_SESSION['setup_totp_secret'] = TOTP::generateSecret(16);
|
|
}
|
|
$secret = $_SESSION['setup_totp_secret'];
|
|
|
|
// Formulierverwerking
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
|
$name = trim($_POST['name'] ?? '');
|
|
$email = strtolower(trim($_POST['email'] ?? ''));
|
|
$password = $_POST['password'] ?? '';
|
|
$confirmPassword = $_POST['confirm_password'] ?? '';
|
|
$totpCode = trim($_POST['totp_code'] ?? '');
|
|
|
|
if (empty($name) || empty($email) || empty($password) || empty($totpCode)) {
|
|
$error = "Alle velden (inclusief de 2FA verificatiecode) zijn verplicht.";
|
|
} elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
|
|
$error = "Voer een geldig e-mailadres in.";
|
|
} elseif (($pwErr = fociz_validate_password($password)) !== null) {
|
|
$error = $pwErr;
|
|
} elseif ($password !== $confirmPassword) {
|
|
$error = "De ingevoerde wachtwoorden komen niet overeen.";
|
|
} elseif (!TOTP::verifyCode($secret, $totpCode)) {
|
|
$error = "Ongeldige 2FA verificatiecode. Zorg dat de tijd op uw telefoon gelijk loopt en probeer opnieuw.";
|
|
} else {
|
|
// Alles klopt: maak de allereerste Admin gebruiker aan in MariaDB!
|
|
try {
|
|
$db = get_db_connection();
|
|
$passwordHash = password_hash($password, PASSWORD_DEFAULT);
|
|
$backupCodes = TOTP::generateBackupCodes(8);
|
|
|
|
$stmt = $db->prepare("
|
|
INSERT INTO users (name, email, password_hash, role, two_factor_secret, two_factor_enabled, backup_codes)
|
|
VALUES (?, ?, ?, 'ADMIN', ?, 1, ?)
|
|
");
|
|
$stmt->execute([
|
|
$name,
|
|
$email,
|
|
$passwordHash,
|
|
$secret,
|
|
json_encode($backupCodes)
|
|
]);
|
|
|
|
$adminId = (int)$db->lastInsertId();
|
|
|
|
// Automatische dagsessie starten (geldig tot 23:59:59)
|
|
$_SESSION['user_id'] = $adminId;
|
|
$_SESSION['user_name'] = $name;
|
|
$_SESSION['user_email'] = $email;
|
|
$_SESSION['user_role'] = 'ADMIN';
|
|
$_SESSION['is_2fa_verified'] = true;
|
|
$_SESSION['auth_date'] = date('Y-m-d');
|
|
$_SESSION['session_expires_at'] = strtotime('today 23:59:59');
|
|
clear_remember_cookie();
|
|
unset($_SESSION['setup_totp_secret']);
|
|
|
|
fociz_log_audit($adminId, 'INITIAL_ADMIN_SETUP', 'user', $adminId, ['email' => $email, 'name' => $name], 'SUCCESS', $email);
|
|
|
|
$success = true;
|
|
} catch (Exception $e) {
|
|
$error = "Fout bij aanmaken beheerder in MariaDB: " . $e->getMessage();
|
|
}
|
|
}
|
|
}
|
|
|
|
$otpAuthUrl = TOTP::getOtpAuthUrl(!empty($email) ? $email : 'admin@fociz.local', $secret, 'Fociz');
|
|
$qrCodeUrl = TOTP::getQrCodeUrl($otpAuthUrl, 200);
|
|
$pageTitle = "Fociz — Eerste Initialisatie";
|
|
?>
|
|
<!DOCTYPE html>
|
|
<html lang="nl" class="dark">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title><?= htmlspecialchars($pageTitle) ?></title>
|
|
<link rel="icon" type="image/svg+xml" href="/assets/favicon.svg">
|
|
<link rel="alternate icon" href="/favicon.ico">
|
|
<!-- Anti-flicker script: Laad direct het gekozen thema uit localStorage -->
|
|
<script>
|
|
(function() {
|
|
var activeTheme = localStorage.getItem('fociz_theme') || 'dark';
|
|
var isDark = true;
|
|
if (activeTheme === 'dark') isDark = true;
|
|
else if (activeTheme === 'light') isDark = false;
|
|
else if (activeTheme === 'system') {
|
|
isDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
|
|
}
|
|
if (isDark) document.documentElement.classList.add('dark');
|
|
else document.documentElement.classList.remove('dark');
|
|
})();
|
|
</script>
|
|
<script src="https://cdn.tailwindcss.com"></script>
|
|
<script>
|
|
tailwind.config = {
|
|
darkMode: 'class',
|
|
theme: {
|
|
extend: {
|
|
colors: {
|
|
slate: { 850: '#151f32', 950: '#070b12' }
|
|
}
|
|
}
|
|
}
|
|
}
|
|
</script>
|
|
<script src="https://unpkg.com/lucide@latest"></script>
|
|
<link rel="preconnect" href="https://fonts.googleapis.com">
|
|
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
|
|
<link href="https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:wght@300;400;500;600;700;800&display=swap" rel="stylesheet">
|
|
<style>body { font-family: 'Plus Jakarta Sans', sans-serif; }</style>
|
|
</head>
|
|
<body class="min-h-screen flex items-center justify-center p-4 bg-[#f8fafc] dark:bg-[#0c0f17] text-slate-900 dark:text-slate-100 transition-colors">
|
|
|
|
<?php require_once __DIR__ . '/../includes/env_badge.php'; ?>
|
|
|
|
<div class="w-full max-w-xl bg-white dark:bg-[#111622] border border-slate-200 dark:border-slate-800/80 rounded-2xl shadow-xs backdrop-blur-xl p-8 transition">
|
|
<!-- Header -->
|
|
<div class="text-center mb-8">
|
|
<div class="inline-flex items-center justify-center w-14 h-14 rounded-2xl bg-indigo-50 dark:bg-indigo-950/40 border border-indigo-200 dark:border-indigo-800/60 text-indigo-600 dark:text-indigo-400 mb-3 shadow-xs">
|
|
<i data-lucide="shield-check" class="w-8 h-8"></i>
|
|
</div>
|
|
<h1 class="text-3xl font-black tracking-tight text-slate-900 dark:text-white">Fociz Initialisatie</h1>
|
|
<p class="text-slate-500 dark:text-slate-400 text-sm mt-1">
|
|
Eenmalige configuratie van het hoofdbeheerdersaccount met verplichte 2FA
|
|
</p>
|
|
</div>
|
|
|
|
<?php if ($error): ?>
|
|
<div class="mb-6 p-4 rounded-2xl bg-red-500/10 border border-red-500/30 flex items-start space-x-3 text-red-700 dark:text-red-400 text-sm">
|
|
<i data-lucide="alert-triangle" class="w-5 h-5 flex-shrink-0 mt-0.5"></i>
|
|
<span><?= htmlspecialchars($error) ?></span>
|
|
</div>
|
|
<?php endif; ?>
|
|
|
|
<?php if ($success): ?>
|
|
<!-- Stap 3: Voltooid met backup codes -->
|
|
<div class="text-center space-y-6">
|
|
<div class="w-16 h-16 bg-teal-50 dark:bg-teal-950/40 text-teal-600 dark:text-teal-400 rounded-2xl flex items-center justify-center mx-auto border border-teal-200 dark:border-teal-800/60 shadow-xs">
|
|
<i data-lucide="check-circle-2" class="w-10 h-10"></i>
|
|
</div>
|
|
<div>
|
|
<h2 class="text-2xl font-black text-slate-900 dark:text-white mb-1">Beheerder Geïnstalleerd!</h2>
|
|
<p class="text-slate-500 dark:text-slate-400 text-sm">
|
|
Uw account is aangemaakt en direct beveiligd met 2FA. Bewaar deze eenmalige herstelcodes veilig:
|
|
</p>
|
|
</div>
|
|
|
|
<div class="bg-slate-50 dark:bg-[#0c0f17] border border-slate-200 dark:border-slate-800 rounded-2xl p-4 text-left">
|
|
<div class="text-xs font-semibold text-slate-500 dark:text-slate-400 mb-2">HERSTELCODES (NOODGEBRUIK):</div>
|
|
<div class="grid grid-cols-2 gap-2 font-mono text-xs text-slate-800 dark:text-slate-300">
|
|
<?php foreach ($backupCodes as $code): ?>
|
|
<span class="bg-white dark:bg-[#111622] px-2.5 py-1.5 rounded-xl border border-slate-200 dark:border-slate-800 text-center font-bold"><?= htmlspecialchars($code) ?></span>
|
|
<?php endforeach; ?>
|
|
</div>
|
|
</div>
|
|
|
|
<a href="/planner.php" class="inline-flex items-center justify-center w-full bg-indigo-600 hover:bg-indigo-500 text-white font-bold py-3 px-4 rounded-xl transition shadow-xs space-x-2 cursor-pointer">
|
|
<span>Start met Fociz Dagplanning</span>
|
|
<i data-lucide="arrow-right" class="w-4 h-4"></i>
|
|
</a>
|
|
</div>
|
|
|
|
<?php else: ?>
|
|
|
|
<form method="POST" action="/auth/setup.php" class="space-y-5">
|
|
<!-- Account Info -->
|
|
<div class="space-y-4">
|
|
<div>
|
|
<label class="block text-xs font-semibold text-slate-700 dark:text-slate-300 mb-1">Volledige naam</label>
|
|
<input type="text" name="name" required placeholder="Bijv. Jan de Vries" value="<?= htmlspecialchars($_POST['name'] ?? '') ?>" class="w-full bg-slate-50 dark:bg-[#0c0f17] border border-slate-300 dark:border-slate-800 rounded-xl px-4 py-2.5 text-slate-900 dark:text-white placeholder-slate-400 dark:placeholder-slate-500 focus:outline-none focus:ring-1 focus:ring-indigo-500 text-sm transition">
|
|
</div>
|
|
|
|
<div>
|
|
<label class="block text-xs font-semibold text-slate-700 dark:text-slate-300 mb-1">Beheerder E-mailadres</label>
|
|
<input type="email" name="email" required placeholder="admin@bedrijf.nl" value="<?= htmlspecialchars($_POST['email'] ?? '') ?>" class="w-full bg-slate-50 dark:bg-[#0c0f17] border border-slate-300 dark:border-slate-800 rounded-xl px-4 py-2.5 text-slate-900 dark:text-white placeholder-slate-400 dark:placeholder-slate-500 focus:outline-none focus:ring-1 focus:ring-indigo-500 text-sm transition">
|
|
</div>
|
|
|
|
<div class="grid grid-cols-1 sm:grid-cols-2 gap-3">
|
|
<div>
|
|
<label class="block text-xs font-semibold text-slate-700 dark:text-slate-300 mb-1">Wachtwoord (min. 12 tekens)</label>
|
|
<input type="password" name="password" required minlength="12" placeholder="••••••••••••" class="w-full bg-slate-50 dark:bg-[#0c0f17] border border-slate-300 dark:border-slate-800 rounded-xl px-4 py-2.5 text-slate-900 dark:text-white placeholder-slate-400 dark:placeholder-slate-500 focus:outline-none focus:ring-1 focus:ring-indigo-500 text-sm transition">
|
|
</div>
|
|
<div>
|
|
<label class="block text-xs font-semibold text-slate-700 dark:text-slate-300 mb-1">Bevestig wachtwoord</label>
|
|
<input type="password" name="confirm_password" required minlength="12" placeholder="••••••••••••" class="w-full bg-slate-50 dark:bg-[#0c0f17] border border-slate-300 dark:border-slate-800 rounded-xl px-4 py-2.5 text-slate-900 dark:text-white placeholder-slate-400 dark:placeholder-slate-500 focus:outline-none focus:ring-1 focus:ring-indigo-500 text-sm transition">
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<!-- 2FA QR Code & Koppeling -->
|
|
<div class="mt-6 pt-6 border-t border-slate-100 dark:border-slate-800/80 text-center space-y-4">
|
|
<h3 class="text-sm font-bold uppercase tracking-wider flex items-center justify-center space-x-1.5 text-indigo-600 dark:text-indigo-400">
|
|
<i data-lucide="key" class="w-4 h-4"></i>
|
|
<span>Tweestapsverificatie (2FA) Koppelen</span>
|
|
</h3>
|
|
<p class="text-xs text-slate-500 dark:text-slate-400 max-w-md mx-auto">
|
|
Scan onderstaande QR-code met uw authenticator app (Google Authenticator, Microsoft Authenticator of 1Password):
|
|
</p>
|
|
|
|
<div class="inline-block p-3 bg-white rounded-2xl shadow-xs border border-slate-200 dark:border-slate-800">
|
|
<div id="qrcode" class="w-44 h-44 mx-auto flex items-center justify-center"></div>
|
|
</div>
|
|
|
|
<div class="bg-slate-50 dark:bg-[#0c0f17] border border-slate-200 dark:border-slate-800 rounded-xl p-2.5 text-xs text-slate-600 dark:text-slate-400 max-w-sm mx-auto font-mono flex items-center justify-between">
|
|
<span>Sleutel: <strong class="text-indigo-600 dark:text-indigo-400"><?= htmlspecialchars($secret) ?></strong></span>
|
|
</div>
|
|
|
|
<div>
|
|
<label class="block text-xs font-semibold text-slate-700 dark:text-slate-300 mb-1.5">
|
|
Voer de 6-cijferige verificatiecode uit uw app in:
|
|
</label>
|
|
<input type="text" name="totp_code" required maxlength="6" placeholder="123456" class="w-48 mx-auto block text-center tracking-[0.5em] font-mono text-xl bg-slate-50 dark:bg-[#0c0f17] border border-slate-300 dark:border-slate-800 rounded-xl py-2 text-slate-900 dark:text-white focus:outline-none focus:ring-1 focus:ring-indigo-500 transition">
|
|
</div>
|
|
</div>
|
|
|
|
<button type="submit" class="w-full mt-6 bg-indigo-600 hover:bg-indigo-500 text-white font-bold py-3 px-4 rounded-xl transition shadow-xs flex items-center justify-center space-x-2 cursor-pointer">
|
|
<span>Account & 2FA Bevestigen</span>
|
|
<i data-lucide="check-circle-2" class="w-4 h-4"></i>
|
|
</button>
|
|
</form>
|
|
|
|
<?php endif; ?>
|
|
</div>
|
|
|
|
<script src="/assets/js/qrcode.min.js"></script>
|
|
<script>
|
|
if (typeof lucide !== 'undefined') lucide.createIcons();
|
|
const qrContainer = document.getElementById('qrcode');
|
|
if (qrContainer) {
|
|
new QRCode(qrContainer, {
|
|
text: <?= json_encode($otpAuthUrl) ?>,
|
|
width: 176,
|
|
height: 176,
|
|
colorDark: '#000000',
|
|
colorLight: '#ffffff',
|
|
correctLevel: QRCode.CorrectLevel.M
|
|
});
|
|
}
|
|
</script>
|
|
</body>
|
|
</html>
|
|
|