diff --git a/accounts_handler.php b/accounts_handler.php
index 34e6c0a..1ae09c3 100644
--- a/accounts_handler.php
+++ b/accounts_handler.php
@@ -30,7 +30,7 @@ function get_display_name($bcid, $use_bcid_fallback=true, $put_bcid_in_parenthes
// Tokens so apps can get VERY BASIC information
-function generate_basic_access_token($bcid): array
+function generate_basic_access_token($bcid, $application_id=""): array
{
// Returns an access token, a refresh token and an expiry timestamp.
@@ -42,14 +42,42 @@ function generate_basic_access_token($bcid): array
// echo $access_token . ":" . $refresh_token;
+ if ($application_id) {
+ db_execute(
+ "INSERT INTO tokens (access_token, refresh_token, expiry, owner_id, application_id, permissions) VALUES (?,?,?,?,?, (1<<0 | 1<<1))",
+ [$access_token, $refresh_token, $expiry, $bcid, $application_id]
+ );
+ } else {
+ db_execute(
+ "INSERT INTO tokens (access_token, refresh_token, expiry, owner_id, permissions) VALUES (?,?,?,?, (1<<0 | 1<<1))",
+ [$access_token, $refresh_token, $expiry, $bcid]
+ );
+ }
+
+ return [
+ "access" => $access_token,
+ "refresh" => $refresh_token,
+ "expiry" => $expiry,
+ "id" => $bcid
+ ];
+}
+
+function generate_token($bcid, $application_id=null, $permissions=0): array {
+ $access_token = md5(uniqid(more_entropy: true).rand(1000000, 9999999));
+ $refresh_token = md5(uniqid("rfish").rand(1000000, 9999999));
+
+ $valid_time = 12; // in hours
+ $expiry = time() + ($valid_time * 60 * 60);
+
db_execute(
- "INSERT INTO tokens (access_token, refresh_token, expiry, owner_id) VALUES (?,?,?,?)",
- [$access_token, $refresh_token, $expiry, $bcid]
+ "INSERT INTO tokens (access_token, refresh_token, expiry, owner_id, application_id, permissions, type) VALUES (?,?,?,?,?,?, 'oauth')",
+ [$access_token, $refresh_token, $expiry, $bcid, $application_id, $permissions]
);
return [
"access" => $access_token,
"refresh" => $refresh_token,
+ "permissions" => $permissions,
"expiry" => $expiry,
"id" => $bcid
];
diff --git a/admin.php b/admin.php
index d92d029..efb0b73 100644
--- a/admin.php
+++ b/admin.php
@@ -18,6 +18,11 @@
+API
+
+
Init
diff --git a/admin_create_token.php b/admin_create_token.php
new file mode 100644
index 0000000..6456f05
--- /dev/null
+++ b/admin_create_token.php
@@ -0,0 +1,86 @@
+";
+ print_r($_POST);
+ echo "";
+
+ $token = generate_token($_POST['owner'], $_POST['application'], $_POST['permissions']);
+
+ echo "Created token. Access token: ". $token['access'] ."
";
+}
+
+?>
+
+Token generator
+
+
+
+
+
+
diff --git a/api_handler.php b/api_handler.php
index 2792cb1..164e5c0 100644
--- a/api_handler.php
+++ b/api_handler.php
@@ -7,8 +7,6 @@ if (array_key_exists('HTTP_AUTHORIZATION', $_SERVER)) {
$access_token = str_replace("Bearer ", "", $_SERVER['HTTP_AUTHORIZATION']);
}
-
-
if (!empty($access_token)) {
// Check who the access token belongs to
$token = db_execute("SELECT * FROM tokens WHERE access_token = ?", [$access_token]);
@@ -27,7 +25,6 @@ function check_authorisation($token=""): int
global $token_owner;
// Validate token
if (!validate_access_token($token) && "" != $token) {
- echo "invalid";
return 0; // Unauthorised
}
@@ -50,8 +47,9 @@ function check_authorisation($token=""): int
}
return match ($token_row['type']) {
- "dangerous" => 22,
- "basic" => 1,
+ "dangerous" => 1<<0 | 1<<1, // Everything
+ "basic" => 1<<1, // Basic
+ "oauth" => $token_row['permissions'],
default => 0,
};
}
@@ -93,16 +91,12 @@ function api_user_info(): array
// `display_name` = 1 (basic)
// `id` = 1 (basic)
// `email` = 1 (basic)
-
$level = check_authorisation($access_token);
-
$data = null;
-
- if ($level >= 1) {
+ if ($level & (1 << 0)) {
$data = db_execute("SELECT id, email, display_name FROM accounts WHERE id = ? LIMIT 1", [$token_owner]);
- } if ($level == 22) {
- $data = db_execute("SELECT * FROM accounts WHERE id = ? LIMIT 1", [$token_owner]);
- unset($data['password']);
+ } else {
+ $data = db_execute("SELECT id, display_name FROM accounts WHERE id = ? LIMIT 1", [$token_owner]);
}
if (null != $data) {
@@ -117,7 +111,50 @@ function api_user_info(): array
"response_code" => 401,
"message" => "Unauthorized."
];
+}
+function api_settings(): array
+{
+ // GET: Return all settings
+ // POST/PATCH: Update settings
+
+ global $access_token, $token_owner;
+
+ $level = check_authorisation($access_token);
+
+ if (!($level & (1 << 1))) { // account.settings
+ http_response_code(401);
+ return [
+ "response_code" => 401,
+ "message" => "Unauthorized."
+ ];
+ }
+
+ if ($_SERVER['REQUEST_METHOD'] === "POST") {
+
+ // Now for the fucking worstest code ever
+ $settings_changed = json_decode(file_get_contents('php://input'), true);
+
+ if (isset($settings_changed['account'])) {
+ if (isset($settings_changed['account']['display_name'])) {
+ $display_name = db_execute('UPDATE accounts SET display_name = ? WHERE id = ?',
+ [$settings_changed['account']['display_name'], $token_owner]);
+ }
+ }
+ }
+
+ // Get account settings
+ $display_name = db_execute('SELECT display_name FROM accounts WHERE id = ?', [$token_owner])["display_name"];
+
+
+ return [
+ "response_code" => 200,
+ "settings" => [
+ "account" => [
+ "display_name" => $display_name,
+ ]
+ ]
+ ];
}
$api_routes = [ // base url is base_url.'/api'
@@ -129,6 +166,9 @@ $api_routes = [ // base url is base_url.'/api'
// Account stuff
"/account/me" => "api_user_info",
+ // Settings
+ "/settings" => "api_settings",
+
// Get avatar
"/avatars/get" => "get_avatar"
];
@@ -142,6 +182,7 @@ if (isset($api_routes[$path])) {
"response_code" => "498",
"message" => "Token expired or invalid."
]));
+ exit();
}
$response = $api_routes[$path]();
if (array_key_exists('response_code', $response)) {
diff --git a/assets/buttons/signinwith.svg b/assets/buttons/signinwith.svg
new file mode 100644
index 0000000..ca72560
--- /dev/null
+++ b/assets/buttons/signinwith.svg
@@ -0,0 +1,88 @@
+
+
+
+<?php if (isset($doc_title)) { echo $doc_title." | "; } ?>ByeCorps ID
-
+
+
+
Bye Corps ID
+
Log into ByeCorps and beyond with a single ID.
+
+
diff --git a/login_external_basic.php b/login_external_basic.php
index af0e93e..2a1c68c 100644
--- a/login_external_basic.php
+++ b/login_external_basic.php
@@ -31,9 +31,29 @@ if ($query['callback'] != $app['callback']) {
goto login;
}
+if ($_SESSION['auth'] && $_SERVER['REQUEST_METHOD'] == 'GET') {
+ // We can check if there's already a valid token of the same level and just pass that on instead.
+ $valid_tokens = db_execute_all("SELECT * FROM tokens WHERE owner_id = ? AND type = ? AND application_id = ? AND expiry > ?",
+ [$_SESSION['id'], "basic", $app_id, time()]);
+
+ if (sizeof($valid_tokens) > 0) {
+ print_r($valid_tokens);
+
+ $token = $valid_tokens[0];
+
+ header('Location: '. $_GET['callback'].'?access_token='.$token['access_token'].'&refresh='.$token['refresh_token']
+ .'&expiry='.$token['expiry']);
+ exit();
+ }
+
+// if (validate_access_token())
+
+
+}
+
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
// Here's a few easy steps to figure out if we should give the other party a token or not.
- print_r($_POST);
+// print_r($_POST);
// First: match the session ids. If they aren't the same it's probably Not Ok.
if (session_id() != $_POST['sessionid']) {
@@ -74,7 +94,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
}
// The following gets run assuming we know the client is the one CLICKING the button.
- $tokens = generate_basic_access_token($_POST['bcid']);
+ $tokens = generate_basic_access_token($_POST['bcid'], $app_id);
header('Location: '. $_POST['callback'].'?access_token='.$tokens['access'].'&refresh='.$tokens['refresh']
.'&expiry='.$tokens['expiry']);
@@ -94,15 +114,15 @@ login:
Sign into
- Owned by
+ Owned by
-
+
Something went wrong!
Server returned error:$error[0] (HTTP response code $error[1])
+
Please double-check the information and avoid signing in with your BCID if you do not trust this app.
- Please confirm that you'd like to sign into
+ Please confirm that you'd like to sign into
$flash";
@@ -131,11 +151,10 @@ login:
Sign into
- GET ME OUT OF HERE
+ Sign into
- You will be brought to
-
-
-
-
-
Badges
- This profile has no badges :(';
- } else {
- foreach ($badges as $badge) {
- echo "
-
-
-
" . htmlspecialchars($badge['title']) . "
-
". htmlspecialchars($badge['description']) ."
-
". htmlspecialchars($badge['description']) ."
-
Earned " . $badge['earned'] . "
-
-
";
- }
- }
- ?>
-
-
-
-
Info
-
-
-
- Joined
-
-
- Badges earned
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
@@ -5,10 +13,26 @@