From f09fdfa25ea3439883e52da595c526566114c4ba Mon Sep 17 00:00:00 2001
From: PBBFA24AAL <haroun.al_smade@edu.bib.de>
Date: Sun, 9 Aug 2026 02:38:16 +0200
Subject: [PATCH] Improve account validation and feedback

---
 app/Controllers/AuthController.php | 119 ++++++++++++++++++++++++-----
 app/Views/auth/login.php           |  37 ++++++++-
 app/Views/auth/register.php        |  55 ++++++++++++-
 3 files changed, 185 insertions(+), 26 deletions(-)

diff --git a/app/Controllers/AuthController.php b/app/Controllers/AuthController.php
index af55379..7b11963 100644
--- a/app/Controllers/AuthController.php
+++ b/app/Controllers/AuthController.php
@@ -4,58 +4,107 @@ class AuthController
 {
     public function showLogin(): void
     {
-        View::render('auth/login');
+        View::render('auth/login', [
+            'values' => ['email' => ''],
+            'errors' => [],
+        ]);
     }
 
     public function login(): void
     {
         verify_csrf_token();
 
-        $email = trim($_POST['email'] ?? '');
-        $password = $_POST['password'] ?? '';
+        $email = $this->postString('email');
+        $password = $this->postPassword();
+        $errors = [];
 
-        if (!filter_var($email, FILTER_VALIDATE_EMAIL) || $password === '') {
-            flash('error', 'Bitte gib eine gueltige E-Mail und dein Passwort ein.');
-            redirect('login');
+        if (!filter_var($email, FILTER_VALIDATE_EMAIL) || mb_strlen($email) > 190) {
+            $errors['email'] = 'Bitte gib eine gueltige E-Mail-Adresse ein.';
         }
 
-        $user = User::findByEmail($email);
+        if ($password === '') {
+            $errors['password'] = 'Bitte gib dein Passwort ein.';
+        }
+
+        if (!empty($errors)) {
+            $this->renderLogin($email, $errors);
+            return;
+        }
+
+        try {
+            $user = User::findByEmail($email);
+        } catch (PDOException $exception) {
+            $this->renderLogin($email, ['form' => 'Die Anmeldung ist gerade nicht verfuegbar. Bitte versuche es spaeter erneut.']);
+            return;
+        }
 
         if (!$user || !password_verify($password, $user['password_hash'])) {
-            flash('error', 'E-Mail oder Passwort ist nicht korrekt.');
-            redirect('login');
+            $this->renderLogin($email, ['form' => 'E-Mail oder Passwort ist nicht korrekt.']);
+            return;
         }
 
         session_regenerate_id(true);
         $_SESSION['user_id'] = (int) $user['id'];
         $_SESSION['user_name'] = $user['name'];
+        unset($_SESSION['csrf_token']);
         redirect('dashboard');
     }
 
     public function showRegister(): void
     {
-        View::render('auth/register');
+        View::render('auth/register', [
+            'values' => ['name' => '', 'email' => ''],
+            'errors' => [],
+        ]);
     }
 
     public function register(): void
     {
         verify_csrf_token();
 
-        $name = trim($_POST['name'] ?? '');
-        $email = trim($_POST['email'] ?? '');
-        $password = $_POST['password'] ?? '';
+        $name = $this->postString('name');
+        $email = $this->postString('email');
+        $password = $this->postPassword();
+        $errors = [];
 
-        if ($name === '' || !filter_var($email, FILTER_VALIDATE_EMAIL) || strlen($password) < 8) {
-            flash('error', 'Bitte Name, gueltige E-Mail und ein Passwort mit mindestens 8 Zeichen eingeben.');
-            redirect('register');
+        if ($name === '') {
+            $errors['name'] = 'Bitte gib deinen Namen ein.';
+        } elseif (mb_strlen($name) > 100) {
+            $errors['name'] = 'Der Name darf maximal 100 Zeichen lang sein.';
         }
 
-        if (User::findByEmail($email)) {
-            flash('error', 'Diese E-Mail ist bereits registriert.');
-            redirect('register');
+        if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
+            $errors['email'] = 'Bitte gib eine gueltige E-Mail-Adresse ein.';
+        } elseif (mb_strlen($email) > 190) {
+            $errors['email'] = 'Die E-Mail-Adresse darf maximal 190 Zeichen lang sein.';
+        }
+
+        if (strlen($password) < 8) {
+            $errors['password'] = 'Das Passwort muss mindestens 8 Zeichen lang sein.';
+        }
+
+        if (!empty($errors)) {
+            $this->renderRegister($name, $email, $errors);
+            return;
+        }
+
+        try {
+            if (User::findByEmail($email)) {
+                $this->renderRegister($name, $email, ['email' => 'Diese E-Mail ist bereits registriert.']);
+                return;
+            }
+
+            $created = User::create($name, $email, $password);
+        } catch (PDOException $exception) {
+            $this->renderRegister($name, $email, ['form' => 'Das Konto konnte nicht erstellt werden. Bitte versuche es spaeter erneut.']);
+            return;
+        }
+
+        if (!$created) {
+            $this->renderRegister($name, $email, ['form' => 'Das Konto konnte nicht erstellt werden. Bitte versuche es spaeter erneut.']);
+            return;
         }
 
-        User::create($name, $email, $password);
         flash('success', 'Registrierung erfolgreich. Du kannst dich jetzt anmelden.');
         redirect('login');
     }
@@ -72,4 +121,34 @@ class AuthController
         session_destroy();
         redirect('login');
     }
+
+    private function renderLogin(string $email, array $errors): void
+    {
+        View::render('auth/login', [
+            'values' => ['email' => $email],
+            'errors' => $errors,
+        ]);
+    }
+
+    private function renderRegister(string $name, string $email, array $errors): void
+    {
+        View::render('auth/register', [
+            'values' => ['name' => $name, 'email' => $email],
+            'errors' => $errors,
+        ]);
+    }
+
+    private function postString(string $key): string
+    {
+        $value = $_POST[$key] ?? '';
+
+        return is_string($value) ? trim($value) : '';
+    }
+
+    private function postPassword(): string
+    {
+        $value = $_POST['password'] ?? '';
+
+        return is_string($value) ? $value : '';
+    }
 }
diff --git a/app/Views/auth/login.php b/app/Views/auth/login.php
index 519d511..b49bc84 100644
--- a/app/Views/auth/login.php
+++ b/app/Views/auth/login.php
@@ -1,12 +1,45 @@
+<?php
+
+$values = $values ?? ['email' => ''];
+$errors = $errors ?? [];
+?>
+
 <section class="auth-panel">
     <h1>Anmelden</h1>
+    <?php if (!empty($errors['form'])): ?>
+        <p class="field-error" role="alert"><?= e($errors['form']) ?></p>
+    <?php endif; ?>
     <form method="post" action="index.php?route=login" class="form">
         <?= csrf_field() ?>
         <label for="email">E-Mail</label>
-        <input id="email" name="email" type="email" autocomplete="email" required>
+        <input
+            id="email"
+            name="email"
+            type="email"
+            maxlength="190"
+            autocomplete="email"
+            value="<?= e($values['email'] ?? '') ?>"
+            class="<?= !empty($errors['email']) ? 'input-error' : '' ?>"
+            <?= !empty($errors['email']) ? 'aria-invalid="true" aria-describedby="email-error"' : '' ?>
+            required
+        >
+        <?php if (!empty($errors['email'])): ?>
+            <small id="email-error" class="field-error"><?= e($errors['email']) ?></small>
+        <?php endif; ?>
 
         <label for="password">Passwort</label>
-        <input id="password" name="password" type="password" autocomplete="current-password" required>
+        <input
+            id="password"
+            name="password"
+            type="password"
+            autocomplete="current-password"
+            class="<?= !empty($errors['password']) ? 'input-error' : '' ?>"
+            <?= !empty($errors['password']) ? 'aria-invalid="true" aria-describedby="password-error"' : '' ?>
+            required
+        >
+        <?php if (!empty($errors['password'])): ?>
+            <small id="password-error" class="field-error"><?= e($errors['password']) ?></small>
+        <?php endif; ?>
 
         <button type="submit">Einloggen</button>
     </form>
diff --git a/app/Views/auth/register.php b/app/Views/auth/register.php
index a64e292..14cf9e1 100644
--- a/app/Views/auth/register.php
+++ b/app/Views/auth/register.php
@@ -1,16 +1,63 @@
+<?php
+
+$values = $values ?? ['name' => '', 'email' => ''];
+$errors = $errors ?? [];
+?>
+
 <section class="auth-panel">
     <h1>Registrieren</h1>
+    <?php if (!empty($errors['form'])): ?>
+        <p class="field-error" role="alert"><?= e($errors['form']) ?></p>
+    <?php endif; ?>
     <form method="post" action="index.php?route=register" class="form">
         <?= csrf_field() ?>
         <label for="name">Name</label>
-        <input id="name" name="name" type="text" autocomplete="name" required>
+        <input
+            id="name"
+            name="name"
+            type="text"
+            maxlength="100"
+            autocomplete="name"
+            value="<?= e($values['name'] ?? '') ?>"
+            class="<?= !empty($errors['name']) ? 'input-error' : '' ?>"
+            <?= !empty($errors['name']) ? 'aria-invalid="true" aria-describedby="name-error"' : '' ?>
+            required
+        >
+        <?php if (!empty($errors['name'])): ?>
+            <small id="name-error" class="field-error"><?= e($errors['name']) ?></small>
+        <?php endif; ?>
 
         <label for="email">E-Mail</label>
-        <input id="email" name="email" type="email" autocomplete="email" required>
+        <input
+            id="email"
+            name="email"
+            type="email"
+            maxlength="190"
+            autocomplete="email"
+            value="<?= e($values['email'] ?? '') ?>"
+            class="<?= !empty($errors['email']) ? 'input-error' : '' ?>"
+            <?= !empty($errors['email']) ? 'aria-invalid="true" aria-describedby="email-error"' : '' ?>
+            required
+        >
+        <?php if (!empty($errors['email'])): ?>
+            <small id="email-error" class="field-error"><?= e($errors['email']) ?></small>
+        <?php endif; ?>
 
         <label for="password">Passwort</label>
-        <input id="password" name="password" type="password" minlength="8" autocomplete="new-password" required>
-        <small>Mindestens 8 Zeichen.</small>
+        <input
+            id="password"
+            name="password"
+            type="password"
+            minlength="8"
+            autocomplete="new-password"
+            class="<?= !empty($errors['password']) ? 'input-error' : '' ?>"
+            <?= !empty($errors['password']) ? 'aria-invalid="true" aria-describedby="password-error password-help"' : 'aria-describedby="password-help"' ?>
+            required
+        >
+        <small id="password-help">Mindestens 8 Zeichen.</small>
+        <?php if (!empty($errors['password'])): ?>
+            <small id="password-error" class="field-error"><?= e($errors['password']) ?></small>
+        <?php endif; ?>
 
         <button type="submit">Konto erstellen</button>
     </form>