From 9638e3530ca74e6b396a7ed2bed2cccd3e8577e1 Mon Sep 17 00:00:00 2001 From: Gowtham M Date: Tue, 7 Oct 2025 13:07:18 +0530 Subject: [PATCH] GWM --- app/Config/Routes.php | 1 + app/Controllers/AuthController.php | 15 +++++++++++++++ app/Filters/JwtAuthFilter.php | 14 ++++++++++++++ app/Models/UserModel.php | 2 +- 4 files changed, 31 insertions(+), 1 deletion(-) diff --git a/app/Config/Routes.php b/app/Config/Routes.php index 27398a0..09012fc 100755 --- a/app/Config/Routes.php +++ b/app/Config/Routes.php @@ -22,6 +22,7 @@ $routes->group('api', ['filter' => 'appSignature'], function ($routes) { // Login api $routes->post('auth/login', 'AuthController::login'); + $routes->get('auth/logout', 'AuthController::logout'); $routes->get('auth/oauthClient', 'AuthController::oauthClient'); $routes->post('auth/oauthlogin', 'AuthController::oauthlogin'); diff --git a/app/Controllers/AuthController.php b/app/Controllers/AuthController.php index 3d2aa1c..5bcbeda 100644 --- a/app/Controllers/AuthController.php +++ b/app/Controllers/AuthController.php @@ -148,6 +148,11 @@ class AuthController extends ResourceController // Generate JWT Token $token = generateJWT($user); + + // Store the token in DB for current session + $this->userModel->update($user['user_id'], [ + 'current_token' => $token + ]); return $this->respond([ @@ -403,6 +408,16 @@ class AuthController extends ResourceController } + public function logout() + { + $user_id = $this->request->getGet('user_id'); + $this->userModel->update($user_id, ['current_token' => null]); + + return $this->respond(['message' => 'Logout successful']); + } + + + //old login code // public function login() { $rules = [ 'email' => 'required|valid_email', 'password' => 'required' ]; if (!$this->validate($rules)) { return $this->failValidationErrors($this->validator->getErrors()); } $data = $this->request->getJSON(); $user = $this->userModel->where('email', $data->email)->where('is_active',1)->first(); // print_r($user);die; if (!$user) { return $this->failUnauthorized('Invalid email or password'); } // Verify password (assuming it's hashed) if (!password_verify($data->password, $user['password'])) { return $this->failUnauthorized('Invalid email or password'); } //update last login time in last_login_at column $this->userModel->update($user['user_id'], ['last_login_at' => date('Y-m-d H:i:s')]); $user = $this->userModel->where('email', $data->email)->first(); if (!empty($user['last_login_at'])) { $user['last_login_at'] = date('d, M-Y h:iA', strtotime($user['last_login_at'])); } else { $user['last_login_at'] = null; } //get service for the organization $orgService = $this->organizationModel->find($user['org_id']); $user['service'] = json_decode($orgService['services_ids'],true); foreach ($user['service'] as $key => $value) { $serviceData = $this->serviceModel->find($value['service_id']); $user['service'][$key]['name'] = $serviceData['name']; $user['service'][$key]['icon'] = $serviceData['icon']; $user['service'][$key]['order'] = $serviceData['order']; } //get role $user['role'] = $this->userModel->getRole($user['role_id']); //find user has the all access $user['plan_action'] = getUserPlanCreationRestrictionStatus($user); // Generate JWT Token $token = generateJWT($user); return $this->respond([ 'status' => 200, 'message' => 'Login successful', 'token' => $token ]); } diff --git a/app/Filters/JwtAuthFilter.php b/app/Filters/JwtAuthFilter.php index efefa7d..81dad1b 100644 --- a/app/Filters/JwtAuthFilter.php +++ b/app/Filters/JwtAuthFilter.php @@ -74,6 +74,20 @@ class JwtAuthFilter implements FilterInterface ])->setStatusCode(401); } + // If token mismatch → user logged out elsewhere + $userId = $decodedToken->data->user_id ?? null; + if (!$userId) { + return false; + } + $userModel = new \App\Models\UserModel(); + $user = $userModel->find($userId); + if ($user['current_token'] !== $matches[1]) { + return $response->setJSON([ + 'status' => false, + 'message' => 'Access denied. Your token changed.' + ])->setStatusCode(403); + } + // print_r($decodedToken); // echo $decodedToken->data->role; // die; diff --git a/app/Models/UserModel.php b/app/Models/UserModel.php index 0a7d65f..1a9d8a0 100644 --- a/app/Models/UserModel.php +++ b/app/Models/UserModel.php @@ -10,7 +10,7 @@ class UserModel extends Model protected $primaryKey = 'user_id'; // Primary key // Fields that can be mass assigned - protected $allowedFields = ['first_name','last_name','password','email','mobile_no','alternate_mobile_no','date_of_birth','address','gender','postal_code','country_code','employee_code','role_id','department_id','group_id','first_approver','first_approver_email','second_approver','second_approver_email','third_approver','third_approver_email','fourth_approver','fourth_approver_email','user_type','passport_number','place_of_issue','passport_document','passport_firstname','passport_middlename','passport_lastname','nationality','date_of_issue','date_of_expiry','created_on','created_by','updated_on','updated_by','is_active','org_id', 'temp_password', 'forex_pre_paid_card_number', 'emergency_contact_number', 'd_seat_preference', 'd_meal_preference', 'i_seat_preference', 'i_meal_preference', 'agent_supported_service_ids', 'd_additonalInfo', 'i_additonalInfo', 'forex_expiry_date', 'delegated_to_user_id', 'delegation_start_date', 'delegation_end_date','last_login_at','company_name','failed_attempts','lock_until']; + protected $allowedFields = ['first_name','last_name','password','email','mobile_no','alternate_mobile_no','date_of_birth','address','gender','postal_code','country_code','employee_code','role_id','department_id','group_id','first_approver','first_approver_email','second_approver','second_approver_email','third_approver','third_approver_email','fourth_approver','fourth_approver_email','user_type','passport_number','place_of_issue','passport_document','passport_firstname','passport_middlename','passport_lastname','nationality','date_of_issue','date_of_expiry','created_on','created_by','updated_on','updated_by','is_active','org_id', 'temp_password', 'forex_pre_paid_card_number', 'emergency_contact_number', 'd_seat_preference', 'd_meal_preference', 'i_seat_preference', 'i_meal_preference', 'agent_supported_service_ids', 'd_additonalInfo', 'i_additonalInfo', 'forex_expiry_date', 'delegated_to_user_id', 'delegation_start_date', 'delegation_end_date','last_login_at','company_name','failed_attempts','lock_until','current_token']; // Specify the return type of the results protected $returnType = 'array';