feat: add home page and asset-serving handlers

2026-07-06 19:02:06 -05:00
parent 0f4a220e70
commit 3e4184f08d
4 changed files with 212 additions and 0 deletions
@@ -0,0 +1,74 @@
 <?php
 declare(strict_types=1);
 namespace BattleForge\Http\Handlers;
 use BattleForge\Http\Request;
 use BattleForge\Http\Response;
 final class GetAssets
 {
    public function __construct(
        private readonly string $placeholderDir,
        private readonly string $uploadsRoot,
    ) {
    }
    /** @param array<string, string> $params */
    public function handle(Request $request, array $params): Response
    {
        $kind = $params['kind'] ?? '';
        $filename = $params['filename'] ?? '';
        if ($kind === 'placeholders') {
            return $this->serveFrom($this->placeholderDir . '/' . $filename);
        }
        if ($kind === 'uploads') {
            $userToken = $params['userToken'] ?? '';
            $requestToken = $request->cookies['__uploads_token'] ?? '';
            if ($userToken === '' || $userToken !== $requestToken) {
                return Response::html(404, '<h1>Not found</h1>');
            }
            return $this->serveFrom($this->uploadsRoot . '/' . $userToken . '/' . $filename);
        }
        return Response::html(404, '<h1>Not found</h1>');
    }
    private function serveFrom(string $path): Response
    {
        if (!is_file($path)) {
            return Response::html(404, '<h1>Not found</h1>');
        }
        $body = file_get_contents($path);
        if ($body === false) {
            return Response::html(500, '<h1>Read error</h1>');
        }
        $ext = strtolower(pathinfo($path, PATHINFO_EXTENSION));
        $contentType = match ($ext) {
            'png' => 'image/png',
            'jpg', 'jpeg' => 'image/jpeg',
            'webp' => 'image/webp',
            'gif' => 'image/gif',
            default => 'application/octet-stream',
        };
        return new Response(200, ['Content-Type' => $contentType] + self::securityHeaders(), $body);
    }
    /** @return array<string, string> */
    private static function securityHeaders(): array
    {
        return [
            'X-Content-Type-Options' => 'nosniff',
            'Referrer-Policy' => 'same-origin',
            'Content-Security-Policy' => "default-src 'self'; img-src 'self' data:; style-src 'self'",
        ];
    }
 }
@@ -0,0 +1,42 @@
 <?php
 declare(strict_types=1);
 namespace BattleForge\Http\Handlers;
 use BattleForge\Http\Request;
 use BattleForge\Http\Response;
 final class GetHomePage
 {
    /** @param array<string, string> $params */
    public function handle(Request $request, array $params): Response
    {
        $body = <<<'HTML'
 <!DOCTYPE html>
 <html lang="en">
 <head>
    <meta charset="utf-8">
    <title>BattleForge</title>
    <link rel="stylesheet" href="/assets/styles.css">
    <meta name="csrf-token" content="{{ csrf }}">
 </head>
 <body>
    <h1>BattleForge</h1>
    <p><a href="/scenarios/new/edit/team">New scenario</a></p>
    <h2>Recent scenarios</h2>
    <div id="recent"><p class="bf-empty">No saved scenarios yet.</p></div>
    <script type="module" src="/js/storage.js"></script>
 </body>
 </html>
 HTML;
        // The CSRF token placeholder is filled by the front controller (Task 16)
        // before the body is sent. The handler does not see the cookie or the
        // secret; it just receives a pre-issued token from the front controller.
        $token = $request->cookies['__csrf'] ?? '';
        $body = str_replace('{{ csrf }}', htmlspecialchars($token, ENT_QUOTES, 'UTF-8'), $body);
        return Response::html(200, $body);
    }
 }
@@ -0,0 +1,70 @@
 <?php
 declare(strict_types=1);
 namespace BattleForge\Tests\Integration;
 use BattleForge\Http\Request;
 use BattleForge\Http\Handlers\GetAssets;
 use PHPUnit\Framework\TestCase;
 final class GetAssetsTest extends TestCase
 {
    private string $placeholderDir;
    private string $uploadsDir;
    protected function setUp(): void
    {
        $this->placeholderDir = sys_get_temp_dir() . '/bf-placeholders-' . bin2hex(random_bytes(4));
        mkdir($this->placeholderDir, 0755, true);
        // 1x1 red PNG
        $png = base64_decode(
            'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR4nGNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==',
            true,
        );
        file_put_contents($this->placeholderDir . '/defender.png', $png);
        $this->uploadsDir = sys_get_temp_dir() . '/bf-assets-' . bin2hex(random_bytes(4));
        mkdir($this->uploadsDir, 0700, true);
    }
    protected function tearDown(): void
    {
        if (is_dir($this->uploadsDir)) {
            foreach (glob($this->uploadsDir . '/*/*') as $file) {
                unlink($file);
            }
            foreach (glob($this->uploadsDir . '/*') as $dir) {
                rmdir($dir);
            }
            rmdir($this->uploadsDir);
        }
        if (is_dir($this->placeholderDir)) {
            foreach (glob($this->placeholderDir . '/*') as $file) {
                unlink($file);
            }
            rmdir($this->placeholderDir);
        }
    }
    public function testItServesAPlaceholderImageWithoutAuth(): void
    {
        $handler = new GetAssets($this->placeholderDir, $this->uploadsDir);
        $request = new Request([], [], [], [], [], '', 'GET', '/assets/placeholders/defender.png', null, '');
        $response = $handler->handle($request, ['kind' => 'placeholders', 'filename' => 'defender.png']);
        self::assertSame(200, $response->status);
        self::assertSame('image/png', $response->headers['Content-Type'] ?? '');
        self::assertGreaterThan(0, strlen($response->body));
    }
    public function testItReturns404ForAMissingFile(): void
    {
        $handler = new GetAssets($this->placeholderDir, $this->uploadsDir);
        $request = new Request([], [], [], [], [], '', 'GET', '/assets/placeholders/missing.png', null, '');
        $response = $handler->handle($request, ['kind' => 'placeholders', 'filename' => 'missing.png']);
        self::assertSame(404, $response->status);
    }
 }
@@ -0,0 +1,26 @@
 <?php
 declare(strict_types=1);
 namespace BattleForge\Tests\Integration;
 use BattleForge\Http\Request;
 use BattleForge\Http\Response;
 use BattleForge\Http\Handlers\GetHomePage;
 use PHPUnit\Framework\TestCase;
 final class GetHomePageTest extends TestCase
 {
    public function testItReturnsTheHomePageWithSecurityHeaders(): void
    {
        $handler = new GetHomePage();
        $request = new Request([], [], [], [], [], '', 'GET', '/', 'text/html', '');
        $response = $handler->handle($request, []);
        self::assertSame(200, $response->status);
        self::assertStringContainsString('text/html', $response->headers['Content-Type'] ?? '');
        self::assertSame('nosniff', $response->headers['X-Content-Type-Options']);
        self::assertStringContainsString('default-src', $response->headers['Content-Security-Policy']);
        self::assertStringContainsString('<a href="/scenarios/new/edit/team">', $response->body);
    }
 }