Browser setup is disabled. Set a private setup key in config.local.php or run the CLI setup described in the README.
Need a password reset? Ask your site administrator.
Optional. Leave unchecked for the usual 30-minute inactivity timeout. Don't enable on a shared device.
Need a password reset? Ask your site administrator.
Signed in as
Change your temporary password before opening a project or managing users.
diff --git a/user-management/src/Auth.php b/user-management/src/Auth.php index c8081c06..18c4492e 100644 --- a/user-management/src/Auth.php +++ b/user-management/src/Auth.php @@ -6,6 +6,11 @@ use Jasr\Framework\PasswordSession; use Jasr\Framework\Response; +/* File Name: Auth.php +Revision: 1.1.0 +Modified Date: 2026-10-27 +Changelog: 1.1.0 - Offer opt-in seven-day shared login without changing default expiry. +*/ final class Auth { public readonly Directory $directory; @@ -16,7 +21,7 @@ public function __construct(private array $config) throw new \RuntimeException('HTTPS is required.'); } $this->directory = new Directory($config['data_path']); - $this->session = new PasswordSession($config['cookie_name'], $config['cookie_path'], $config['secure_cookie'], $config['timeout']); + $this->session = new PasswordSession($config['cookie_name'], $config['cookie_path'], $config['secure_cookie'], $config['timeout'], $config['remember_seconds']); header('Cache-Control: no-store'); } public function csrf(): string { return $this->session->csrf(); } @@ -29,7 +34,7 @@ public function user(): ?array if (!$user || !$user['active'] || $user['version'] !== ($_SESSION['identity_version'] ?? null)) return null; return Directory::publicUser($user); } - public function login(string $username, string $password): bool + public function login(string $username, string $password, bool $remember = false): bool { $username = strtolower(trim($username)); $remoteIp = (string) ($_SERVER['REMOTE_ADDR'] ?? 'cli'); @@ -59,6 +64,7 @@ public function login(string $username, string $password): bool $this->session->logout(); // Rotate ID/token before establishing the shared identity. $_SESSION['identity_id'] = $found['id']; $_SESSION['identity_version'] = $found['version']; + if ($remember) $this->session->enableRemember(); // Do not clear the peer-IP counter: it also limits password spraying. JsonStore::update($this->config['data_path'] . '/attempts.json', function (array $r) use ($keys): array { unset($r[$keys[0]]); diff --git a/user-management/tests/remember.test.cjs b/user-management/tests/remember.test.cjs new file mode 100644 index 00000000..45fbea4d --- /dev/null +++ b/user-management/tests/remember.test.cjs @@ -0,0 +1,123 @@ +/* +File Name: remember.test.cjs +Author: Jason Lamb (with help from ChatGPT) +Description: Isolated HTTP verification for opt-in seven-day central login, expiry and sign-out. +Revision: 1.0.1 +Created Date: 2026-10-27 +Modified Date: 2026-10-27 +Changelog: 1.0.1 - Check that remembered cookies retain fixed original expiry after a page load. 1.0.0 - Check session-only default, secure cookie flags, remembered expiry and revocation. +*/ +'use strict'; +const {test,after}=require('node:test'); +const assert=require('node:assert/strict'); +const fs=require('node:fs'); +const os=require('node:os'); +const path=require('node:path'); +const {spawn}=require('node:child_process'); +const root=path.resolve(__dirname,'../..'); +const temp=fs.mkdtempSync(path.join(os.tmpdir(),'jasr-remember-')); +for(const name of ['1-Framework','user-management']) + fs.cpSync(path.join(root,name),path.join(temp,name),{recursive:true}); +const data=path.join(temp,'user-management/data'); +for(const name of fs.readdirSync(data))if(name!=='.htaccess') + fs.rmSync(path.join(data,name),{recursive:true,force:true}); +const key='isolated-remember-test-key-at-least-32-characters'; +fs.writeFileSync(path.join(temp,'user-management/config.local.php'), + "false,'setup_key'=>'"+key+"'];"); +fs.writeFileSync(path.join(temp,'expire.php'), + "user()) {http_response_code(401);exit;}\n"+ + "$_SESSION['remember_until']=time()-1;\n"+ + "echo 'test-only forced expiration';\n"); +const port=18963,host='http://127.0.0.1:'+port; +const server=spawn('php',['-S','127.0.0.1:'+port,'-t',temp],{stdio:['ignore','pipe','pipe']}); +let logs=''; +server.stderr.on('data',chunk=>logs+=String(chunk)); +after(()=>{server.kill();fs.rmSync(temp,{recursive:true,force:true});if(/Fatal error|Parse error/.test(logs))console.error(logs);}); + +class Browser{ + cookie='';csrf=''; + async request(url='/user-management/',post=null){ + const headers={Cookie:this.cookie}; + if(post)headers['Content-Type']='application/x-www-form-urlencoded'; + const options={headers,redirect:'manual'}; + if(post){options.method='POST';options.body=new URLSearchParams({csrf:this.csrf,...post});} + const res=await fetch(host+url,options); + const cookies=res.headers.getSetCookie?.()||[]; + if(cookies.length)this.cookie=cookies[cookies.length-1].split(';')[0]; + const text=await res.text(); + const match=text.match(/name="csrf" value="([a-f0-9]+)"/); + if(match)this.csrf=match[1]; + return {status:res.status,text,cookies}; + } + async post(action,details={}){ + const res=await this.request('/user-management/',{action,...details}); + if(res.status===303)await this.request(); + return res; + } +} +const password='example-password-for-tests-2026'; +test('default idle session, opt-in remembered login, and global logout',async()=>{ + let ready=false; + for(let i=0;i<100;i++){ + try{await fetch(host+'/user-management/');ready=true;break;} + catch{await new Promise(resolve=>setTimeout(resolve,80));} + } + assert.ok(ready,'isolated PHP HTTP server must start; logs: '+logs); + const browser=new Browser(); + let res=await browser.request(); + assert.match(res.text,/Create the first administrator/); + assert.equal((await browser.post('setup',{ + setup_key:key,username:'member',name:'Test Member', + password,confirm_password:password + })).status,303); + res=await browser.request(); + assert.match(res.text,/Stay signed in for 7 days/); + assert.match(res.text,/30-minute inactivity/); + + // Without the checkbox, browser closes end the session; no persistent Expires. + const normal=await browser.post('login',{username:'member',password}); + assert.equal(normal.status,303); + assert.ok(normal.cookies.length>0,'PHP rotates the cookie after login'); + assert.ok(normal.cookies.every(x=>!/;\s*expires=/i.test(x)), + 'default login sets session-only cookies'); + assert.match((await browser.request()).text,/Signed in as/); + + await browser.post('logout'); + assert.match((await browser.request()).text,/Every session counts. Progress happens one workout at a time.
-Workout Tracker v1.6.0 · Updated October 27, 2026
+Workout Tracker v1.7.0 · Updated October 27, 2026