EventListener.php

<?php
/**
 * Copyright 2025 AXYNUK
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 * FOSSBilling Two-Factor Authentication Extension
 * Event Hooks - Login Interception
 *
 * @copyright 2025 AXYNUK
 * @license   http://www.apache.org/licenses/LICENSE-2.0 Apache-2.0
 * @version   1.0.0
 */

/**
 * Event Hooks for Two-Factor Authentication
 * 
 * These hooks intercept the login process AFTER credentials are validated
 * but BEFORE the session is fully established.
 */

namespace Box\Mod\Twofactor;

class EventListener
{
    protected $di;

    public function __construct($di)
    {
        $this->di = $di;
    }

    /**
     * Hook: After admin login credentials validated
     * Event: onAfterAdminLogin
     * 
     * This is called after credentials are checked but before dashboard access
     */
    public function onAfterAdminLogin(\Box_Event $event)
    {
        $params = $event->getParameters();
        $admin_id = $params['id'] ?? null;

        if (!$admin_id) {
            return; // No admin ID, let normal flow continue
        }

        // Get 2FA service
        $service = $this->di['mod_service']('twofactor');

        // Check if 2FA is enabled for this admin
        if (!$service->isEnabledForUser($admin_id, 'admin')) {
            return; // 2FA not enabled, let normal flow continue
        }

        // 2FA is enabled - intercept the login
        $session = $this->di['session'];

        // Clear the admin session that was just set
        $session->delete('admin');

        // Set partial authentication state
        $session->set('twofactor_pending', true);
        $session->set('twofactor_user_id', $admin_id);
        $session->set('twofactor_user_type', 'admin');
        $session->set('twofactor_attempts', 0);

        // Generate and send 2FA code
        try {
            $result = $service->createAndSendCode($admin_id, 'admin');
            
            // Redirect to 2FA verification page
            header('Location: /admin/twofactor/verify');
            exit;

        } catch (\Exception $e) {
            error_log("2FA Error: " . $e->getMessage());
            
            // On error, clear 2FA state and show error
            $session->delete('twofactor_pending');
            $session->delete('twofactor_user_id');
            $session->delete('twofactor_user_type');
            
            $session->set('error', 'Failed to send verification code. Please try again.');
            header('Location: /admin/login');
            exit;
        }
    }

    /**
     * Hook: After client login credentials validated
     * Event: onAfterClientLogin
     * 
     * This is called after credentials are checked but before client area access
     */
    public function onAfterClientLogin(\Box_Event $event)
    {
        $params = $event->getParameters();
        $client_id = $params['id'] ?? null;

        if (!$client_id) {
            return; // No client ID, let normal flow continue
        }

        // Get 2FA service
        $service = $this->di['mod_service']('twofactor');

        // Check if 2FA is enabled for this client
        if (!$service->isEnabledForUser($client_id, 'client')) {
            return; // 2FA not enabled, let normal flow continue
        }

        // 2FA is enabled - intercept the login
        $session = $this->di['session'];

        // Clear the client session that was just set
        $session->delete('client');

        // Set partial authentication state
        $session->set('twofactor_pending', true);
        $session->set('twofactor_user_id', $client_id);
        $session->set('twofactor_user_type', 'client');
        $session->set('twofactor_attempts', 0);

        // Generate and send 2FA code
        try {
            $result = $service->createAndSendCode($client_id, 'client');
            
            // Redirect to 2FA verification page
            header('Location: /twofactor/verify');
            exit;

        } catch (\Exception $e) {
            error_log("2FA Error: " . $e->getMessage());
            
            // On error, clear 2FA state and show error
            $session->delete('twofactor_pending');
            $session->delete('twofactor_user_id');
            $session->delete('twofactor_user_type');
            
            $session->set('error', 'Failed to send verification code. Please try again.');
            header('Location: /login');
            exit;
        }
    }
}