<?php
//======================================================================================
//
// Function: Validate the REEFT 2.0 Access token
//
// Programmer: AR
// Date : 2025-02-07
//
// Copyright Reeft A/S (c) - 2025
//======================================================================================
//======================================================================================
// Set session
//======================================================================================
if(!isset($_SESSION))
{
session_start();
}
//WHILE TESTING CALL WITH PARM test
if (isset($_GET['test']) && $_GET['test'] === 'Y') {
$apiUrl = $rftUrl . '/Authentication/Login/Gps';
$receivedToken = 'eyJhbGciOiJIUzM4NCIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI5OGQzYWVhYi0zZWRlLTMyNjYtOTEzYi00YTJkMGRiODVhNDMiLCJqdGkiOiIxN2E5N2YxNy1lNTkwLTRmNWYtYjBlMi1iODM0MjlkMjc4MzYiLCJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9uYW1lIjoic3VwZXJBZG1pbiIsImh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwOC8wNi9pZGVudGl0eS9jbGFpbXMvcm9sZSI6IlN1cGVyQWRtaW4iLCJQZXJtaXNzaW9ucyI6Ikdwc1Rva2VuIiwiUm9sZUlkIjoiMzY2N2E1NGYtYWEyNy00ZTNhLTg3NzgtYWQ3NTgzN2NmZTZhIiwiT3JnYW5pemF0aW9uSWQiOiJkZjkzNjU0ZS1kMWMzLTQ1OGItODAyMC0zNTlmMTlhZDYxY2UiLCJVc2VTaGFyZWREYXRhYmFzZSI6dHJ1ZSwiQ29uc2lkZXJPcmdhbml6YXRpb25IZWFkZXIiOmZhbHNlLCJleHAiOjE3OTI0OTc5NjQsImlzcyI6IlJlZWZ0Lk9yZ2FuaXphdGlvblNlcnZpY2UiLCJhdWQiOiJSZWVmdC5Pcmdhbml6YXRpb25TZXJ2aWNlIn0.J-WFQAeZsM4owbUQaX3QE7Ybe4W90vqyLuiU_QHTwwmlYHzQxmWRbeiT4s1kxSGG'; //super admin
//$receivedToken = 'eyJhbGciOiJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGRzaWctbW9yZSNobWFjLXNoYTM4NCIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI5OGQzYWVhYi0zZWRlLTMyNjYtOTEzYi00YTJkMGRiODVhNDMiLCJqdGkiOiJhMGE2YjVkMi0yNjg3LTQ5YWMtYjg1YS1hYWRiYjNmOTBkOTQiLCJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9uYW1lIjoiKzQ1MzEzMjMzNDAiLCJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dzLzIwMDgvMDYvaWRlbnRpdHkvY2xhaW1zL3JvbGUiOiJTdXBlckFkbWluIiwiU2NvcGVzIjoiUmVlZkFQSSIsIlJvbGVJZCI6IjM2NjdhNTRmLWFhMjctNGUzYS04Nzc4LWFkNzU4MzdjZmU2YSIsIk9yZ2FuaXphdGlvbklkIjoiZWQxY2RiOTgtZjliZS00ZTlkLTkxODQtNGQxYzcxMzAxZDQ0IiwiVXNlU2hhcmVkRGF0YWJhc2UiOnRydWUsImNvbnNpZGVyT3JnYW5pemF0aW9uSGVhZGVyIjp0cnVlLCJleHAiOjE3MzI3OTk2NTksImlzcyI6IlJlZWZ0Lk9yZ2FuaXphdGlvblNlcnZpY2UiLCJhdWQiOiJSZWVmdC5Pcmdhbml6YXRpb25TZXJ2aWNlIn0.t_zI1z2_4N_wehjixfjfDCmBXzAKrN1YU53AlTjJt9zSGvbV9P5VxwkTERBjfgS5'; //expired
//$receivedToken = 'eyJhbGciOiJIUzM4NCIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMzEzMzg5Yi1kMDNjLTRmNzYtYjRkOC0wOGRjOGJhNDU1MzIiLCJqdGkiOiI3Mzk0ZGU4Yy04ZTZhLTRiZWUtYmZiZi03YmJmNzE5YzdmOWMiLCJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9uYW1lIjoiIiwiaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93cy8yMDA4LzA2L2lkZW50aXR5L2NsYWltcy9yb2xlIjoiT3JnYW5pemF0aW9uQWRtaW4iLCJTY29wZXMiOiJSZWVmdCIsIlJvbGVJZCI6Ijk2MmYzNDM2LTNiODUtNGYxMi1hMDdkLTk3N2YzZmQ1ZGNlMiIsIk9yZ2FuaXphdGlvbklkIjoiZWQxY2RiOTgtZjliZS00ZTlkLTkxODQtNGQxYzcxMzAxZDQ0IiwiVXNlU2hhcmVkRGF0YWJhc2UiOnRydWUsIkNvbnNpZGVyT3JnYW5pemF0aW9uSGVhZGVyIjpmYWxzZSwiZXhwIjoxNzkyMzkzNTIyLCJpc3MiOiJSZWVmdC5Pcmdhbml6YXRpb25TZXJ2aWNlIiwiYXVkIjoiUmVlZnQuT3JnYW5pemF0aW9uU2VydmljZSJ9.m-RWjbjJuXNGvoAe5Tb8KvgXD0r0ZUr0X3nqZKul_jE3XuYQTSwLkpps5ygCBguk'; //admin (min service bix)
$ConsiderOrganizationHeader = 0;
$UseSharedDb = 1;
$TargetOrganization = 'DF93654E-D1C3-458B-8020-359F19AD61CE';
authorization($receivedToken, $ConsiderOrganizationHeader, $UseSharedDb, $TargetOrganization, 'da');
} else {
// Get token from the request header (not used GPS will receive everything in the body from web, including token, ConsiderOrganizationHeader, TargetOrganization, UseSharedDb and language.)
//$headers = getallheaders();
// Read the raw JSON data from the request body - changed so we use a GET
//$requestBody = file_get_contents('php://input');
//$requestData = json_decode($requestBody, true);
if (isset($_REQUEST['token']) ) {
$receivedToken = trim(str_replace('Bearer', '', $_REQUEST['token']));
} else {
$receivedToken = null;
http_response_code(400); // Bad Request
displayError('Bearer token not provided');
exit;
}
if (isset($_REQUEST['language']) ) {
$loginLanguage = $_REQUEST['language'];
if (!in_array($loginLanguage, ["en", "de", "da", "no", "sv"])) {
http_response_code(400); // Bad Request
displayError('Language not allow (allow is ["en", "de", "da", "no", "sv"])');
exit;
}
} else {
http_response_code(400); // Bad Request
echo json_encode(['error' => 'Language missing']);
displayError('Language missing');
exit;
}
if (isset($_REQUEST['ConsiderOrganizationHeader']) ) {
$ConsiderOrganizationHeader = $_REQUEST['ConsiderOrganizationHeader'];
} else {
http_response_code(400); // Bad Request
displayError('ConsiderOrganizationHeader missing');
exit;
}
if (isset($_REQUEST['UseSharedDb']) ) {
$UseSharedDb = $_REQUEST['UseSharedDb'];
} else {
http_response_code(400); // Bad Request
displayError('UseSharedDb missing');
exit;
}
if (isset($_REQUEST['TargetOrganization']) ) {
$TargetOrganization = $_REQUEST['TargetOrganization'];
} else {
http_response_code(400); // Bad Request
displayError('TargetOrganization missing');
exit;
}
if (isset($_REQUEST['origin']) ) {
$origin = $_REQUEST['origin'];
} else {
$origin = 'production';
}
//if staging or test we have to ensure we uses right url
if (isset($_REQUEST['origin']) ) {
if ($_REQUEST['origin'] == 'staging') {
$rftUrl = 'https://staging-bffweb.reeft.com/api'; // staging url
$rftUrlCustomer = 'https://staging-customer.reeft.com/api';
$rftUrlOrganization = 'https://staging-organization.reeft.com/api';
} else if ($_REQUEST['origin'] == 'azdev') {
$rftUrl = 'https://azdev-bffweb.reeft.com/api'; // azdev url
$rftUrlCustomer = 'https://azdev-customer.reeft.com/api';
$rftUrlOrganization = 'https://azdev-organization.reeft.com/api';
} else if ($_REQUEST['origin'] == 'aztest') {
$rftUrl = 'https://aztest-bffweb.reeft.com/api'; // aztest url
$rftUrlCustomer = 'https://aztest-customer.reeft.com/api';
$rftUrlOrganization = 'https://aztest-organization.reeft.com/api';
} else if ($_REQUEST['origin'] == 'production') {
$rftUrl = 'https://bffweb.reeft.com/api'; // live url
$rftUrlCustomer = 'https://customer.reeft.com/api';
$rftUrlOrganization = 'https://organization.reeft.com/api';
}
}
// Check for Authorization header
if ($receivedToken) {
$auth = authorization($receivedToken, $ConsiderOrganizationHeader, $UseSharedDb, $TargetOrganization, $loginLanguage, $origin);
if ($auth == "OK") {
http_response_code(200); // OK
}
}
}
function authorization($receivedToken, $ConsiderOrganizationHeader, $UseSharedDb, $TargetOrganization , $loginLanguage, $origin) {
global $rftUrl;
$apiUrl = $rftUrl . '/Authentication/Login/Gps';
// cURL setup
$ch = curl_init($apiUrl);;
$headers = [
'accept: text/plain',
'Authorization: Bearer ' . $receivedToken,
'ConsiderOrganizationHeader: ' . $ConsiderOrganizationHeader,
'UseSharedDb: ' . $UseSharedDb,
'TargetOrganization: ' . $TargetOrganization,
];
// cURL options
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_POST, true); // Explicitly set the method to POST
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
// Execute cURL request
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if (curl_errno($ch)) {
$curlError = curl_error($ch);
} else {
$curlError = false;
}
// Close cURL resource
curl_close($ch);
if ($curlError) {
http_response_code(400); // Bad Request
$errorMessage = 'cURL error calling Authentication/Login/Gps - ' . $curlError;
displayError($errorMessage);
exit;
}
if ($httpCode != '200'){
http_response_code(400); // Bad Request
$errorMessage = 'httpCode recieved calling Authentication/Login/Gps - ' . $httpCode;
displayError($errorMessage);
exit;
}
$data = json_decode($response, true);
$token = $data["token"];
$refreshToken = $data["refreshToken"];
$_SESSION['receivedToken'] = $receivedToken;
$_SESSION['ConsiderOrganizationHeader'] = $ConsiderOrganizationHeader;
$_SESSION['UseSharedDb'] = $UseSharedDb;
$_SESSION['TargetOrganization'] = $TargetOrganization;
$_SESSION['loginLanguage'] = $loginLanguage;
$_SESSION['token'] = $token;
$_SESSION['origin'] = $origin;
$_SESSION['refreshToken'] = $data["refreshToken"];
$_SESSION['loginOrganizationId'] = $data["organizationId"];
$_SESSION['loginOrganizationName'] = $data["organizationName"];
$_SESSION['loginUserId'] = $data["userId"];
$_SESSION['loginUserName'] = $data["name"];
$_SESSION['loginUserRole'] = $data["role"][0];
$_SESSION['loginDepartmentId'] = $data["departmentId"];
$_SESSION['loginDepartmentName'] = $data["departmentName"];
return "OK";
}
// Display an error message to the user in the opened window
function displayError($errorMessage) {
?>
<!DOCTYPE html>
<html>
<head>
<title>Error</title>
<style>
body {
font-family: Arial, sans-serif;
text-align: center;
margin-top: 50px;
}
.error-box {
display: inline-block;
border: 1px solid red;
padding: 20px;
background-color: #ffe6e6;
color: red;
font-weight: bold;
border-radius: 10px;
}
</style>
</head>
<body>
<div class="error-box">
<p>Sorry, you do not have access to this page</p>
<p>Please try again from the webplanner or contact support and provide the error message below</p>
<p>Error: <?php echo htmlspecialchars($errorMessage); ?></p>
</div>
</body>
</html>
<?php
}
?>