Initial commit — Donna portal v1

Setup completo del portal interno donna.aal-law.com: * Landing público con OAuth login + grid de apps autenticado * Flujo OAuth2 contra Mailcow (mail.aal-law.com) * Sesiones SSO compartidas en el dominio (cookie donna_session, 8h) * Whitelist de dominios aal-law.com / aalnlaw.com * App "Control de Escrituras" migrada desde ZH-Consultores/control-escrituras (mismo schema, mismo frontend, ahora con shared Auth/Db/Config libs) * Migraciones SQL para users, escrituras_tramites, escrituras_historial * Caddy on :80 con rewrite extless → .php * Backup diario MariaDB (systemd timer + script) con retención 14d * Documentación de arquitectura en README + infra files en docs/infra
2026-05-11 19:10:36 +00:00
commit 4ee32aec6d
21 changed files with 2327 additions and 0 deletions
@@ -0,0 +1,65 @@
+<?php
+declare(strict_types=1);
+
+require_once __DIR__ . '/Config.php';
+
+final class Oauth {
+    public static function exchangeCodeForToken(string $code): array {
+        return self::httpPost(Config::get('OAUTH_TOKEN_URL'), [
+            'grant_type'    => 'authorization_code',
+            'code'          => $code,
+            'redirect_uri'  => Config::get('OAUTH_REDIRECT_URI'),
+            'client_id'     => Config::get('OAUTH_CLIENT_ID'),
+            'client_secret' => Config::get('OAUTH_CLIENT_SECRET'),
+        ]);
+    }
+
+    public static function fetchProfile(string $accessToken): array {
+        return self::httpGetBearer(Config::get('OAUTH_PROFILE_URL'), $accessToken);
+    }
+
+    private static function httpPost(string $url, array $form): array {
+        $ch = curl_init($url);
+        curl_setopt_array($ch, [
+            CURLOPT_RETURNTRANSFER => true,
+            CURLOPT_POST           => true,
+            CURLOPT_POSTFIELDS     => http_build_query($form),
+            CURLOPT_HTTPHEADER     => ['Accept: application/json'],
+            CURLOPT_TIMEOUT        => 10,
+            CURLOPT_CONNECTTIMEOUT => 5,
+            CURLOPT_SSL_VERIFYPEER => true,
+            CURLOPT_SSL_VERIFYHOST => 2,
+        ]);
+        $body = curl_exec($ch);
+        $err  = curl_error($ch);
+        curl_close($ch);
+        if ($err || $body === false) {
+            error_log('oauth POST failed: ' . $err);
+            return [];
+        }
+        return json_decode((string)$body, true) ?? [];
+    }
+
+    private static function httpGetBearer(string $url, string $token): array {
+        $ch = curl_init($url);
+        curl_setopt_array($ch, [
+            CURLOPT_RETURNTRANSFER => true,
+            CURLOPT_HTTPHEADER     => [
+                'Authorization: Bearer ' . $token,
+                'Accept: application/json',
+            ],
+            CURLOPT_TIMEOUT        => 10,
+            CURLOPT_CONNECTTIMEOUT => 5,
+            CURLOPT_SSL_VERIFYPEER => true,
+            CURLOPT_SSL_VERIFYHOST => 2,
+        ]);
+        $body = curl_exec($ch);
+        $err  = curl_error($ch);
+        curl_close($ch);
+        if ($err || $body === false) {
+            error_log('oauth GET failed: ' . $err);
+            return [];
+        }
+        return json_decode((string)$body, true) ?? [];
+    }
+}