271 lines
11 KiB
PHP
271 lines
11 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
/**
|
|
* Öffentliche Demo-API der Terminbuchung.
|
|
*
|
|
* Die Datei ist absichtlich nicht an Contao-Tabellen gekoppelt: Sie wird unter
|
|
* /booking/api.php direkt von Apache ausgeliefert und kann dadurch gleich aus
|
|
* der statischen Vorschau und aus einem Contao-HTML-Element verwendet werden.
|
|
*/
|
|
|
|
header('Content-Type: application/json; charset=utf-8');
|
|
header('Cache-Control: no-store');
|
|
header('X-Content-Type-Options: nosniff');
|
|
|
|
function respond(int $status, array $payload): never
|
|
{
|
|
http_response_code($status);
|
|
echo json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES | JSON_THROW_ON_ERROR);
|
|
exit;
|
|
}
|
|
|
|
function bookingDatabase(): PDO
|
|
{
|
|
$databaseUrl = getenv('DATABASE_URL');
|
|
if (!is_string($databaseUrl) || $databaseUrl === '') {
|
|
throw new RuntimeException('DATABASE_URL is not configured.');
|
|
}
|
|
|
|
$parts = parse_url($databaseUrl);
|
|
if (!is_array($parts) || ($parts['scheme'] ?? '') !== 'mysql' || !isset($parts['host'], $parts['path'], $parts['user'])) {
|
|
throw new RuntimeException('DATABASE_URL is invalid.');
|
|
}
|
|
|
|
$database = ltrim($parts['path'], '/');
|
|
if ($database === '') {
|
|
throw new RuntimeException('DATABASE_URL has no database name.');
|
|
}
|
|
|
|
$port = isset($parts['port']) ? (int) $parts['port'] : 3306;
|
|
$dsn = sprintf('mysql:host=%s;port=%d;dbname=%s;charset=utf8mb4', $parts['host'], $port, $database);
|
|
|
|
return new PDO($dsn, rawurldecode($parts['user']), rawurldecode($parts['pass'] ?? ''), [
|
|
PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
|
|
PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
|
|
PDO::ATTR_EMULATE_PREPARES => false,
|
|
]);
|
|
}
|
|
|
|
function bookingSession(): void
|
|
{
|
|
if (session_status() === PHP_SESSION_ACTIVE) {
|
|
return;
|
|
}
|
|
|
|
session_name('sufw_booking');
|
|
session_set_cookie_params([
|
|
'httponly' => true,
|
|
'samesite' => 'Lax',
|
|
'secure' => (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off'),
|
|
]);
|
|
session_start();
|
|
}
|
|
|
|
function csrfToken(): string
|
|
{
|
|
bookingSession();
|
|
if (!isset($_SESSION['csrf_token'])) {
|
|
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
|
|
}
|
|
|
|
return $_SESSION['csrf_token'];
|
|
}
|
|
|
|
function ensureBookingRateLimit(): void
|
|
{
|
|
bookingSession();
|
|
$now = time();
|
|
$recent = array_values(array_filter($_SESSION['booking_requests'] ?? [], static fn ($timestamp): bool => is_int($timestamp) && $timestamp > $now - 900));
|
|
if (count($recent) >= 10) {
|
|
respond(429, ['error' => 'Zu viele Anfragen. Bitte versuchen Sie es später erneut.']);
|
|
}
|
|
|
|
$recent[] = $now;
|
|
$_SESSION['booking_requests'] = $recent;
|
|
}
|
|
|
|
function readJsonBody(): array
|
|
{
|
|
$contentLength = (int) ($_SERVER['CONTENT_LENGTH'] ?? 0);
|
|
if ($contentLength > 32768) {
|
|
respond(413, ['error' => 'Die Anfrage ist zu groß.']);
|
|
}
|
|
|
|
try {
|
|
$payload = json_decode((string) file_get_contents('php://input'), true, 32, JSON_THROW_ON_ERROR);
|
|
} catch (JsonException) {
|
|
respond(400, ['error' => 'Die Anfrage konnte nicht verarbeitet werden.']);
|
|
}
|
|
|
|
if (!is_array($payload)) {
|
|
respond(400, ['error' => 'Die Anfrage konnte nicht verarbeitet werden.']);
|
|
}
|
|
|
|
return $payload;
|
|
}
|
|
|
|
function stringField(array $payload, string $name, int $maxLength): string
|
|
{
|
|
$value = trim((string) ($payload[$name] ?? ''));
|
|
if ($value === '' || mb_strlen($value) > $maxLength) {
|
|
throw new InvalidArgumentException($name);
|
|
}
|
|
|
|
return $value;
|
|
}
|
|
|
|
function dateField(array $payload, string $name): ?string
|
|
{
|
|
$value = trim((string) ($payload[$name] ?? ''));
|
|
if ($value === '') {
|
|
return null;
|
|
}
|
|
|
|
$date = DateTimeImmutable::createFromFormat('!Y-m-d', $value);
|
|
return $date && $date->format('Y-m-d') === $value ? $value : null;
|
|
}
|
|
|
|
function registrationId(): string
|
|
{
|
|
$hex = bin2hex(random_bytes(16));
|
|
return sprintf('%s-%s-%s-%s-%s', substr($hex, 0, 8), substr($hex, 8, 4), substr($hex, 12, 4), substr($hex, 16, 4), substr($hex, 20));
|
|
}
|
|
|
|
function normaliseEvent(array $event): array
|
|
{
|
|
$event['id'] = (string) $event['id'];
|
|
$event['capacity'] = (int) $event['capacity'];
|
|
$event['confirmedCount'] = (int) $event['confirmedCount'];
|
|
$event['availableCapacity'] = max(0, $event['capacity'] - $event['confirmedCount']);
|
|
$event['status'] = $event['availableCapacity'] > 0 ? 'available' : 'full';
|
|
$event['introductionRequired'] = (bool) $event['introductionRequired'];
|
|
unset($event['confirmedCount']);
|
|
return $event;
|
|
}
|
|
|
|
function listEvents(PDO $database): never
|
|
{
|
|
$project = (string) ($_GET['project'] ?? '');
|
|
$from = (string) ($_GET['from'] ?? '');
|
|
$to = (string) ($_GET['to'] ?? '');
|
|
if (!in_array($project, ['perspektivwerk', 'produktionsschule'], true) || !preg_match('/^\d{4}-\d{2}-\d{2}$/', $from) || !preg_match('/^\d{4}-\d{2}-\d{2}$/', $to)) {
|
|
respond(400, ['error' => 'Ungültige Kalenderanfrage.']);
|
|
}
|
|
|
|
$fromDate = DateTimeImmutable::createFromFormat('!Y-m-d', $from);
|
|
$toDate = DateTimeImmutable::createFromFormat('!Y-m-d', $to);
|
|
if (!$fromDate || !$toDate || $fromDate >= $toDate || $fromDate->diff($toDate)->days > 93) {
|
|
respond(400, ['error' => 'Ungültiger Kalenderzeitraum.']);
|
|
}
|
|
|
|
$statement = $database->prepare(<<<'SQL'
|
|
SELECT e.id, e.project, e.title, e.starts_at AS startsAt, e.ends_at AS endsAt,
|
|
e.capacity, e.format, e.introduction_required AS introductionRequired,
|
|
e.contact_name AS contactName,
|
|
COUNT(r.id) AS confirmedCount
|
|
FROM sufw_booking_events e
|
|
LEFT JOIN sufw_booking_registrations r ON r.event_id = e.id AND r.status = 'confirmed'
|
|
WHERE e.project = :project AND e.is_active = 1
|
|
AND e.starts_at < :toDate AND e.ends_at >= :fromDate
|
|
GROUP BY e.id
|
|
ORDER BY e.starts_at, e.title
|
|
SQL);
|
|
$statement->execute(['project' => $project, 'fromDate' => "$from 00:00:00", 'toDate' => "$to 00:00:00"]);
|
|
|
|
respond(200, ['csrfToken' => csrfToken(), 'events' => array_map('normaliseEvent', $statement->fetchAll())]);
|
|
}
|
|
|
|
function createRegistration(PDO $database): never
|
|
{
|
|
ensureBookingRateLimit();
|
|
$providedToken = (string) ($_SERVER['HTTP_X_SUFW_BOOKING_CSRF'] ?? '');
|
|
if (!hash_equals(csrfToken(), $providedToken)) {
|
|
respond(403, ['error' => 'Die Sitzung ist abgelaufen. Bitte laden Sie den Kalender neu.']);
|
|
}
|
|
|
|
$payload = readJsonBody();
|
|
$project = (string) ($payload['project'] ?? '');
|
|
$eventId = (string) ($payload['eventId'] ?? '');
|
|
$privacyAccepted = ($payload['privacyAccepted'] ?? false) === true;
|
|
try {
|
|
$name = stringField($payload, 'name', 160);
|
|
$email = mb_strtolower(stringField($payload, 'email', 254));
|
|
$phone = stringField($payload, 'phone', 64);
|
|
} catch (InvalidArgumentException) {
|
|
respond(422, ['error' => 'Bitte prüfen Sie Ihre Pflichtangaben.']);
|
|
}
|
|
|
|
if (!in_array($project, ['perspektivwerk', 'produktionsschule'], true) || !preg_match('/^[a-f0-9-]{36}$/', $eventId) || !filter_var($email, FILTER_VALIDATE_EMAIL) || !preg_match('/^[0-9+()\-\/\s]{6,64}$/', $phone) || !$privacyAccepted) {
|
|
respond(422, ['error' => 'Bitte prüfen Sie Ihre Pflichtangaben.']);
|
|
}
|
|
|
|
$introductionAttended = ($payload['introductionAttended'] ?? false) === true;
|
|
$introductionDate = dateField($payload, 'introductionDate');
|
|
try {
|
|
$database->beginTransaction();
|
|
$eventStatement = $database->prepare('SELECT id, introduction_required, capacity FROM sufw_booking_events WHERE id = :id AND project = :project AND is_active = 1 FOR UPDATE');
|
|
$eventStatement->execute(['id' => $eventId, 'project' => $project]);
|
|
$event = $eventStatement->fetch();
|
|
if (!$event) {
|
|
$database->rollBack();
|
|
respond(404, ['error' => 'Dieser Termin ist nicht mehr verfügbar.']);
|
|
}
|
|
if ((bool) $event['introduction_required'] && (!$introductionAttended || $introductionDate === null)) {
|
|
$database->rollBack();
|
|
respond(422, ['error' => 'Bitte bestätigen Sie die Einführungsveranstaltung und geben Sie das Datum an.']);
|
|
}
|
|
|
|
$countStatement = $database->prepare("SELECT COUNT(*) FROM sufw_booking_registrations WHERE event_id = :eventId AND status = 'confirmed'");
|
|
$countStatement->execute(['eventId' => $eventId]);
|
|
if ((int) $countStatement->fetchColumn() >= (int) $event['capacity']) {
|
|
$database->rollBack();
|
|
respond(409, ['error' => 'Dieser Termin ist inzwischen ausgebucht. Bitte wählen Sie einen anderen Termin.']);
|
|
}
|
|
|
|
$duplicateStatement = $database->prepare("SELECT id FROM sufw_booking_registrations WHERE event_id = :eventId AND status = 'confirmed' AND email = :email AND name = :name LIMIT 1");
|
|
$duplicateStatement->execute(['eventId' => $eventId, 'email' => $email, 'name' => $name]);
|
|
if ($duplicateStatement->fetch()) {
|
|
$database->rollBack();
|
|
respond(409, ['error' => 'Für diese Person liegt bereits eine bestätigte Anmeldung vor.']);
|
|
}
|
|
|
|
$insert = $database->prepare(<<<'SQL'
|
|
INSERT INTO sufw_booking_registrations
|
|
(id, event_id, status, name, email, phone, privacy_accepted_at, introduction_attended, introduction_date)
|
|
VALUES
|
|
(:id, :eventId, 'confirmed', :name, :email, :phone, UTC_TIMESTAMP(), :introductionAttended, :introductionDate)
|
|
SQL);
|
|
$insert->execute([
|
|
'id' => registrationId(), 'eventId' => $eventId, 'name' => $name, 'email' => $email, 'phone' => $phone,
|
|
'introductionAttended' => $introductionAttended ? 1 : 0,
|
|
'introductionDate' => $introductionAttended ? $introductionDate : null,
|
|
]);
|
|
$database->commit();
|
|
} catch (Throwable $exception) {
|
|
if ($database->inTransaction()) {
|
|
$database->rollBack();
|
|
}
|
|
error_log('SUFW booking API: '.$exception->getMessage());
|
|
respond(500, ['error' => 'Die Anmeldung konnte nicht gespeichert werden. Bitte versuchen Sie es später erneut.']);
|
|
}
|
|
|
|
respond(201, ['message' => 'Ihre Anmeldung wurde verbindlich gespeichert.']);
|
|
}
|
|
|
|
try {
|
|
$database = bookingDatabase();
|
|
if ($_SERVER['REQUEST_METHOD'] === 'GET') {
|
|
listEvents($database);
|
|
}
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
|
createRegistration($database);
|
|
}
|
|
header('Allow: GET, POST');
|
|
respond(405, ['error' => 'Diese Methode wird nicht unterstützt.']);
|
|
} catch (Throwable $exception) {
|
|
error_log('SUFW booking API: '.$exception->getMessage());
|
|
respond(500, ['error' => 'Der Kalender ist vorübergehend nicht verfügbar.']);
|
|
}
|