reflector-dashboard/auth/lib.php

<?php
/*
 * Reflector Dashboard — web front-end for SvxReflector
 * Copyright (C) 2026 SA7AUX (Björn)
 * SPDX-License-Identifier: AGPL-3.0-or-later
 *
 * This program is free software: you can redistribute it and/or modify it under
 * the terms of the GNU Affero General Public License as published by the Free
 * Software Foundation, either version 3 of the License, or (at your option) any
 * later version. See the LICENSE file for details.
 */
declare(strict_types=1);

function cfg(): array {
  static $cfg = null;
  if ($cfg !== null) return $cfg;
  $cfg = require __DIR__ . '/config.php';
  return $cfg;
}

// redis() / redis_connect() / redis_scan_mget() come from auth/lib/redis.php
// (copy of <dmr-portal>/auth/lib/redis.php).
require __DIR__ . '/lib/redis.php';
// json_in/json_out, CSRF and rate limiting come from auth/lib/http.php (copy of
// callmgr2's); the rate-limit keys keep this site's namespace.
function rate_limit_key_prefix(): string { return rkey('ratelimit:'); }
require __DIR__ . '/lib/http.php';
require __DIR__ . '/lib/acl.php';
require __DIR__ . '/lib/html.php';
require __DIR__ . '/lib/shell.php';

function rkey(string $suffix): string {
  $p = cfg()['redis']['prefix'] ?? '';
  return $p . ltrim($suffix, ':');
}

function base_call(string $cs): string {
  $cs = trim($cs);
  $cs = preg_split('/[-(]/', $cs)[0] ?? $cs;
  return strtoupper(trim($cs));
}

function norm_email(string $email): string {
  return strtolower(trim($email));
}

function uuidv4(): string {
  $d = random_bytes(16);
  $d[6] = chr((ord($d[6]) & 0x0f) | 0x40);
  $d[8] = chr((ord($d[8]) & 0x3f) | 0x80);
  $hex = bin2hex($d);
  return sprintf('%s-%s-%s-%s-%s',
    substr($hex, 0, 8),
    substr($hex, 8, 4),
    substr($hex, 12, 4),
    substr($hex, 16, 4),
    substr($hex, 20, 12)
  );
}

function token_id(): string {
  return rtrim(strtr(base64_encode(random_bytes(12)), '+/', '-_'), '=');
}

function token_secret(): string {
  return rtrim(strtr(base64_encode(random_bytes(32)), '+/', '-_'), '=');
}

function token_hash(string $secret): string {
  return hash('sha256', $secret, false);
}

function start_session(): void {
  $s = cfg()['session'];
  $params = session_get_cookie_params();
  session_name($s['name'] ?? 'svxportal_sess');
  session_set_cookie_params([
    'lifetime' => 0,
    'path' => '/',
    'domain' => $params['domain'] ?? '',
    'secure' => (bool)($s['cookie_secure'] ?? false),
    'httponly' => true,
    'samesite' => $s['cookie_samesite'] ?? 'Lax',
  ]);
  if (session_status() !== PHP_SESSION_ACTIVE) session_start();
}

function set_session_user(string $uuid): void {
  start_session();
  session_regenerate_id(true);
  $_SESSION['uid'] = $uuid;
}

function session_user(): ?string {
  start_session();
  $u = $_SESSION['uid'] ?? null;
  return is_string($u) && $u !== '' ? $u : null;
}

function require_login(): string {
  $u = session_user();
  if (!$u) json_out(['ok'=>false,'error'=>'not_logged_in'], 401);
  check_session_timeout(7200); // 2 hour idle timeout
  // Banned users are cut off completely — also mid-session, as on the dmr site
  $acct = acct_get($u);
  if ((int)($acct['banned'] ?? 0) === 1 || is_call_banned((string)($acct['callsign'] ?? ''))) {
    session_destroy();
    json_out(['ok'=>false,'error'=>'Your account has been banned.'], 403);
  }
  return $u;
}

function acct_key(string $uuid): string { return rkey("acct:$uuid"); }
function acct_calls_key(string $uuid): string { return rkey("acct_calls:$uuid"); }
// Reverse index for extra callsigns: SET of account uuids per callsign. Unlike
// the unique call:<CS> login index, the same callsign (e.g. a club call) may
// sit on several accounts at once.
function call_accts_key(string $callsign_upper): string { return rkey("call_accts:$callsign_upper"); }
function acct_nodes_key(string $uuid): string { return rkey("acct_nodes:$uuid"); }
function email_index_key(string $email_lower): string { return rkey("acct_by_email:$email_lower"); }
function call_index_key(string $callsign_upper): string { return rkey("call:$callsign_upper"); }
function node_index_key(string $node_id): string { return rkey("node:$node_id"); }

function find_acct_by_login(string $userOrEmail): ?string {
  $v = trim($userOrEmail);
  if ($v === '') return null;

  if (str_contains($v, '@')) {
    $uuid = redis()->get(email_index_key(norm_email($v)));
    return is_string($uuid) && $uuid !== '' ? $uuid : null;
  }

  $uuid = redis()->get(call_index_key(base_call($v)));
  return is_string($uuid) && $uuid !== '' ? $uuid : null;
}

function acct_get(string $uuid): array {
  $h = redis()->hGetAll(acct_key($uuid));
  return is_array($h) ? $h : [];
}

// Account flags (8-bit, as on the dmr site): 1=unreg 2=reg 4=normal 8=lvl1 16=lvl2 32=lvl3.
// The flags ARE the admin system. Accounts without the field derive a value
// from the legacy email_verified/admin_level fields.
function acct_flags_from(array $h): int {
  $f = $h['acct_flags'] ?? null;
  if ($f !== null && $f !== false && $f !== '') return ((int)$f) & 0x3F;
  if ((string)($h['email_verified'] ?? '0') !== '1') return 1;
  $flags = 2 | 4;
  $legacy = (int)($h['admin_level'] ?? 1);
  if ($legacy === 2) $flags |= 16;
  if ($legacy >= 3) $flags |= 32;
  return $flags;
}
function acct_flags(string $uuid): int { return acct_flags_from(acct_get($uuid)); }
function acct_level_from_flags(int $flags): int {
  if ($flags & 32) return 3;
  if ($flags & (8|16)) return 2; // lvl1 and lvl2 are both acting admins
  return 1;
}
// Fine-grained admin rank for the level hierarchy: lvl1=1, lvl2=2, lvl3=3, none=0.
function acct_admin_rank_from(int $flags): int {
  if ($flags & 32) return 3;
  if ($flags & 16) return 2;
  if ($flags & 8)  return 1;
  return 0;
}
function acct_admin_rank(string $uuid): int { return acct_admin_rank_from(acct_flags($uuid)); }

function acct_admin_level(string $uuid): int {
  $lvl = acct_level_from_flags(acct_flags($uuid));
  return $lvl;
}

function require_admin(int $minLevel): string {
  $uuid = require_login();
  if (acct_admin_level($uuid) < $minLevel) json_out(['ok'=>false,'error'=>'forbidden'], 403);
  return $uuid;
}

// All callsigns tied to an account: the primary callsign field plus any extra
// callsigns (club calls etc.) an admin has added to the acct_calls set.
function acct_all_calls(string $uuid): array {
  $calls = [];
  $cs = strtoupper(trim((string)(acct_get($uuid)['callsign'] ?? '')));
  if ($cs !== '') $calls[] = $cs;
  foreach (redis()->sMembers(acct_calls_key($uuid)) ?: [] as $c) {
    $c = strtoupper(trim((string)$c));
    if ($c !== '' && !in_array($c, $calls, true)) $calls[] = $c;
  }
  return $calls;
}

// A node belongs to a callsign when the callsign appears anywhere in the node
// name: SA7AUX matches SA7AUX, SA7AUX-TEST, SA7AUX_TEST, SA7AUX/TEST,
// SA7AUXTEST and XXSA7AUXXX. The node name itself is never rewritten — the
// variants are distinct nodes.
function calls_match_node(array $calls, string $cs): bool {
  $node = strtoupper(trim($cs));
  if ($node === '') return false;
  foreach ($calls as $c) {
    if ($c !== '' && preg_match('/' . preg_quote($c, '/') . '/', $node)) return true;
  }
  return false;
}

function link_callsign(string $uuid, string $callsign): void {
  $cs = base_call($callsign);
  if ($cs === '') throw new RuntimeException('invalid_callsign');

  $idx = call_index_key($cs);
  $old = redis()->get($idx);
  if (is_string($old) && $old !== '' && $old !== $uuid) throw new RuntimeException('callsign_taken');

  redis()->set($idx, $uuid);
  redis()->sAdd(acct_calls_key($uuid), $cs);
}

function link_node(string $uuid, string $nodeId): void {
  $id = trim($nodeId);
  if ($id === '') throw new RuntimeException('invalid_node');

  $idx = node_index_key($id);
  $old = redis()->get($idx);
  if (is_string($old) && $old !== '' && $old !== $uuid) throw new RuntimeException('node_taken');

  redis()->set($idx, $uuid);
  redis()->sAdd(acct_nodes_key($uuid), $id);
}

// --- Node ownership ---
function pki_certs_dir(): string {
  static $dir = null;
  if ($dir !== null) return $dir;
  $dir = '/etc/svxlink/pki/certs';
  foreach (@file('/etc/svxlink/svxreflector.conf', FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) ?: [] as $line) {
    if (preg_match('/^CERT_CA_CERTS_DIR\s*=\s*(.+)$/', trim($line), $m)) { $dir = trim($m[1]); break; }
  }
  $dir = rtrim($dir, '/');
  return $dir;
}

// Email carried in a node's client cert (subjectAltName, falling back to the
// subject's emailAddress), or '' if the node has no cert / no email in it.
function node_cert_email(string $cs): string {
  $f = pki_certs_dir() . "/{$cs}.crt";
  if (!is_file($f)) return '';
  $x = @openssl_x509_parse((string)@file_get_contents($f));
  if (!$x) return '';
  $san = (string)($x['extensions']['subjectAltName'] ?? '');
  if (preg_match('/email:([^,\s]+)/i', $san, $m)) return norm_email($m[1]);
  $e = (string)($x['subject']['emailAddress'] ?? '');
  return $e !== '' ? norm_email($e) : '';
}

// Pending-CSR and signed-CSR directories, resolved from svxreflector.conf the
// same way as pki_certs_dir().
function pki_conf_dir(string $key, string $fallback): string {
  $dir = $fallback;
  foreach (@file('/etc/svxlink/svxreflector.conf', FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) ?: [] as $line) {
    if (preg_match('/^' . preg_quote($key, '/') . '\s*=\s*(.+)$/', trim($line), $m)) { $dir = trim($m[1]); break; }
  }
  return rtrim($dir, '/');
}
function pki_pending_dir(): string { return pki_conf_dir('CERT_CA_PENDING_CSRS_DIR', '/etc/svxlink/pki/pending_csrs'); }

// Path safety for node callsigns used as cert/CSR file names — same rule as the
// reflector's isCallsignPathSafe(): never '/', '..' or NUL.
function node_callsign_path_safe(string $cs): bool {
  return $cs !== '' && strlen($cs) <= 64
      && !str_contains($cs, '/') && !str_contains($cs, '..') && !str_contains($cs, "\0");
}

// Validate a node callsign for portal operations: file-name safety only.
// Which names may exist on the network is the reflector's business — the live
// network has trunk/bridge nodes (SE-EASTCOAST, stream_test, SA7AUX-DMRBR)
// that no callsign-format regex covers, so the portal must not be stricter.
// Callsign check shared by the node/reflector APIs; a caller may pass its own
// stricter validator (node_cmd_api: amateur-format regex).
function valid_callsign(string $cs): bool { return node_callsign_valid($cs); }
function require_callsign(array $in, ?callable $validator = null): string {
  $cs = strtoupper(trim((string)($in['callsign'] ?? '')));
  $ok = $validator ? $validator($cs) : valid_callsign($cs);
  if ($cs === '' || !$ok) json_out(['ok' => false, 'error' => 'invalid_callsign'], 400);
  return $cs;
}

function node_callsign_valid(string $cs): bool {
  return node_callsign_path_safe($cs)
      && preg_match('/^[A-Za-z0-9._-]{1,64}$/', $cs) === 1;
}

// Email carried in a pending CSR's subjectAltName (or subject emailAddress), '' if none.
function node_csr_email(string $cs): string {
  $f = pki_pending_dir() . "/{$cs}.csr";
  if (!is_file($f)) return '';
  $out = [];
  @exec('openssl req -in ' . escapeshellarg($f) . ' -noout -text 2>/dev/null', $out);
  $text = implode("\n", $out);
  if (preg_match('/email:([^,\s]+)/i', $text, $m)) return norm_email($m[1]);
  if (preg_match('/emailAddress\s*=\s*([^,\s\/]+)/i', $text, $m)) return norm_email($m[1]);
  return '';
}

// Run a CA command through the reflector PTY helper (svxlink-owned). true on
// success, or an error string.
function reflector_ca(string $sub, string $cs): true|string {
  $sub = strtoupper($sub);
  if (!in_array($sub, ['SIGN', 'RM'], true)) return 'bad CA subcommand';
  if (!node_callsign_path_safe($cs) || preg_match('/\s/', $cs)) return 'bad callsign';
  $cmd = 'sudo -u svxlink /usr/local/sbin/svxreflector-pty CA ' . escapeshellarg($sub) . ' ' . escapeshellarg($cs);
  exec($cmd . ' 2>&1', $out, $rc);
  return $rc === 0 ? true : (implode("\n", $out) ?: 'PTY write failed');
}

// --- Per-email certificate renewal counter ---
// 0 = new (never issued), 1 = admin issued the first cert, >=1 lets the account
// self-serve renewals. The count is keyed by the account/cert email.
function cert_email_key(string $email): string { return rkey('cert_email:' . norm_email($email)); }
function cert_email_ensure(string $email): void {
  $e = norm_email($email);
  if ($e === '') return;
  $k = cert_email_key($e);
  if (!redis()->exists($k)) redis()->hMSet($k, ['email' => $e, 'count' => '0']);
}
function cert_email_count(string $email): int {
  $e = norm_email($email);
  if ($e === '') return 0;
  $c = redis()->hGet(cert_email_key($e), 'count');
  return ($c === false || $c === null) ? 0 : (int)$c;
}
function cert_email_bump(string $email): int {
  $e = norm_email($email);
  if ($e === '') return 0;
  $k = cert_email_key($e);
  redis()->hSet($k, 'email', $e);
  return (int)redis()->hIncrBy($k, 'count', 1);
}

// --- Per-node certificate issue counter ---
// Same semantics as the per-email counter, keyed by the full node callsign:
// 0 = an admin has never issued a cert for this node, >=1 = the owner may
// self-serve renewals. Bumped on every sign (admin or self), never decremented
// so the first-issue gate survives a remove->reissue cycle.
function cert_node_key(string $cs): string { return rkey('cert_node:' . strtoupper(trim($cs))); }
function cert_node_ensure(string $cs): void {
  $c = strtoupper(trim($cs));
  if ($c === '') return;
  $k = cert_node_key($c);
  if (!redis()->exists($k)) redis()->hMSet($k, ['call' => $c, 'count' => '0']);
}
function cert_node_count(string $cs): int {
  $c = strtoupper(trim($cs));
  if ($c === '') return 0;
  $v = redis()->hGet(cert_node_key($c), 'count');
  return ($v === false || $v === null) ? 0 : (int)$v;
}
function cert_node_bump(string $cs): int {
  $c = strtoupper(trim($cs));
  if ($c === '') return 0;
  $k = cert_node_key($c);
  redis()->hSet($k, 'call', $c);
  return (int)redis()->hIncrBy($k, 'count', 1);
}

// A user "owns" a node if they're a site admin, one of their callsigns (primary
// or admin-added extra/club calls) appears in the node name, they're a listed
// node admin, or the node's client cert carries their verified account email.
function user_owns_node(string $uuid, string $cs): bool {
  if (acct_admin_level($uuid) >= 2) return true;
  $me = acct_get($uuid);
  $mycalls = acct_all_calls($uuid);
  if (calls_match_node($mycalls, $cs)) return true;
  $admins = redis()->sMembers(rkey("node_admins:$cs")) ?: [];
  foreach ($mycalls as $c) {
    if (in_array($c, $admins, true)) return true;
  }
  if (!empty($me['email']) && !empty($me['email_verified'])) {
    $ce = node_cert_email($cs);
    if ($ce !== '' && $ce === norm_email((string)$me['email'])) return true;
  }
  return false;
}

// --- Global callsign bans ---
// A Redis SET of base callsigns (like the DMR site's banned_callsigns set).
// A banned callsign is blocked on the portal — it cannot register or sign in.
function global_bans_key(): string { return rkey('banned_callsigns'); }

function is_call_banned(string $callsign): bool {
  $cs = base_call($callsign);
  if ($cs === '') return false;
  return (bool) redis()->sIsMember(global_bans_key(), $cs);
}

function mail_send(string $to, string $subject, string $body): bool {
  $m = cfg()['mail'] ?? [];
  $from = $m['from'] ?? 'no-reply@example.com';
  // Direct SSL SMTP when a relay is configured (host+user) — needs no local MTA
  // (/usr/sbin/sendmail), which many boxes don't have. Same approach as the
  // callmgr portal. Falls back to PHP mail() where no SMTP is configured (e.g.
  // a box with a working msmtp/sendmail).
  $host = $m['host'] ?? '';
  $user = $m['user'] ?? '';
  if ($host !== '' && $user !== '') {
    return smtp_send_ssl($host, (int)($m['port'] ?? 465), $user, (string)($m['pass'] ?? ''),
                         $from, (string)($m['from_name'] ?? 'Reflector Dashboard'), $to, $subject, $body);
  }
  $headers = "From: $from\r\nContent-Type: text/plain; charset=UTF-8\r\n";
  return @mail($to, $subject, $body, $headers);
}

// Minimal SSL SMTP client (AUTH LOGIN). Returns true only when the server
// accepts the message. No dependency on a local MTA.
function smtp_send_ssl(string $host, int $port, string $user, string $pass,
                       string $from, string $from_name, string $to,
                       string $subject, string $body): bool {
  $ctx = stream_context_create(['ssl' => ['verify_peer' => true, 'verify_peer_name' => true]]);
  $fp = @stream_socket_client("ssl://{$host}:{$port}", $errno, $errstr, 10, STREAM_CLIENT_CONNECT, $ctx);
  if (!$fp) { error_log("smtp: connect failed $host:$port $errstr"); return false; }
  $read = function() use ($fp): string { return fgets($fp, 4096) ?: ''; };
  $write = function(string $c) use ($fp): void { fwrite($fp, $c . "\r\n"); };
  $expect = function(string $code) use ($read): bool { return str_starts_with($read(), $code); };
  if (!$expect('220')) { fclose($fp); return false; }
  $write("EHLO svxportal");
  do { $line = $read(); } while ($line !== '' && strlen($line) > 3 && $line[3] === '-');
  $write("AUTH LOGIN");        if (!$expect('334')) { fclose($fp); return false; }
  $write(base64_encode($user)); if (!$expect('334')) { fclose($fp); return false; }
  $write(base64_encode($pass)); if (!$expect('235')) { fclose($fp); error_log("smtp: auth failed"); return false; }
  $write("MAIL FROM:<{$from}>"); if (!$expect('250')) { fclose($fp); return false; }
  $write("RCPT TO:<{$to}>");     if (!$expect('250')) { fclose($fp); return false; }
  $write("DATA");                if (!$expect('354')) { fclose($fp); return false; }
  $msg  = "From: {$from_name} <{$from}>\r\n";
  $msg .= "To: {$to}\r\n";
  $msg .= "Subject: {$subject}\r\n";
  $msg .= "MIME-Version: 1.0\r\nContent-Type: text/plain; charset=UTF-8\r\n";
  $msg .= "Date: " . date('r') . "\r\n\r\n";
  $msg .= $body . "\r\n.";
  $write($msg);                  if (!$expect('250')) { fclose($fp); return false; }
  $write("QUIT"); fclose($fp);
  return true;
}

// --- Session timeout ---
function check_session_timeout(int $max_idle = 3600): void {
  start_session();
  if (isset($_SESSION['last_activity']) && (time() - (int)$_SESSION['last_activity']) > $max_idle) {
    session_unset();
    session_destroy();
    json_out(['ok' => false, 'error' => 'session_expired'], 401);
  }
  $_SESSION['last_activity'] = time();
}