autenticacao.php library

Path in the Gestor bibliotecas/autenticacao.php

Four topics: the RSA JWT token the Gestor uses in the login cookie and in the API, encrypting and decrypting values with the site's RSA keys, per-IP attempt control and the distributed channel credentials. The keys live in autenticacoes/<domain>/chaves/gestor/ (privada.key, protected by OPENSSL_PASSWORD, and publica.key), see global variables.

The RSA token

It is not a standard JWT (RS256): the header says "alg": "RSA", and the "signature" is the header.payload itself encrypted with the private key (openssl_private_encrypt, in 245-byte blocks, each block base64-encoded and the whole again base64-encoded). Validating means decrypting with the public key and comparing with the received header.payload.

• autenticacao_gerar_jwt_chave_privada(['host', 'expiration', 'pubID', 'chavePrivada', 'chavePrivadaSenha', 'payload' => optional]) builds the token. Without payload, it uses {iss: host, exp: expiration, sub: pubID}. It issues the API tokens; the login cookie uses the same format, built by usuario_gerar_token_autorizacao() (usuario.php) and validated by gestor_permissao_validar_jwt().

• autenticacao_validar_jwt_chave_publica(['token', 'chavePublica', 'retornarPayloadCompleto']) checks the signature, requires exp and sub and rejects expired tokens. It returns the sub (the pubID), the whole payload or false.

Validating the token is only the first step: gestor_permissao_token() still checks the pubID in usuarios_tokens with the USUARIO_HASH_PASSWORD HMAC (request lifecycle).

The inverted variants autenticacao_gerar_jwt_chave_publica() and autenticacao_validar_jwt_chave_privada(), and autenticacao_cliente_gerar_jwt() / autenticacao_cliente_gerar_token_validacao() (from the multi-host mode), have no callers.

Encrypting secrets

The first pair is the one used to store API keys (AI servers): it hides the value from someone who only sees the database, but whoever has the database and the public key recovers it. For real confidentiality, encrypt with the public key and decrypt with the private one.

autenticacao_openssl_gerar_chaves() generates a 2048-bit RSA pair; autenticacao_gerar_senha() and autenticacao_crypto_rand_secure() generate passwords and random numbers. None of the three has callers in the core (the installer has its own key generator).

Per-IP attempt control

The acessos table keeps, per IP (from ip_get()) and type (login, signup, forgot-password), the count, the status and the block.

Limits from the .env: at login, up to ACESSOS_MAXIMO_LOGINS_SIMPLES (3) failures the status is livre, up to ACESSOS_MAXIMO_FALHAS_LOGINS (10) it is antispam, and then bloqueado. For sign-ups, ACESSOS_MAXIMO_CADASTROS_* and ACESSOS_MAXIMO_CADASTROS_SIMPLES_* per type. Each block lasts blocks × ACESSOS_TEMPO_BLOQUEIO_IP seconds (growing with each repeat), and the record disappears after ACESSOS_TEMPO_DESBLOQUEIO_IP without activity. autenticacao_acessos_limpeza() runs on every check and applies both rules.

In perfil-usuario, the status decides the CAPTCHA: with reCAPTCHA, it is only required from antispam on; with Turnstile, always.

Distributed channel

Used by the central side of the distributed architecture:

• autenticacao_distribuido_gerar_tokens($id_usuarios): OAuth2 tokens with the distributed scope;

• autenticacao_distribuido_verificar_permissao_modulo(): the user's profile has the target module;

• autenticacao_distribuido_token_ativo(): the channel access token is valid.

Channel credential validation does not go through the attempt control.

Functions

autenticacao_crypto_rand_secure(int $min, int $max): int

autenticacao_cliente_gerar_jwt(array|false $params = false): string|false

autenticacao_openssl_gerar_chaves(array|false $params = false): array|false

autenticacao_gerar_senha(int $length = 32): string

autenticacao_gerar_jwt_chave_publica(array|false $params = false): string|false

autenticacao_gerar_jwt_chave_privada(array|false $params = false): string|false

autenticacao_validar_jwt_chave_publica(array|false $params = false): array|string|false

autenticacao_validar_jwt_chave_privada(array|false $params = false): array|false

autenticacao_cliente_gerar_token_validacao(array|false $params = false): array

autenticacao_acesso_verificar(array|false $params = false): array

autenticacao_acesso_cadastrar(array|false $params = false): void

autenticacao_acesso_confirmar(array|false $params = false): void

autenticacao_acesso_falha(array|false $params = false): void

autenticacao_acessos_limpeza(array|false $params = false): void

autenticacao_encriptar_chave_publica(array|false $params = false): string|false

autenticacao_encriptar_chave_privada(array|false $params = false): string|false

autenticacao_decriptar_chave_publica(array|false $params = false): string|false

autenticacao_decriptar_chave_privada(array|false $params = false): string|false

autenticacao_distribuido_gerar_tokens(int $id_usuarios): array|false

autenticacao_distribuido_verificar_permissao_modulo(int $id_usuarios, string $modulo): bool

autenticacao_distribuido_token_ativo(string $token): bool