From 6d40398f53ef77fe918e3a216f2d4410aa8db0a7 Mon Sep 17 00:00:00 2001 From: Ture La Manna Date: Wed, 11 Feb 2026 17:18:38 +0100 Subject: [PATCH] Claim email da Spie e CNS disattivabile per utente --- App/Config/site.php.example | 1 + App/Core/Controller.php | 1 - App/Core/Model.php | 6 ++++- App/Models/Cns.php | 22 +++++++++++------ App/Models/Token.php | 22 +++++++++++++++++ App/Models/User.php | 14 ++++++++--- App/Models/UserTool.php | 33 +++++++++++++++++++++++++ App/bootstrap.php | 2 +- html/index.php | 46 +++++++++++++++++++++-------------- html/spid/index.php | 4 ++- setup/file/autenticazione.sql | 8 +++--- setup/file/update_001.sql | 2 ++ tools/get_token | 14 +++++++++++ tools/user_add | 27 ++++++++++++++++++++ tools/user_list | 11 +++++++++ 15 files changed, 174 insertions(+), 39 deletions(-) create mode 100644 App/Models/Token.php create mode 100644 App/Models/UserTool.php create mode 100644 setup/file/update_001.sql create mode 100755 tools/get_token create mode 100755 tools/user_add create mode 100755 tools/user_list diff --git a/App/Config/site.php.example b/App/Config/site.php.example index 7208a70..ea9eada 100644 --- a/App/Config/site.php.example +++ b/App/Config/site.php.example @@ -2,4 +2,5 @@ return [ 'key' => 'CHANGE_ME', + 'url' => 'https://autenticazione.lavoripubblici.sicilia.it/', ]; diff --git a/App/Core/Controller.php b/App/Core/Controller.php index d5fcc1d..0c75f2b 100644 --- a/App/Core/Controller.php +++ b/App/Core/Controller.php @@ -4,7 +4,6 @@ namespace MwgAuth\Core; class Controller { - private static $charset = 'UTF-8'; private static $contentType = 'application/json'; private static $responseCode = 200; diff --git a/App/Core/Model.php b/App/Core/Model.php index 6e088c1..980f936 100644 --- a/App/Core/Model.php +++ b/App/Core/Model.php @@ -78,7 +78,11 @@ class Model foreach ($conditions as $field => $value) { $where[] = "(`$field`=:$field)"; } - return "SELECT `" . implode('`,`', $fields) . "` FROM `$table` WHERE " . implode(' AND ', $where); + $sql = "SELECT `" . implode('`,`', $fields) . "` FROM `$table`"; + if (count($where)) { + $sql .= ' WHERE ' . implode(' AND ', $where); + } + return $sql; } protected static function insert(string $table, array $fields): bool diff --git a/App/Models/Cns.php b/App/Models/Cns.php index b228359..37d27a0 100644 --- a/App/Models/Cns.php +++ b/App/Models/Cns.php @@ -23,7 +23,11 @@ class Cns extends Model $this->verificaCertificato(); // https://www.agid.gov.it/sites/default/files/repository_files/documentazione_trasparenza/strutturacertificatoautenticazionecns_v1.1_.pdf if (isset($this->certificato['subject']['serialNumber'])) { - $this->codiceFiscale = preg_replace('/^[A-Za-z]{2}:/', '', $this->certificato['subject']['serialNumber']); + $this->codiceFiscale = preg_replace( + '/^[A-Za-z]{2}:/', + '', + $this->certificato['subject']['serialNumber'] + ); } else { $this->codiceFiscale = explode('/', $this->certificato['subject']['commonName'])[0]; } @@ -78,13 +82,15 @@ class Cns extends Model private function verificaCertificato() { - // if (!isset($this->certificato['subject']['commonName']) || - // !isset($this->certificato['subject']['surname']) || - // !isset($this->certificato['subject']['givenName']) || - // isset($this->certificato['subject']['serialNumber']) || - // !isset($this->certificato['extensions']['certificatePolicies'])) { - $this->salvaCertificato(); - // } + if ( + !isset($this->certificato['subject']['commonName']) + || !isset($this->certificato['subject']['surname']) + || !isset($this->certificato['subject']['givenName']) + || isset($this->certificato['subject']['serialNumber']) + || !isset($this->certificato['extensions']['certificatePolicies']) + ) { + $this->salvaCertificato(); + } } private function salvaCertificato() diff --git a/App/Models/Token.php b/App/Models/Token.php new file mode 100644 index 0000000..08ee0d1 --- /dev/null +++ b/App/Models/Token.php @@ -0,0 +1,22 @@ + $token]); + if (null === $token) { + return true; + } + $user_id = self::selectOne('sessions', ['user_id'], ['auth' => $token['auth']]); + if (null === $user_id) { + return true; + } + $useCns = self::selectOne('users', ['use_cns'], ['id' => $user_id['user_id']]); + return $useCns['use_cns'] == 1; + } +} diff --git a/App/Models/User.php b/App/Models/User.php index 01b9074..05243b0 100644 --- a/App/Models/User.php +++ b/App/Models/User.php @@ -62,7 +62,7 @@ class User extends Model public function getLoginData(string $token): ?array { - $ret = $this->select('logins', ['codice_fiscale', 'nome', 'cognome'], ['token' => $token]); + $ret = $this->select('logins', ['codice_fiscale', 'nome', 'cognome', 'email'], ['token' => $token]); return empty($ret) ? null : $ret[0]; } @@ -90,13 +90,19 @@ class User extends Model return $this->userName; } - public static function setLoginData(string $token, string $codiceFiscale, string $nome, string $cognome): bool - { + public static function setLoginData( + string $token, + string $codiceFiscale, + string $nome, + string $cognome, + ?string $email = null + ): bool { return self::insert('logins', [ 'token' => $token, 'codice_fiscale' => $codiceFiscale, 'nome' => $nome, 'cognome' => $cognome, + 'email' => $email, ]); } @@ -121,7 +127,7 @@ class User extends Model return Config::getValue('site', 'key'); } - private static function hashPassword(string $password): string + protected static function hashPassword(string $password): string { $siteKey = self::getSiteKey(); return hash('sha256', $siteKey . $password); diff --git a/App/Models/UserTool.php b/App/Models/UserTool.php new file mode 100644 index 0000000..04ac206 --- /dev/null +++ b/App/Models/UserTool.php @@ -0,0 +1,33 @@ + $username, + 'password' => self::hashPassword($password), + 'remote' => $remote, + 'use_cns' => $useCns, + ]); + } + + public static function list(): array + { + return self::select('users', ['id', 'username', 'remote', 'use_cns'], []); + } + + public static function token(string $username): ?string + { + $rows = self::select('users', ['id'], ['username' => $username]); + if (empty($rows)) { + return null; + } + $user = new User($rows[0]['id'], $username); + return $user->getToken('http://localhost/callback'); + } +} diff --git a/App/bootstrap.php b/App/bootstrap.php index ff1ced4..40040ee 100644 --- a/App/bootstrap.php +++ b/App/bootstrap.php @@ -2,5 +2,5 @@ namespace MwgAuth\Core; -require_once(__DIR__.'/Core/AutoLoader.php'); +require_once(__DIR__ . '/Core/AutoLoader.php'); AutoLoader::register(); diff --git a/html/index.php b/html/index.php index 2a3b9ca..8044393 100644 --- a/html/index.php +++ b/html/index.php @@ -1,4 +1,12 @@ - + @@ -16,23 +24,25 @@
-
-

Accedi con CNS

-
-

- La Carta Nazionale dei Servizi o CNS è una smart card o una chiavetta USB che contiene un - "certificato digitale" di autenticazione personale, utile per accedere ai servizi online della - Regione Siciliana. -

-
- - -
-
+ +
+

Accedi con CNS

+
+

+ La Carta Nazionale dei Servizi o CNS è una smart card o una chiavetta USB che contiene un + "certificato digitale" di autenticazione personale, utile per accedere ai servizi online della + Regione Siciliana. +

+
+ + +
+
+

Accedi con SPID o CieID

diff --git a/html/spid/index.php b/html/spid/index.php index 2ec493d..e40b5b1 100644 --- a/html/spid/index.php +++ b/html/spid/index.php @@ -8,11 +8,13 @@ $token = $_GET['t'] ?? null; if ('' === ($token ?? '')) { include($_SERVER['DOCUMENT_ROOT'] . '/errors/generic.php'); } else { + @file_put_contents("/var/www/html/cns/policy/claims-$token.txt", print_r($_SERVER, true)); User::setLoginData( $token, $_SERVER['SPID_claim_fiscalNumber'], $_SERVER['SPID_claim_given_name'], - $_SERVER['SPID_claim_family_name'] + $_SERVER['SPID_claim_family_name'], + $_SERVER['SPID_claim_email'], ); $callback = User::getCallback($token); if (null === $callback) { diff --git a/setup/file/autenticazione.sql b/setup/file/autenticazione.sql index ce54ed2..e1d5b1d 100644 --- a/setup/file/autenticazione.sql +++ b/setup/file/autenticazione.sql @@ -15,6 +15,7 @@ CREATE TABLE `logins` ( `codice_fiscale` varchar(255) DEFAULT NULL, `nome` varchar(255) DEFAULT NULL, `cognome` varchar(255) DEFAULT NULL, + `email` varchar(255) NULL DEFAULT NULL, `created_at` timestamp NULL DEFAULT NULL, `modified_at` timestamp NULL DEFAULT NULL, PRIMARY KEY (`token`) @@ -46,17 +47,14 @@ CREATE TABLE `users` ( `username` varchar(255) NOT NULL, `password` char(64) NOT NULL, `remote` varchar(45) DEFAULT NULL, + `use_cns` BOOLEAN NOT NULL DEFAULT TRUE, `created_at` timestamp NULL DEFAULT NULL, - `updated_at` timestamp NULL DEFAULT NULL, + `modified_at` timestamp NULL DEFAULT NULL, `deleted_at` timestamp NULL DEFAULT NULL, PRIMARY KEY (`id`), UNIQUE KEY `users_username_remote_unique` (`username`,`remote`) ) ENGINE=InnoDB AUTO_INCREMENT=5 DEFAULT CHARSET=utf8; -INSERT INTO `users`(`id`,`username`,`password`,`remote`,`created_at`,`updated_at`,`deleted_at`) VALUES -(1,'sismica','268633d46fdf00502dba60facce2ba5eec6a5d86c843c19f3f3b1ef8c0342ada','192.168.15.*',CURRENT_TIMESTAMP,CURRENT_TIMESTAMP,NULL), -(2,'sismica','268633d46fdf00502dba60facce2ba5eec6a5d86c843c19f3f3b1ef8c0342ada','79.8.172.13',CURRENT_TIMESTAMP,CURRENT_TIMESTAMP,NULL); - /*!40101 SET SQL_MODE=@OLD_SQL_MODE */; /*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */; /*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */; diff --git a/setup/file/update_001.sql b/setup/file/update_001.sql new file mode 100644 index 0000000..73328fa --- /dev/null +++ b/setup/file/update_001.sql @@ -0,0 +1,2 @@ +ALTER TANLE `logins` ADD COLUMN `email` VARCHAR(255) NULL DEFAULT NULL AFTER `cognome`; +ALTER TANLE `users` ADD COLUMN `use_cns` BOOLEAN NOT NULL DEFAULT TRUE AFTER `remote`; diff --git a/tools/get_token b/tools/get_token new file mode 100755 index 0000000..35599ba --- /dev/null +++ b/tools/get_token @@ -0,0 +1,14 @@ +#!/usr/bin/env php +\n"; + exit(1); +} +$token = UserTool::token($argv[1]); +echo Config::getValue('site', 'url') . "?t=$token\n"; diff --git a/tools/user_add b/tools/user_add new file mode 100755 index 0000000..a596c1c --- /dev/null +++ b/tools/user_add @@ -0,0 +1,27 @@ +#!/usr/bin/env php +