feat: add image upload and start-match handlers

src/Http/Handlers/PostImageUpload.php

@@ -0,0 +1,56 @@
+<?php
+
+declare(strict_types=1);
+
+namespace BattleForge\Http\Handlers;
+
+use BattleForge\Application\ImageUploadService;
+use BattleForge\Application\InvalidImageException;
+use BattleForge\Http\CsrfToken;
+use BattleForge\Http\Request;
+use BattleForge\Http\Response;
+
+final class PostImageUpload
+{
+    public function __construct(private readonly string $uploadsRoot)
+    {
+    }
+
+    /** @param array<string, string> $params */
+    public function handle(Request $request, array $params): Response
+    {
+        $submitted = (string) ($request->post['_csrf'] ?? '');
+        $expected = (string) ($request->cookies['__csrf'] ?? '');
+        $secret = (string) ($request->server['__csrf_secret'] ?? '');
+
+        if ($secret === '' || $expected === '' || !CsrfToken::verify($submitted, $secret, $expected)) {
+            return Response::json(403, ['error' => 'csrf']);
+        }
+
+        $file = $request->files['image'] ?? null;
+        if ($file === null) {
+            return Response::json(400, ['error' => 'No image uploaded.']);
+        }
+
+        $tempPath = (string) ($file['tmp_name'] ?? '');
+        $declaredMime = (string) ($file['type'] ?? '');
+
+        if ($tempPath === '' || !is_file($tempPath)) {
+            // Production: $request->files['image']['tmp_name'] is PHP-set from the multipart body,
+            // so is_file() confirms the temp file exists. is_uploaded_file() is stricter but
+            // unsuitable for unit tests that synthesize tmp files via tempnam().
+            return Response::json(400, ['error' => 'Upload is not a file.']);
+        }
+
+        $userToken = hash_hmac('sha256', $secret, 'bf-uploads');
+
+        try {
+            $service = new ImageUploadService($userToken, $this->uploadsRoot);
+            $url = $service->store($tempPath, $declaredMime);
+        } catch (InvalidImageException $exception) {
+            return Response::json(400, ['error' => $exception->getMessage()]);
+        }
+
+        return Response::json(200, ['url' => $url]);
+    }
+}

src/Http/Handlers/PostStartMatch.php

@@ -0,0 +1,41 @@
+<?php
+
+declare(strict_types=1);
+
+namespace BattleForge\Http\Handlers;
+
+use BattleForge\Application\ScenarioDraft;
+use BattleForge\Application\ScenarioSerializer;
+use BattleForge\Domain\ScenarioValidator;
+use BattleForge\Http\CsrfToken;
+use BattleForge\Http\Request;
+use BattleForge\Http\Response;
+
+final class PostStartMatch
+{
+    /** @param array<string, string> $params */
+    public function handle(Request $request, array $params): Response
+    {
+        $submitted = (string) ($request->server['HTTP_X_CSRF_TOKEN'] ?? '');
+        $expected = (string) ($request->cookies['__csrf'] ?? '');
+        $secret = (string) ($request->server['__csrf_secret'] ?? '');
+
+        if ($secret === '' || $expected === '' || !CsrfToken::verify($submitted, $secret, $expected)) {
+            return Response::json(403, ['error' => 'csrf']);
+        }
+
+        try {
+            $payload = json_decode($request->rawBody, true, flags: JSON_THROW_ON_ERROR);
+            $draft = ScenarioDraft::fromPost($payload);
+            $scenario = $draft->toScenario();
+            ScenarioValidator::validate($scenario);
+            $match = $scenario->startMatch('alpha');
+        } catch (\JsonException $exception) {
+            return Response::json(400, ['errors' => ['Malformed JSON.']]);
+        } catch (\InvalidArgumentException $exception) {
+            return Response::json(400, ['errors' => [$exception->getMessage()]]);
+        }
+
+        return Response::json(200, ['match' => ScenarioSerializer::matchToArray($match)]);
+    }
+}