Authentication & Authorization

Authentication & Authorization

User Types

• Users: Client accounts (stored in users table)
• Staff: Admin/staff accounts (stored in staff table)

Authentication Flow

1. User submits login credentials
2. System verifies password using password_verify()
3. System creates PHP session
4. System stores user ID and role in session
5. System updates last login timestamp

Session Management

// Check if logged in
$auth = new Auth();
if ($auth->isLoggedIn()) {
    $userId = $auth->getUserId();
    $user = $auth->getUser();
}

// Check user type
if ($auth->isClient()) {
    // Client access
}

if ($auth->isStaff()) {
    // Staff access
}

Authorization

// Require staff access
requireStaffAccess('clients');

// Check permissions
$permissionManager = new PermissionManager();
if ($permissionManager->hasAccess($staffId, 'clients', 'edit')) {
    // Allow edit
}

Password Security

// Hash password
$hash = password_hash($password, PASSWORD_DEFAULT);

// Verify password
if (password_verify($password, $hash)) {
    // Password correct
}

CSRF Protection

All forms should include CSRF tokens:

// Generate token
$csrfToken = bin2hex(random_bytes(32));
$_SESSION['csrf_token'] = $csrfToken;

// In form
<input type="hidden" name="csrf_token" value="<?= $csrfToken ?>">

// Verify on submit
if ($_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    die('Invalid CSRF token');
}

Input Validation

// Sanitize input
$email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);
$email = filter_var($email, FILTER_VALIDATE_EMAIL);

// Escape output
echo e($userInput);