Refactor user handling and improve data validation.

Reorganized class properties for better accessibility and added a `nullify` method for handling null values in the database. Enhanced customer handling logic to prevent duplicate records and ensure password nullification. Improved password validation and user authentication checks for stricter input handling.

classes/authentication.php

@@ -19,6 +19,10 @@ class authentication implements authentication_i
         if (!$customer->exists()) {
             return false;
         }
+        // Check if the customer has a password
+        if (!$customer->password->value()) {
+            return false;
+        }
         // Check if the password is correct
         if (!$this->match_passwords($password, $customer->password->value())) {
             return false;

classes/object_property.php

@@ -4,8 +4,8 @@ namespace classes;
 
 class object_property
 {
-    private string $table; // The table of the objects in the database (e.g. users)
-    public int $id; // The id of the object in the database
+    public int $id; // The table of the objects in the database (e.g. users)
+    private string $table; // The id of the object in the database
     private string $column; // The column name of the field in the database table (e.g. id, name, email)
     private string $type; // The data type of the field in the database table (e.g. int, varchar, text)
     private bool $required; // Whether the field is required or not
@@ -53,12 +53,23 @@ class object_property
         // If the value is null, set it to null
         if ($value === null) {
             $sql = "UPDATE $this->table SET $this->column = NULL WHERE id = $this->id";
-        }
-        // If the value is a string, escape it
+        } // If the value is a string, escape it
         else {
             $value = $db->escape_string($value);
             $sql = "UPDATE $this->table SET $this->column = '$value' WHERE id = $this->id";
         }
         $db->query($sql);
     }
+
+    /**
+     * Nullify the value of the field in the database table
+     */
+    public function nullify(): void
+    {
+        // Set the value of the field in the database table to null
+        global /** @var db $db */
+        $db;
+        $sql = "UPDATE $this->table SET $this->column = NULL WHERE id = $this->id";
+        $db->query($sql);
+    }
 }

objects/users_o.php

@@ -106,18 +106,43 @@ class users_o extends db
         if (isset($customer_data[0])) {
             // Avoid SQL injection
             $customer_number = $db->escape_string($customer_data[0]->customerNumber);
-            // Create a new record in the database
-            $sql = "INSERT INTO $this->table (customer_number) VALUES ('$customer_number')";
-            $db->query($sql);
-            // Get the id of the new record
-            $this->id = $db->insert_id();
-            // Set the values of the object properties
-            $this->getObjectProperties();
+            // Double check if the customer exists
+            $sql = "SELECT * FROM $this->table WHERE customer_number = '$customer_number'";
+            $result = $db->query($sql);
+            if ($result->num_rows > 0) {
+                $this->id = $result->fetch_assoc()['id'];
+                $this->getObjectProperties();
+            } else {
+                // Import the customer
+                $this->add($customer_number, '', 0);
+                // Nullify the password
+                $this->password->nullify();
+            }
         }
         // Else return false
         return false;
     }
 
+    public function add(string $customer_number, mixed $password, int $role = 0): void
+    {
+        global $db;
+        // Avoid SQL injection
+        $customer_number = $db->escape_string($customer_number);
+        $role = $db->escape_string($role);
+        // Hash the password
+        $password = password_hash($password, PASSWORD_DEFAULT);
+        $password = $db->escape_string($password);
+        // Create a new record in the database
+        $sql = "INSERT INTO $this->table (customer_number, password, group_id) VALUES ('$customer_number', '$password', $role)";
+        $db->query($sql);
+
+        // Get the id of the new record
+        $this->id = $db->insert_id();
+
+        // Set the values of the object properties
+        $this->getObjectProperties();
+    }
+
     public function automaticGetTargetUserFromRequest(): users_o
     {
         // Get the data from the request
@@ -212,26 +237,6 @@ class users_o extends db
         $customer_notes->add($customer_id, $note, $cashier_id);
     }
 
-    public function add(string $customer_number, mixed $password, int $role = 0): void
-    {
-        global $db;
-        // Avoid SQL injection
-        $customer_number = $db->escape_string($customer_number);
-        $role = $db->escape_string($role);
-        // Hash the password
-        $password = password_hash($password, PASSWORD_DEFAULT);
-        $password = $db->escape_string($password);
-        // Create a new record in the database
-        $sql = "INSERT INTO $this->table (customer_number, password, group_id) VALUES ('$customer_number', '$password', $role)";
-        $db->query($sql);
-
-        // Get the id of the new record
-        $this->id = $db->insert_id();
-
-        // Set the values of the object properties
-        $this->getObjectProperties();
-    }
-
     public function deleteNote(int $note_id): void
     {
         global $db;

routes/authRoute.php

@@ -21,7 +21,7 @@ class authRoute
             if (!isset($data['customer_number']) || empty($data['customer_number']) || !is_numeric($data['customer_number']) || $data['customer_number'] < 1) {
                 $response->error('Customer number is required', 400);
             }
-            if (!isset($data['password'])) {
+            if (!isset($data['password']) || empty($data['password']) || strlen($data['password']) < 1) {
                 $response->error('Password is required', 400);
             }
             // Try to log the user in