SWAMPy

✎ CARVE FLESH

EDITING: login.php

<?php

// admin/auth/login.php

require_once __DIR__ . '/../../config/database.php';
require_once __DIR__ . '/../../helpers/response.php';
require_once __DIR__ . '/../../helpers/validate.php';
require_once __DIR__ . '/../../middleware/auth.php';
require_once __DIR__ . '/../../models/AdminUser.php';

$pdo = require __DIR__ . '/../../config/database.php';
$adminModel = new AdminUser($pdo);

$input = json_decode(file_get_contents('php://input'), true);
$email = $input['email'] ?? '';
$password = $input['password'] ?? '';

if (empty($email) || empty($password)) {
    json_error('AUTH_ERROR', 'Email and password are required.', 401);
}

try {
    $user = $adminModel->findByEmail($email);

if (!$user || !$adminModel->verifyPassword($password, $user['password_hash'])) {
        json_error('AUTH_ERROR', 'Invalid credentials.', 401);
    }

$adminModel->updateLastLogin($user['id']);

$accessToken = issueJwt($user['id'], $user['role'], 2); // 2hr access token
    $refreshToken = issueJwt($user['id'], $user['role'], 168); // 7 day refresh token (168 hrs)

// Set refresh token in httpOnly cookie (Section 6)
    setcookie('refresh_token', $refreshToken, [
        'expires' => time() + (7 * 24 * 3600),
        'path' => '/api/admin/auth',
        'domain' => $_SERVER['HTTP_HOST'],
        'secure' => true,
        'httponly' => true,
        'samesite' => 'Strict'
    ]);

json_success([
        'user' => [
            'id' => $user['id'],
            'name' => $user['name'],
            'email' => $user['email'],
            'role' => $user['role'],
            'avatar_url' => $user['avatar_url']
        ],
        'access_token' => $accessToken
    ]);

} catch (Exception $e) {
    json_error('SERVER_ERROR', $e->getMessage(), 500);
}

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📄 change-password.php	PHP	1.9 KB	2026-07-03 12:03	EDIT
📄 error_log	?	2.3 KB	2026-08-21 18:50	EDIT
📄 login.php	PHP	1.7 KB	2026-07-02 10:29	EDIT
📄 refresh.php	PHP	1 KB	2026-07-02 10:29	EDIT