SWAMPy

✎ CARVE FLESH

EDITING: Auth.php

<?php
/**
 * Flora and Creations — JWT Authentication
 *
 * Minimal JWT implementation (HS256) without external libraries.
 * Compatible with PHP 7.4+.
 */

namespace App;

class Auth
{
    /**
     * Generate a JWT token.
     *
     * @param array $payload User claims (id, role, email, name, etc.)
     * @return string
     */
    public static function generateToken(array $payload): string
    {
        $cfg = require __DIR__ . '/../config/config.php';
        $secret = $cfg['jwt']['secret'];
        $expiry = time() + ($cfg['jwt']['expiry'] ?? 86400);

$header = json_encode(['typ' => 'JWT', 'alg' => 'HS256']);
        $payload = json_encode(array_merge($payload, ['exp' => $expiry, 'iss' => $cfg['jwt']['issuer']]));

$base64UrlHeader = self::base64UrlEncode($header);
        $base64UrlPayload = self::base64UrlEncode($payload);
        $signature = hash_hmac('sha256', $base64UrlHeader . "." . $base64UrlPayload, $secret, true);
        $base64UrlSignature = self::base64UrlEncode($signature);

return $base64UrlHeader . "." . $base64UrlPayload . "." . $base64UrlSignature;
    }

/**
     * Verify a JWT token and return its payload.
     *
     * @param string $token
     * @return array Decoded payload
     * @throws \RuntimeException On invalid/expired token
     */
    public static function verify(string $token): array
    {
        $cfg = require __DIR__ . '/../config/config.php';
        $secret = $cfg['jwt']['secret'];

$parts = explode('.', $token);
        if (count($parts) !== 3) {
            throw new \RuntimeException('Invalid token format.');
        }

[$base64UrlHeader, $base64UrlPayload, $base64UrlSignature] = $parts;

// Verify signature
        $expectedSignature = hash_hmac('sha256', $base64UrlHeader . "." . $base64UrlPayload, $secret, true);
        $expectedBase64UrlSignature = self::base64UrlEncode($expectedSignature);

if (!self::hashEquals($base64UrlSignature, $expectedBase64UrlSignature)) {
            throw new \RuntimeException('Invalid token signature.');
        }

// Decode payload
        $payload = json_decode(self::base64UrlDecode($base64UrlPayload), true);
        if (!$payload) {
            throw new \RuntimeException('Unable to decode token payload.');
        }

// Check expiry
        if (isset($payload['exp']) && $payload['exp'] < time()) {
            throw new \RuntimeException('Token has expired.');
        }

return $payload;
    }

private static function base64UrlEncode(string $data): string
    {
        return rtrim(strtr(base64_encode($data), '+/', '-_'), '=');
    }

private static function base64UrlDecode(string $data): string
    {
        $remainder = strlen($data) % 4;
        if ($remainder) {
            $data .= str_repeat('=', 4 - $remainder);
        }
        return base64_decode(strtr($data, '-_', '+/'));
    }

/** Timing-safe comparison */
    private static function hashEquals(string $a, string $b): bool
    {
        if (function_exists('hash_equals')) {
            return hash_equals($a, $b);
        }
        // Fallback
        $len = strlen($a);
        if (strlen($b) !== $len) {
            return false;
        }
        $result = 0;
        for ($i = 0; $i < $len; $i++) {
            $result |= ord($a[$i]) ^ ord($b[$i]);
        }
        return $result === 0;
    }
}

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📁 assets/	DIR	—	2026-07-15 09:38
📁 Controllers/	DIR	—	2026-07-15 09:38
📁 database/	DIR	—	2026-11-04 12:46
📁 Middleware/	DIR	—	2026-11-04 12:46
📁 Models/	DIR	—	2026-07-15 07:57
📁 Routes/	DIR	—	2026-11-04 12:46
📁 Services/	DIR	—	2026-07-15 07:57
📁 uploads/	DIR	—	2026-07-15 10:47
📁 Utils/	DIR	—	2026-11-04 12:46
📄 .htaccess	HTACCESS	2.3 KB	2026-07-15 09:52	EDIT
📄 Auth.php	PHP	3.4 KB	2026-07-15 09:17	EDIT
📄 Database.php	PHP	814 B	2026-07-15 09:17	EDIT
📄 error_log	?	6.3 KB	2026-11-04 11:36	EDIT
📄 index.php	PHP	1.9 KB	2026-07-15 09:17	EDIT
📄 Router.php	PHP	5 KB	2026-07-15 09:17	EDIT