Problems with session variables in slim php framework - php

Question

I developed an API that I already have on a server. During the whole development I did tests with POSTMA and I had no problem, however, now that I want to use the API from the production domain to another domain it doesn't work: /
Production -> Local consumption POSTMAN: If it works
Production -> Local consumption from a website: Does not work
The problem is with the session variables, I have some consulates that occupy parameters such as "user ID" or "company id" that I set in the first step when I authenticate with JWT.
Step 1: Authentication (Route)
use App\Lib\Auth,
App\Validation\EmpleadoValidation,
App\Lib\Response;
$app->group('/autenticar/', function () {
$this->post('empresa', function ($req, $res, $args) {
$parametros = $req->getParsedBody();
if(isset($parametros['API']) && isset($parametros['API-KEY'])){
return $res->withHeader('Content-type', 'application/json')
->write(
json_encode($this->model->empresaAuth->autenticar($parametros['API'], $parametros['API-KEY']))
);
}else{
$r = new Response;
return $res->withHeader('Content-type', 'application/json')->withStatus(403)->write(json_encode($r->SetResponse(false, "Cabeceras no válidas")));
}
});
});
Step 1.2: Authenticate (Model)
public function autenticar($TOKEN, $KEY){
try{
$sql="SELECT e.id AS id_empresa, u.id AS id_admin, e.TOKEN, e.KEY,
u.email, e.nom_comercial
FROM empresas AS e
INNER JOIN empresas_usuariosprincipales AS u ON u.id_empresa=e.id
WHERE e.TOKEN = :TOKEN AND e.KEY= :KEY and e.API=1";
$stmt = $this->db->prepare($sql);
$stmt->bindParam(":TOKEN", $TOKEN, PDO::PARAM_STR);
$stmt->bindParam(":KEY", $KEY, PDO::PARAM_STR);
$respuesta = $stmt ->execute();
$respuesta = $stmt ->fetch();
$data = $respuesta;
}catch(Exception $e){
die($e);
}
if(is_object($data)){
$token = Auth::SignIn([
'DISS' => $data->id_empresa.'-'.$data->id_admin,
'TOKEN' => $data->TOKEN,
]);
/**
* I used this library but it doesn't work for me
* https://github.com/akrabat/rka-slim-session-middleware
*/
$this->sesion->data = $data->TOKEN;
$this->sesion->id_empresa = $data->id_empresa;
$this->sesion->id_usuario = $data->id_admin;
/**
* I create session variables with the local system, but they don't work either
*/
$_SESSION['data'] = $data->TOKEN;
$_SESSION['id_empresa'] = $data->id_empresa;
$_SESSION['id_usuario'] = $data->id_admin;
$this->response->data = array("TOKEN" => $token);
return $this->response->SetResponse(true);
}else{
return $this->response->SetResponse("false", "Credenciales no válidas");
}
}
The problem arises when I want to access some resource of my API, I have a Middelwere configured, I don't know if this is causing the inconvenience. For example, in the following resources, when I access the model, my "user_id" and "business_id" session variables do not exist.
Step 2. I try to access a route (Resource). The resource requests access to the Middelwere
$app->group('/agenda/', function () {
$this->get('get', function ($req, $res, $args) {
return $res->withHeader('Content-type', 'application/json')
->write(
json_encode($this->model->agenda->getAll())
);
});
})->add(new AuthMiddlewareEmpresa($app));
Step 2.1 The Middleware validates the permissions to access the resource.
class AuthMiddlewareEmpresa{
private $app = null;
private $r = null;
public function __construct($app){
$this->app = $app;
$this->r = new Response;
}
public function __invoke($request, $response, $next){
$c = $this->app->getContainer();
$app_tokken_name = $c->settings['app_token_name'];
$token = $request->getHeader($app_tokken_name);
if($c->model->detallesempresa->obtener()->data!=false && $c->model->detallesempresa->obtener()->data->api==1){
if(isset($token[0])) $token = $token[0];
try{
Auth::Check($token);
}catch(Exception $e){
$r = new Response;
$r->data = array("TOKEN" => null);
return $response->withHeader('Content-type', 'application/json')->withStatus(401)->write(json_encode($r->SetResponse(false, "Token no válido.")));
}
}else{
$r = new Response;
return $response->withHeader('Content-type', 'application/json')->withStatus(401)->write(json_encode($r->SetResponse(false, "Sin acceso a Jobtify API.")));
}
return $next($request, $response);
}
}
but when the Middleware requires access to the model to validate the permissions from the database. I simply cannot access the session variables. T_T
2.3. This is the model. Return null because when doing the queries it does not detect the session variables user_id and company_id
class DetallesEmpresaModel{
private $db;
private $TOKEN = "";
private $id_empresa = "";
private $id_usuario = "";
private $response;
private $sesion;
public function __construct($db){
$this->db = $db;
$this->response = new Response();
$this->sesion = new \RKA\Session();
if(isset($this->sesion->id_empresa)){
$this->TOKEN = $_SESSION['data'];
}
if(isset($this->sesion->id_empresa)){
$this->id_empresa = $this->sesion->id_empresa;
}
if(isset($this->sesion->id_usuario)){
$this->id_usuario = $this->sesion->id_usuario;
}
}
/*
Este modelo es accesible internamente
*/
public function obtener(){
try{
$sql="SELECT e.id_paquete AS paquete, e.activa, e.api, priv.* FROM empresas_privilegios AS priv
INNER JOIN empresas AS e ON priv.id_empresa=e.id
WHERE id_empresa=:id_empresa";
$stmt = $this->db->prepare($sql);
$stmt->bindParam(":id_empresa", $this->id_empresa, PDO::PARAM_STR);
$respuesta = $stmt ->execute();
$respuesta = $stmt ->fetch();
$data = $respuesta;
}catch(Exception $e){
die($e);
}
$this->response->SetResponse(true);
$this->response->data = $data;
return $this->response;
}
}