keith/BattleForge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: CSRF flow ships the raw token, not the HMAC cookie

Browse Source
This commit is contained in:
Keith Solomon
2026-07-26 11:01:36 -05:00
parent 73254cbf80
commit 2ea8cfd83d
13 changed files with 60 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Http/Handlers/GetBattlefieldEditor.php
+1 -1
View File
@@ -12,7 +12,7 @@ final class GetBattlefieldEditor
/** @param array<string, string> $params */
public function handle(Request $request, array $params): Response
{
$csrf = $request->cookies['__csrf'] ?? '';
$csrf = $request->cookies['__csrf_token'] ?? '';
$scenarioId = $params['id'] ?? 'new';
$width = 8;
$height = 8;
src/Http/Handlers/GetHomePage.php
+1 -1
View File
@@ -16,7 +16,7 @@ final class GetHomePage
/** @param array<string, string> $params */
public function handle(Request $request, array $params): Response
{
$csrf = $request->cookies['__csrf'] ?? '';
$csrf = $request->cookies['__csrf_token'] ?? '';
$bundled = $this->loadBundledScenarios();
ob_start();
src/Http/Handlers/GetMatchView.php
+1 -1
View File
@@ -12,7 +12,7 @@ final class GetMatchView
/** @param array<string, string> $params */
public function handle(Request $request, array $params): Response
{
$csrf = $request->cookies['__csrf'] ?? '';
$csrf = $request->cookies['__csrf_token'] ?? '';
ob_start();
require_once __DIR__ . '/../../Views/layout.php';
src/Http/Handlers/GetTeamEditor.php
+1 -1
View File
@@ -12,7 +12,7 @@ final class GetTeamEditor
/** @param array<string, string> $params */
public function handle(Request $request, array $params): Response
{
$csrf = $request->cookies['__csrf'] ?? '';
$csrf = $request->cookies['__csrf_token'] ?? '';
$scenarioId = $params['id'] ?? 'new';
$error = null;
src/Http/Handlers/PostStartMatch.php
+11 -2
View File
@@ -27,8 +27,17 @@ final class PostStartMatch
try {
$payload = json_decode($request->rawBody, true, flags: JSON_THROW_ON_ERROR);
$draft = ScenarioDraft::fromPost($payload);
$scenario = $draft->toScenario();
// Accept either the canonical `Scenario` shape (used by the bundled
// scenario endpoint at /scenarios/bundled/{id}, where the JS POSTs
// the JSON it fetched verbatim) or the editor's `ScenarioDraft`
// shape (the form's denormalized fields). The presence of a
// nested `battlefield` object distinguishes the two.
if (is_array($payload) && is_array($payload['battlefield'] ?? null)) {
$scenario = ScenarioSerializer::scenarioFromArray($payload);
} else {
$draft = ScenarioDraft::fromPost($payload ?? []);
$scenario = $draft->toScenario();
}
ScenarioValidator::validate($scenario);
$match = $scenario->startMatch('alpha');
} catch (\JsonException $exception) {