Add try-catch blocks to ensure JSON responses for login/auth

- Wrap login and authentication handlers in try-catch blocks
- Always return valid JSON even on errors
- Fix potential PHP warnings breaking JSON responses

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

diff --git a/public/index.php b/public/index.php
index ed013ac757f25dadad7f990bb9a37c2b3e604c09..8d4cc38c26db60a644621ce51a3b9fea382bad42 100644 (file)
--- a/public/index.php
+++ b/public/index.php
@@ -217,24 +217,35 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
         $username = trim($_POST['login_username']);
         
         if (!empty($username)) {
-            // Check if user exists
-            $stmt = $pdo->prepare("SELECT id FROM users WHERE username = ?");
-            $stmt->execute([$username]);
-            $user = $stmt->fetch(PDO::FETCH_ASSOC);
-            
-            if ($user) {
-                // Start authentication
-                $authenticationOptions = $webAuthnManager->generateAuthenticationOptions($username);
-                $_SESSION['authentication_options'] = $authenticationOptions;
-                $_SESSION['authentication_username'] = $username;
-                $_SESSION['authenticating_user_id'] = $user['id'];
+            try {
+                // Check if user exists
+                $stmt = $pdo->prepare("SELECT id FROM users WHERE username = ?");
+                $stmt->execute([$username]);
+                $user = $stmt->fetch(PDO::FETCH_ASSOC);
                 
+                if ($user) {
+                    // Start authentication
+                    $authenticationOptions = $webAuthnManager->generateAuthenticationOptions($username);
+                    $_SESSION['authentication_options'] = $authenticationOptions;
+                    $_SESSION['authentication_username'] = $username;
+                    $_SESSION['authenticating_user_id'] = $user['id'];
+                    
+                    header('Content-Type: application/json');
+                    echo json_encode([
+                        'success' => true,
+                        'options' => $authenticationOptions->jsonSerialize()
+                    ]);
+                    exit();
+                } else {
+                    header('Content-Type: application/json');
+                    echo json_encode(['success' => false, 'error' => 'Utilisateur non trouvé']);
+                    exit();
+                }
+            } catch (Exception $e) {
                 header('Content-Type: application/json');
-                echo json_encode([
-                    'success' => true,
-                    'options' => $authenticationOptions->jsonSerialize()
-                ]);
+                echo json_encode(['success' => false, 'error' => 'Erreur: ' . $e->getMessage()]);
                 exit();
+            }
             } else {
                 header('Content-Type: application/json');
                 echo json_encode(['success' => false, 'error' => 'Utilisateur non trouvé']);
@@ -248,36 +259,42 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
         $authenticationResponse = trim($_POST['authenticationResponse']);
         
         if (!empty($authenticationResponse) && isset($_SESSION['authentication_username'])) {
-            $username = $_SESSION['authentication_username'];
-            $userId = $_SESSION['authenticating_user_id'] ?? 0;
-            unset($_SESSION['authentication_username']);
-            unset($_SESSION['authenticating_user_id']);
-            
-            // Verify authentication
-            $authenticationData = $webAuthnManager->authenticate($authenticationResponse);
-            
-            if ($authenticationData) {
-                // Check if credential belongs to user
-                $stmt = $pdo->prepare("SELECT yubikey_id FROM users WHERE id = ? AND username = ?");
-                $stmt->execute([$userId, $username]);
-                $user = $stmt->fetch(PDO::FETCH_ASSOC);
+            try {
+                $username = $_SESSION['authentication_username'];
+                $userId = $_SESSION['authenticating_user_id'] ?? 0;
+                unset($_SESSION['authentication_username']);
+                unset($_SESSION['authenticating_user_id']);
                 
-                if ($user) {
-                    // Log in the user
-                    $_SESSION['user_id'] = $userId;
-                    $_SESSION['username'] = $username;
-                    $_SESSION['status'] = "Connexion réussie ! Bienvenue $username.";
-                    $_SESSION['action_processed'] = false; // Will trigger action(start) on next load
+                // Verify authentication
+                $authenticationData = $webAuthnManager->authenticate($authenticationResponse);
+                
+                if ($authenticationData) {
+                    // Check if credential belongs to user
+                    $stmt = $pdo->prepare("SELECT yubikey_id FROM users WHERE id = ? AND username = ?");
+                    $stmt->execute([$userId, $username]);
+                    $user = $stmt->fetch(PDO::FETCH_ASSOC);
                     
-                    header('Content-Type: application/json');
-                    echo json_encode(['success' => true, 'redirect' => 'index.php']);
-                    exit();
+                    if ($user) {
+                        // Log in the user
+                        $_SESSION['user_id'] = $userId;
+                        $_SESSION['username'] = $username;
+                        $_SESSION['status'] = "Connexion réussie ! Bienvenue $username.";
+                        $_SESSION['action_processed'] = false; // Will trigger action(start) on next load
+                        
+                        header('Content-Type: application/json');
+                        echo json_encode(['success' => true, 'redirect' => 'index.php']);
+                        exit();
+                    }
                 }
+                
+                header('Content-Type: application/json');
+                echo json_encode(['success' => false, 'error' => 'Authentification échouée']);
+                exit();
+            } catch (Exception $e) {
+                header('Content-Type: application/json');
+                echo json_encode(['success' => false, 'error' => 'Erreur: ' . $e->getMessage()]);
+                exit();
             }
-            
-            header('Content-Type: application/json');
-            echo json_encode(['success' => false, 'error' => 'Authentification échouée']);
-            exit();
         }
     }
 }