auth update

api/login.php

@@ -21,13 +21,31 @@ if (!is_array($data)) {
 
 $login = trim($data['username'] ?? '');
 $password = $data['password'] ?? '';
+$siteAlias = trim($data['site_alias'] ?? '');
+
+if ($siteAlias === '') {
+    http_response_code(400);
+    echo json_encode(['success' => false, 'message' => 'Не указан сайт']);
+    exit;
+}
 
 // Поиск пользователя по username
-$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ?");
+$stmt = $pdo->prepare("SELECT id, username, password_hash, ok5, o7, o10m, o10a, webp FROM users WHERE username = ?");
 $stmt->execute([$login]);
 $user = $stmt->fetch(PDO::FETCH_ASSOC);
 
 if ($user && password_verify($password, $user['password_hash'])) {
+    $allowedAliases = ['ok5', 'o7', 'o10m', 'o10a', 'webp'];
+    if (!in_array($siteAlias, $allowedAliases, true)) {
+        echo json_encode(['success' => false, 'message' => 'Неизвестный сайт']);
+        exit;
+    }
+
+    if ((int)$user[$siteAlias] !== 1) {
+        echo json_encode(['success' => false, 'message' => 'Нет доступа к сайту']);
+        exit;
+    }
+
     // Успешная авторизация
     session_regenerate_id(true);
     $_SESSION['user_id'] = $user['id'];