Flatboard5管理员登录后没多久就失效再次登录直接密码错误

<?php
/*
 * Project name: Flatboard 5
 * Project URL: https://flatboard.org
 * Author: Frédéric Kaplon and contributors
 * All Flatboard code is released under the GPL3 license.
 *
 * Flatboard 5 - Middleware d'authentification (AuthContext-based)
 */

namespace App\Middleware;

use App\Core\Request;
use App\Core\Response;
use App\Core\Session;
use App\Helpers\Translator;
use App\Helpers\UrlHelper;

class AuthMiddleware implements MiddlewareInterface
{
    private const DEFAULT_ERROR_MESSAGE = 'You must be logged in to access this page';
    private const DEFAULT_AJAX_ERROR = 'Unauthorized access';

    // Cache des traductions
    private static $translations = [];

    public function handle(Request $request, Response $response): bool
    {
        /**
         * 🛟 Sécurité :
         * Si l'AuthContext n'existe pas encore (ordre des middlewares),
         * on le crée ici pour éviter tout crash.
         */
        if (!isset($request->auth)) {
            $request->auth = (object) [
                'isAuthenticated' => false,
                'userId' => null
            ];

            $userId = Session::get('user_id');
            if (!empty($userId) && is_numeric($userId)) {
                $request->auth->isAuthenticated = true;
                $request->auth->userId = (int) $userId;
            }
        }

        // ✅ Lecture unique de l'état d'authentification
        if ($request->auth->isAuthenticated) {
            return true;
        }

        // ❌ Non authentifié
        $this->handleUnauthenticated($request, $response);
        return false;
    }

    /**
     * Gère une tentative d'accès non authentifié
     */
    private function handleUnauthenticated(Request $request, Response $response): void
    {
        if (defined('DEBUG') && DEBUG) {
            \App\Core\Logger::info('Unauthorized access attempt', [
                'url' => $request->getUrl(),
                'method' => $request->getMethod(),
                'ip' => $_SERVER['REMOTE_ADDR'] ?? 'unknown',
                'user_agent' => $_SERVER['HTTP_USER_AGENT'] ?? 'unknown'
            ]);
        }

        if ($request->isAjax()) {
            $this->handleAjaxUnauthorized($response);
        } else {
            $this->handleWebUnauthorized($response);
        }
    }

    /**
     * Gère une requête AJAX non autorisée
     */
    private function handleAjaxUnauthorized(Response $response): void
    {
        $errorMessage = $this->getTranslation(
            'http.403.title',
            'errors',
            self::DEFAULT_AJAX_ERROR
        );

        $response->json([
            'success' => false,
            'error' => $errorMessage,
            'redirect' => UrlHelper::to('/login')
        ], 401);
    }

    /**
     * Gère une requête web non autorisée
     */
    private function handleWebUnauthorized(Response $response): void
    {
        $errorMessage = $this->getTranslation(
            'auth.loginRequired',
            'errors',
            self::DEFAULT_ERROR_MESSAGE
        );

        Session::flash('error', $errorMessage);
        $response->redirect(UrlHelper::to('/login'));
    }

    /**
     * Récupère une traduction avec cache
     */
    private function getTranslation(string $key, string $domain, string $default): string
    {
        $cacheKey = $domain . '.' . $key;

        if (isset(self::$translations[$cacheKey])) {
            return self::$translations[$cacheKey];
        }

        $translation = Translator::trans($key, [], $domain);
        $result = !empty($translation) ? $translation : $default;

        self::$translations[$cacheKey] = $result;

        return $result;
    }

    /**
     * Vide le cache des traductions (tests)
     */
    public static function clearCache(): void
    {
        self::$translations = [];
    }
}

<?php
/*
 * Project name: Flatboard 5
 * Project URL: https://flatboard.org
 * Author: Frédéric Kaplon and contributors
 *
 * Flatboard 5 - Visitor tracking middleware (safe & throttled)
 */

namespace App\Middleware;

use App\Core\Request;
use App\Core\Response;
use App\Core\Session;
use App\Models\Visitor;

class VisitorTrackingMiddleware implements MiddlewareInterface
{
    /**
     * Paths that should never be tracked
     */
    private const IGNORED_PATHS = [
        '/api/',
        '/favicon.ico',
        '/robots.txt',
        '/health',
        '/ping',
        '/presence/update',
    ];

    /**
     * Static file extensions to ignore
     */
    private const IGNORED_EXTENSIONS = [
        '.css', '.js', '.jpg', '.jpeg', '.png', '.gif',
        '.svg', '.ico', '.woff', '.woff2', '.ttf', '.eot',
        '.map', '.json', '.xml',
    ];

    /**
     * Prevent multiple tracking calls during the same request
     */
    private static bool $tracked = false;

    public function handle(Request $request, Response $response): bool
    {
        /**
         * 1️⃣ Avoid double execution in the same request
         */
        if (self::$tracked) {
            return true;
        }

        /**
         * 2️⃣ Logged-in users are handled elsewhere (presence system)
         */
        if ($this->isAuthenticatedUser()) {
            return true;
        }

        /**
         * 3️⃣ Ignore useless / noisy requests
         */
        if ($this->shouldIgnore($request)) {
            return true;
        }

        /**
         * 4️⃣ Track anonymous visitor
         */
        $this->trackVisitor($request);

        self::$tracked = true;
        return true;
    }

    /**
     * Check if a user is authenticated
     */
    private function isAuthenticatedUser(): bool
    {
        return !empty(Session::get('user_id'));
    }

    /**
     * Decide whether the request should be ignored
     */
    private function shouldIgnore(Request $request): bool
    {
        $url = $request->getUrl();

        // Ignore AJAX calls (except presence ping)
        if ($request->isAjax() && strpos($url, '/presence/update') === false) {
            return true;
        }

        // Ignore known paths
        foreach (self::IGNORED_PATHS as $path) {
            if (strpos($url, $path) === 0) {
                return true;
            }
        }

        // Ignore static files
        foreach (self::IGNORED_EXTENSIONS as $ext) {
            if (str_ends_with($url, $ext)) {
                return true;
            }
        }

        return false;
    }

    /**
     * Create or update anonymous visitor entry
     */
    private function trackVisitor(Request $request): void
    {
        try {
            Visitor::updateOrCreate([
                'ip_address' => $request->getIp(),
                'user_agent' => $request->getUserAgent(),
                'page'       => $request->getUrl(),
                'user_id'    => null,
            ]);
        } catch (\Throwable $e) {
            // Never block the request because of tracking
            \App\Core\Logger::error('Visitor tracking failed', [
                'error' => $e->getMessage(),
            ]);
        }
    }

    /**
     * Cleanup old visitors (CRON)
     */
    public static function cleanup(int $minutes = 60): int
    {
        try {
            return Visitor::cleanup($minutes);
        } catch (\Throwable $e) {
            \App\Core\Logger::error('Visitor cleanup failed', [
                'error' => $e->getMessage(),
            ]);
            return 0;
        }
    }

    /**
     * Get visitor statistics
     */
    public static function getStats(int $minutes = 15): ?array
    {
        try {
            return [
                'active_visitors'    => count(Visitor::getActive($minutes)),
                'anonymous_visitors' => count(Visitor::getActiveAnonymousVisitors($minutes)),
                'bots'               => count(Visitor::getActiveBotsDetailed($minutes)),
                'visitors_list'      => Visitor::getActiveAnonymousVisitors($minutes),
                'bots_list'          => Visitor::getActiveBotsDetailed($minutes),
            ];
        } catch (\Throwable $e) {
            \App\Core\Logger::error('Visitor stats failed', [
                'error' => $e->getMessage(),
            ]);
            return null;
        }
    }

    /**
     * Reset internal state (tests only)
     */
    public static function reset(): void
    {
        self::$tracked = false;
    }
}