Fix login and order
This commit is contained in:
parent
dbecad8606
commit
484a36ce11
22 changed files with 399 additions and 520 deletions
|
|
@ -42,11 +42,11 @@ Commercial billing, provisioning, invoices, orders, transactions, coupons, and p
|
|||
|
||||
## Website Ordering Boundary
|
||||
|
||||
The active Gameservers.World website no longer links customers to `billing/order.php`. The public catalog uses `Panel/modules/website/order.php?service_id=...` as the order entry point. That page validates the enabled service server-side and sends logged-out users through website login before returning them to the intended service.
|
||||
The active Gameservers.World website no longer links customers to `billing/order.php`. The public catalog uses `Panel/modules/website/order.php?service_id=...` as the order entry point. That page validates the enabled service server-side and allows anonymous visitors to configure slots/location and add the package to the website session cart.
|
||||
|
||||
Payment approval and final provisioning remain server-side responsibilities. The browser must not call private provisioning methods directly, and prices must be read from server-side catalog data rather than query parameters.
|
||||
|
||||
In this repository checkout the historical `Panel/modules/billing` runtime is not present, although billing tables and integration references remain. The website order page therefore stops at validated order intent and support handoff until the active checkout/payment runtime is connected.
|
||||
In this repository checkout the historical `Panel/modules/billing` runtime is not present, although billing tables and integration references remain. The website cart therefore stops at validated order intent and a friendly checkout-unavailable message until the active checkout/payment runtime is connected.
|
||||
|
||||
## Admin Workflow
|
||||
|
||||
|
|
|
|||
|
|
@ -35,24 +35,15 @@ The website module centralizes these helpers in `includes/bootstrap.php`:
|
|||
|
||||
The website does not include the billing config loader directly. It reads panel or billing DB values safely, uses them only when needed, and avoids public fatal errors tied to missing config files.
|
||||
|
||||
## Shared Accounts and SSO
|
||||
## Shared Accounts
|
||||
|
||||
The website uses the Panel `users` table as the account source of truth. A customer has the same `user_id` on Gameservers.World, the GSP Panel, support, billing, and server orders.
|
||||
|
||||
Website login verifies credentials against the existing Panel password hash format. This preserves current Panel login behavior and avoids a second website password database.
|
||||
|
||||
`gameservers.world` and `panel.iaregamer.com` cannot share a normal PHP session cookie because they are unrelated parent domains. The bridge is a one-time SSO token:
|
||||
`gameservers.world` and `panel.iaregamer.com` cannot share a normal PHP session cookie because they are unrelated parent domains. SSO is deferred for this phase. The website and Panel keep separate sessions, and users may log in separately on both sites with the same credentials. Passwords, password hashes, PHP session IDs, and authentication tokens are never passed in URLs.
|
||||
|
||||
- website to Panel: `Panel/modules/website/sso.php` creates a token and redirects to `Panel/sso.php`
|
||||
- Panel to website: `Panel/sso.php` creates a token and redirects back to `Panel/modules/website/sso.php`
|
||||
- table: `OGP_DB_PREFIXsso_tokens`
|
||||
- lifetime: 30-60 seconds
|
||||
- storage: SHA-256 token hash only
|
||||
- reuse: rejected after `used_at` is set
|
||||
- URL contents: token only, never passwords, password hashes, API keys, or PHP session IDs
|
||||
- HTTPS is required in production
|
||||
|
||||
Expired tokens are cleaned opportunistically when SSO is used. The administration module also creates the table for fresh installs.
|
||||
`Panel/modules/website/sso.php` and `Panel/sso.php` are retained only as compatibility redirects for old links. Active navigation must not depend on them.
|
||||
|
||||
## Ordering
|
||||
|
||||
|
|
@ -62,11 +53,13 @@ The current public catalog route is `serverlist.php`. Customer-facing Order butt
|
|||
|
||||
The old `billing/order.php` route is obsolete in this repository layout and must not be used for active Gameservers.World links.
|
||||
|
||||
`order.php` validates the requested `service_id` server-side against enabled catalog records before allowing the customer to continue. Logged-out customers have the intended order path stored in the website session, are sent to `login.php`, and return to the same service after successful login.
|
||||
`order.php` validates the requested `service_id` server-side against enabled catalog records before allowing the customer to continue. Anonymous visitors can configure slots and location, add the server package to the session cart, and review the cart before login.
|
||||
|
||||
The website owns catalog display, order intent, login-return behavior, checkout entry, and customer confirmation. The Panel owns final provisioning, server assignment to the shared `user_id`, game-home creation, agent handoff, and provisioning state. Public browser requests must not call private provisioning methods directly.
|
||||
Login or registration is required only at checkout. The cart is stored in the website session and remains available through website login session regeneration. Panel registration is currently linked directly until a website-native registration form is restored.
|
||||
|
||||
Checkout/payment handlers are not present in this repository checkout. Until the active payment runtime is connected, `order.php` validates the selected service and sends the customer to support instead of pretending payment or provisioning is available.
|
||||
The website owns catalog display, cart storage, order intent, login-return behavior, checkout entry, and customer confirmation. The Panel owns final provisioning, server assignment to the shared `user_id`, game-home creation, agent handoff, and provisioning state. Public browser requests must not call private provisioning methods directly.
|
||||
|
||||
Checkout/payment handlers are not present in this repository checkout. Until the active payment runtime is connected, `cart.php` preserves the validated cart and shows a friendly checkout-unavailable message instead of pretending payment or provisioning is available.
|
||||
|
||||
## Navigation
|
||||
|
||||
|
|
@ -76,7 +69,7 @@ Website footer account links are state-aware:
|
|||
- logged in: `My Account`, `Order a Server`, `Control Panel`, `My Servers`, `Log Out`
|
||||
- staff-only links appear only for Panel admin users and still rely on Panel authorization server-side
|
||||
|
||||
The website Control Panel button sends logged-in users through website-to-Panel SSO. Logged-out users go through website login first. The Panel dashboard `Order Another Server` link sends logged-in Panel users through Panel-to-website SSO.
|
||||
The website main navigation also includes visible `Login`, `Create Account`, and `Cart` entries when appropriate. Control Panel, My Servers, and staff administration links point directly to the configured Panel domain. The Panel dashboard `Order Another Server` link points directly to the website catalog.
|
||||
|
||||
## Deployment
|
||||
|
||||
|
|
@ -101,6 +94,7 @@ Recommended:
|
|||
- `login.php`
|
||||
- `account.php`
|
||||
- `order.php`
|
||||
- `cart.php`
|
||||
- `sso.php`
|
||||
|
||||
## Pricing and Platform Reference
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue