Keith Solomon
5d9af7a4fd
Add FullFlowTest, a single end-to-end test that exercises the home page, the team editor POST, the battlefield editor POST, and the start-match POST through the front controller (no php -S). Wiring fixes in public/index.php (called out in the test brief): - Honor $_SERVER['__csrf_secret'] when set so the test can supply its own secret; fall back to BATTLEFORGE_SECRET / var/secret.key otherwise. - Read the raw body from $_SERVER['__raw_body'] when set; fall back to php://input otherwise. PHP CLI's php://input is empty, so an explicit hook is needed for JSON bodies. - Return the response status from the front controller so the test can assert the HTTP status it set via http_response_code(). Test fixes: - Drop the static keyword on the runFrontController closure; static forbids $this access and the closure must capture $this to record lastStatus. - Drop the redundant '?? ''' on the ob_get_clean() result; (string) ob_get_clean() is always a string. - Set $_SERVER['__raw_body'] alongside $this->rawBody for the JSON requests so the front controller can read the body.
130 lines
4.7 KiB
PHP
130 lines
4.7 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use BattleForge\Http\CsrfToken;
|
|
use BattleForge\Http\Handlers\GetAssets;
|
|
use BattleForge\Http\Handlers\GetBattlefieldEditor;
|
|
use BattleForge\Http\Handlers\GetHomePage;
|
|
use BattleForge\Http\Handlers\GetTeamEditor;
|
|
use BattleForge\Http\Handlers\PostBattlefieldEditor;
|
|
use BattleForge\Http\Handlers\PostImageUpload;
|
|
use BattleForge\Http\Handlers\PostStartMatch;
|
|
use BattleForge\Http\Handlers\PostTeamEditor;
|
|
use BattleForge\Http\Request;
|
|
use BattleForge\Http\Response;
|
|
use BattleForge\Http\Router;
|
|
|
|
require __DIR__ . '/../vendor/autoload.php';
|
|
|
|
// 1. Read the app secret.
|
|
$secret = getenv('BATTLEFORGE_SECRET');
|
|
if ($secret === false || $secret === '') {
|
|
$secretFile = __DIR__ . '/../var/secret.key';
|
|
if (!is_file($secretFile)) {
|
|
if (!is_dir(dirname($secretFile))) {
|
|
mkdir(dirname($secretFile), 0700, true);
|
|
}
|
|
file_put_contents($secretFile, random_bytes(32));
|
|
chmod($secretFile, 0600);
|
|
}
|
|
$secret = file_get_contents($secretFile);
|
|
if ($secret === false) {
|
|
http_response_code(500);
|
|
echo "Failed to read app secret.\n";
|
|
return;
|
|
}
|
|
}
|
|
|
|
// 2. Ensure the __csrf cookie is set. If absent, issue a fresh token.
|
|
$cookies = $_COOKIE;
|
|
$existingCookie = (string) ($cookies['__csrf'] ?? '');
|
|
if ($existingCookie === '') {
|
|
[$token, $cookie] = CsrfToken::issue($secret);
|
|
setcookie('__csrf', $cookie, [
|
|
'expires' => time() + 86400,
|
|
'path' => '/',
|
|
'secure' => isset($_SERVER['HTTPS']),
|
|
'httponly' => true,
|
|
'samesite' => 'Lax',
|
|
]);
|
|
$existingCookie = $cookie;
|
|
$cookies['__csrf'] = $cookie;
|
|
}
|
|
|
|
// 3. Compute the upload-endpoint user token (derived from the same secret).
|
|
$uploadsToken = hash_hmac('sha256', $secret, 'bf-uploads');
|
|
|
|
// 4. Determine the request method, path, and content type.
|
|
$method = strtoupper((string) ($_SERVER['REQUEST_METHOD'] ?? 'GET'));
|
|
$uri = (string) ($_SERVER['REQUEST_URI'] ?? '/');
|
|
$path = parse_url($uri, PHP_URL_PATH) ?: '/';
|
|
$queryString = (string) (parse_url($uri, PHP_URL_QUERY) ?? '');
|
|
$contentType = isset($_SERVER['CONTENT_TYPE']) ? (string) $_SERVER['CONTENT_TYPE'] : null;
|
|
if ($contentType !== null) {
|
|
$semicolon = strpos($contentType, ';');
|
|
if ($semicolon !== false) {
|
|
$contentType = substr($contentType, 0, $semicolon);
|
|
}
|
|
$contentType = trim($contentType);
|
|
}
|
|
|
|
// 5. Read the raw body for fetch POSTs that submit JSON.
|
|
$rawBody = (string) ($_SERVER['__raw_body'] ?? file_get_contents('php://input'));
|
|
|
|
// 6. Build a Request with the request data, the CSRF secret, and the upload token.
|
|
$server = $_SERVER;
|
|
if (!isset($server['__csrf_secret'])) {
|
|
$server['__csrf_secret'] = $secret;
|
|
}
|
|
$server['__uploads_token'] = $uploadsToken;
|
|
|
|
$request = new Request(
|
|
get: $_GET,
|
|
post: $_POST,
|
|
files: $_FILES,
|
|
cookies: $cookies,
|
|
server: $server,
|
|
queryString: $queryString,
|
|
method: $method,
|
|
path: $path,
|
|
contentType: $contentType,
|
|
rawBody: $rawBody,
|
|
);
|
|
|
|
// 7. Configure the router with the eight routes.
|
|
$uploadsRoot = __DIR__ . '/../var/uploads';
|
|
$placeholderDir = __DIR__ . '/assets/placeholders';
|
|
|
|
$homePage = static fn (Request $r, array $p): Response => (new GetHomePage())->handle($r, $p);
|
|
$getTeam = static fn (Request $r, array $p): Response => (new GetTeamEditor())->handle($r, $p);
|
|
$postTeam = static fn (Request $r, array $p): Response => (new PostTeamEditor())->handle($r, $p);
|
|
$getBattlefield = static fn (Request $r, array $p): Response => (new GetBattlefieldEditor())->handle($r, $p);
|
|
$postBattlefield = static fn (Request $r, array $p): Response => (new PostBattlefieldEditor())->handle($r, $p);
|
|
$postStart = static fn (Request $r, array $p): Response => (new PostStartMatch())->handle($r, $p);
|
|
$postUpload = static fn (Request $r, array $p): Response => (new PostImageUpload($uploadsRoot))->handle($r, $p);
|
|
$getAssets = static function (Request $r, array $p) use ($placeholderDir, $uploadsRoot): Response {
|
|
return (new GetAssets($placeholderDir, $uploadsRoot))->handle($r, $p);
|
|
};
|
|
|
|
$router = new Router();
|
|
$router->add('GET', '/', $homePage);
|
|
$router->add('GET', '/scenarios/{id}/edit/team', $getTeam);
|
|
$router->add('POST', '/scenarios/{id}/edit/team', $postTeam);
|
|
$router->add('GET', '/scenarios/{id}/edit/battlefield', $getBattlefield);
|
|
$router->add('POST', '/scenarios/{id}/edit/battlefield', $postBattlefield);
|
|
$router->add('POST', '/scenarios/{id}/start', $postStart);
|
|
$router->add('POST', '/assets/upload', $postUpload);
|
|
$router->add('GET', '/assets/{kind}/{filename}', $getAssets);
|
|
|
|
// 8. Dispatch and emit.
|
|
$response = $router->dispatch($request);
|
|
|
|
http_response_code($response->status);
|
|
foreach ($response->headers as $name => $value) {
|
|
header($name . ': ' . $value);
|
|
}
|
|
echo $response->body;
|
|
|
|
return $response->status;
|