feat: bot WhatsApp Business API — Palmas360 inicial

2026-06-04 13:35:23 -05:00
commit 202a263e25
18 changed files with 2100 additions and 0 deletions
@@ -0,0 +1,88 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Middleware de autenticación JWT HS256.
+ *
+ * Valida el header:  Authorization: Bearer <token>
+ * El secreto se toma de la variable de entorno JWT_SECRET.
+ */
+class Auth
+{
+    /**
+     * Verifica el Bearer token. Termina con 401 si es inválido.
+     * Devuelve el payload decodificado si es válido.
+     */
+    public static function requireBearer(): array
+    {
+        $header = $_SERVER['HTTP_AUTHORIZATION']
+               ?? $_SERVER['REDIRECT_HTTP_AUTHORIZATION']
+               ?? '';
+
+        if (!str_starts_with($header, 'Bearer ')) {
+            self::abort(401, 'Token de autorización requerido.');
+        }
+
+        $token = substr($header, 7);
+        return self::verifyJwt($token);
+    }
+
+    // ─── JWT HS256 ────────────────────────────────────────────────────────────
+
+    private static function verifyJwt(string $token): array
+    {
+        $parts = explode('.', $token);
+        if (count($parts) !== 3) {
+            self::abort(401, 'Token malformado.');
+        }
+
+        [$b64Header, $b64Payload, $b64Sig] = $parts;
+
+        // Verificar firma
+        $secret   = env('JWT_SECRET', '');
+        if ($secret === '') {
+            self::abort(500, 'JWT_SECRET no configurado.');
+        }
+
+        $data     = "$b64Header.$b64Payload";
+        $expected = self::base64UrlEncode(
+            hash_hmac('sha256', $data, $secret, true)
+        );
+
+        // Comparación segura contra timing attacks
+        if (!hash_equals($expected, $b64Sig)) {
+            self::abort(401, 'Firma JWT inválida.');
+        }
+
+        // Decodificar payload
+        $payload = json_decode(self::base64UrlDecode($b64Payload), true);
+        if (!is_array($payload)) {
+            self::abort(401, 'Payload JWT inválido.');
+        }
+
+        // Validar expiración si existe
+        if (isset($payload['exp']) && $payload['exp'] < time()) {
+            self::abort(401, 'Token expirado.');
+        }
+
+        return $payload;
+    }
+
+    private static function base64UrlEncode(string $data): string
+    {
+        return rtrim(strtr(base64_encode($data), '+/', '-_'), '=');
+    }
+
+    private static function base64UrlDecode(string $data): string
+    {
+        return base64_decode(strtr($data, '-_', '+/'));
+    }
+
+    private static function abort(int $code, string $message): never
+    {
+        http_response_code($code);
+        header('Content-Type: application/json; charset=utf-8');
+        echo json_encode(['error' => $message], JSON_UNESCAPED_UNICODE);
+        exit;
+    }
+}
@@ -0,0 +1,75 @@
+<?php
+declare(strict_types=1);
+
+class SessionAuth
+{
+    public static function start(): void
+    {
+        if (session_status() === PHP_SESSION_NONE) {
+            session_set_cookie_params([
+                'lifetime' => 0,
+                'path'     => '/',
+                'secure'   => isset($_SERVER['HTTPS']),
+                'httponly' => true,
+                'samesite' => 'Lax',
+            ]);
+            session_start();
+        }
+    }
+
+    /** Redirige a /login si no hay sesión activa. */
+    public static function require(): void
+    {
+        self::start();
+        if (empty($_SESSION['user_id'])) {
+            header('Location: /login');
+            exit;
+        }
+    }
+
+    public static function login(array $user): void
+    {
+        self::start();
+        session_regenerate_id(true);
+        $_SESSION['user_id'] = $user['id'];
+        $_SESSION['user']    = [
+            'id'    => $user['id'],
+            'name'  => $user['name'],
+            'email' => $user['email'],
+        ];
+    }
+
+    public static function logout(): void
+    {
+        self::start();
+        $_SESSION = [];
+        if (ini_get('session.use_cookies')) {
+            $p = session_get_cookie_params();
+            setcookie(session_name(), '', time() - 42000, $p['path'], $p['domain'], $p['secure'], $p['httponly']);
+        }
+        session_destroy();
+    }
+
+    public static function user(): array
+    {
+        return $_SESSION['user'] ?? [];
+    }
+
+    public static function csrfToken(): string
+    {
+        self::start();
+        if (empty($_SESSION['csrf_token'])) {
+            $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+        }
+        return $_SESSION['csrf_token'];
+    }
+
+    public static function validateCsrf(): void
+    {
+        $token = $_POST['_token'] ?? '';
+        if (!isset($_SESSION['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $token)) {
+            http_response_code(403);
+            exit('Token CSRF inválido.');
+        }
+    }
+}