mobile app api

2026-07-27 21:04:07 +03:00
parent 9241e177ac
commit 6913024596
54 changed files with 5156 additions and 0 deletions
@@ -0,0 +1,42 @@
+<?php
+require __DIR__ . '/_bootstrap.php';
+
+/**
+ * @OA\Post(
+ *   path="/password-change.php",
+ *   tags={"Auth"},
+ *   summary="Change the password of the signed-in user",
+ *   description="Revokes every other token; the current device stays signed in.",
+ *   security={{"bearerAuth":{}}},
+ *   @OA\RequestBody(required=true, @OA\JsonContent(
+ *     required={"current_password","new_password"},
+ *     @OA\Property(property="current_password", type="string", format="password"),
+ *     @OA\Property(property="new_password", type="string", format="password", minLength=8)
+ *   )),
+ *   @OA\Response(response=200, ref="#/components/responses/Success"),
+ *   @OA\Response(response=401, ref="#/components/responses/Unauthorized"),
+ *   @OA\Response(response=422, ref="#/components/responses/ValidationError")
+ * )
+ */
+require_method('POST');
+$user = require_auth($pdo);
+
+$in      = body();
+$current = (string) ($in['current_password'] ?? '');
+$new     = (string) ($in['new_password'] ?? '');
+
+if (strlen($new) < 8) {
+    json_error(422, 'Validation failed', ['new_password' => ['At least 8 characters']]);
+}
+if (!password_verify($current, (string) $user['password'])) {
+    json_error(422, 'Validation failed', ['current_password' => ['Wrong password']]);
+}
+
+$pdo->prepare('UPDATE auth_users SET password = ? WHERE id = ?')
+    ->execute([password_hash($new, PASSWORD_DEFAULT), $user['id']]);
+
+// Keep the device that just changed the password signed in.
+$pdo->prepare('DELETE FROM api_tokens WHERE user_id = ? AND token <> ?')
+    ->execute([$user['id'], hash('sha256', (string) bearer_token())]);
+
+json_ok();