death-notifier/src/main/api.php

<?php

namespace main;

use PHPMailer\PHPMailer\Exception;
use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\SMTP;
use SQLite3;

/** @noinspection PhpIncludeInspection Exists after `npm run deploy` */
require_once __DIR__ . "/vendor/autoload.php";
require_once __DIR__ . "/Database.php";


//header("Content-type:application/json;charset=utf-8");


$config = parse_ini_file("config.default.ini.php", process_sections: true, scanner_mode: INI_SCANNER_TYPED);
if (file_exists("config.ini.php")) {
    $config_custom = parse_ini_file("config.ini.php", process_sections: true, scanner_mode: INI_SCANNER_TYPED);
    $config = array_merge($config, $config_custom);
}

// TODO: CSRF token check!
// TODO: GET should never modify state!!!

if (!file_exists($config["database"]["filename"])) {
    (new SQLite3($config["database"]["filename"]))->close();

    $db = new Database($config["database"]["filename"], SQLITE3_OPEN_READWRITE);
    $db->install();
    $db->close();
}

session_start();
if (isset($_GET["postisget"])) {
    $_POST = $_GET;
}

if (isset($_POST["action"])) {
    switch ($_POST["action"]) {
        case "add-user":
            if (!isset($_POST["email"], $_POST["password"], $_POST["password_confirm"])) {
                exit("missing inputs");
            }

            if (filter_var($_POST["email"], FILTER_VALIDATE_EMAIL)) {
                exit("invalid email");
            }

            if ($_POST["password"] !== $_POST["password_confirm"]) {
                exit("differing passwords");
            }

            $db = new Database($config["database"]["filename"], SQLITE3_OPEN_READONLY);
            if ($db->get_user_by_email($_POST["email"]) !== null) {
                exit("email already in use");
            }
            $db->close();

            $db = new Database($config["database"]["filename"], SQLITE3_OPEN_READWRITE);
            $uuid = bin2hex(random_bytes(16));
            $db->add_user($uuid, $_POST["email"], $_POST["password"]);
            $db->close();
            break;
        case "update-user-email":
            if (!isset($_POST["email"])) {
                exit("missing inputs");
            }

            if (!isset($_SESSION["uuid"])) {
                exit("not logged in");
            }

            if (filter_var($_POST["email"], FILTER_VALIDATE_EMAIL)) {
                exit("invalid email");
            }

            $db = new Database($config["database"]["filename"], SQLITE3_OPEN_READONLY);
            if ($db->get_user_by_email($_POST["email"]) !== null) {
                exit("email already in use");
            }
            $db->close();

            $db = new Database($config["database"]["filename"], SQLITE3_OPEN_READWRITE);
            $db->set_user_email($_SESSION["uuid"], $_POST["email"]);
            $db->close();
            break;
        case "update-user-password":
            if (!isset($_POST["password"], $_POST["password_confirm"])) {
                exit("missing inputs");
            }

            if (!isset($_SESSION["uuid"])) {
                exit("not logged in");
            }

            if ($_POST["password"] !== $_POST["password_confirm"]) {
                exit("differing passwords");
            }

            $db = new Database($config["database"]["filename"], SQLITE3_OPEN_READWRITE);
            $db->set_user_password($_SESSION["uuid"], $_POST["password"]);
            $db->close();
            break;
        case "delete-user":
            if (!isset($_SESSION["uuid"])) {
                exit("not logged in");
            }

            $db = new Database($config["database"]["filename"], SQLITE3_OPEN_READWRITE);
            $db->delete_user($_SESSION["uuid"]);
            $db->close();

            session_destroy();
            break;
        case "add-tracking":
            break;
        case "delete-tracking":
            break;
        case "send-test-email":
            // TODO: Send this to logged-in user

            $mail = new PHPMailer();
            $mail->IsSMTP();
            $mail->CharSet = "UTF-8";

            $mail->SMTPDebug = SMTP::DEBUG_OFF;
            $mail->Host = $config["mail"]["host"];
            $mail->SMTPAuth = true;
            $mail->Port = $config["mail"]["port"];
            $mail->Username = $config["mail"]["username"];
            $mail->Password = $config["mail"]["password"];
            $mail->SMTPSecure = PHPMailer::ENCRYPTION_SMTPS;
            try {
                $mail->setFrom($config["mail"]["username"], $config["mail"]["from_name"]);
                $mail->addAddress($config["mail"]["to_address_test"]);
            } catch (Exception $exception) {
                exit("false");
            }

            $mail->Subject = "Test mail";
            $mail->Body = "This is a test mail from death-notifier!";

            try {
                $mail->send();
            } catch (Exception $exception) {
                exit("false");
            }

            exit("true");
    }
} else if (isset($_GET["action"])) {
    switch ($_GET["action"]) {
        case "login":
            if (!isset($_GET["email"], $_GET["password"])) {
                exit();
            }

            $db = new Database($config["database"]["filename"], SQLITE3_OPEN_READWRITE);
            $user = $db->get_user_by_email($_GET["email"]);
            $db->close();

            if ($user === null || !password_verify($_GET["password"], $user["password"])) {
                exit("false");
            }

            $_SESSION["uuid"] = $user["uuid"];
            exit("true");
        case "logout":
            session_destroy();
            break;
        case "get-trackings":
            // Returns list of people of this user
            break;
    }
}