Merge pull request 'MAPG-143 make it possible to disable game for guests (default is disable)' (#47) from feature/MAPG-143-allow-game-only-for-users into develop

Reviewed-on: https://gitea.e5tv.hu/esoko/mapguesser/pulls/47

.env.example

@@ -20,3 +20,4 @@ MULTI_INTERNAL_HOST=multi
 MULTI_INTERNAL_PORT=5000
 MULTI_WS_URL=mapguesser-dev.ch:8090
 MULTI_WS_PORT=8090
+ENABLE_GAME_FOR_GUESTS=0

README.md

@@ -70,6 +70,7 @@ Example:
 ```
 LEAFLET_TILESERVER_URL=https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png
 LEAFLET_TILESERVER_SUBDOMAINS=abc
+LEAFLET_TILESERVER_ATTRIBUTION="&copy; <a href=\"https://www.openstreetmap.org/copyright\">OpenStreetMap</a> contributors"
 ```
 
 ### (Production only) Create cron job

public/static/css/mapguesser.css

@@ -451,6 +451,7 @@ div.box {
 }
 
 .circleControl .controlItem {
+    position: relative;
     height: 60px;
     margin-top: 10px;
     opacity: 70%;
@@ -463,6 +464,8 @@ div.box {
 
 .circleControl .controlItem div {
     position: absolute;
+    width: 100%;
+    height: 100%;
 }
 
 .circleControl .controlBackground {
@@ -477,7 +480,6 @@ div.box {
     margin: auto;
     margin-top: 50%;
     transform: translateY(-50%);
-    -ms-transform: translateY(-50%);
 }
 
 @media screen and (max-width: 599px) {

src/Controller/GameController.php

@@ -2,6 +2,7 @@
 
 use DateTime;
 use Faker\Factory;
+use MapGuesser\Interfaces\Authorization\ISecured;
 use MapGuesser\Interfaces\Request\IRequest;
 use MapGuesser\Response\HtmlContent;
 use MapGuesser\Response\JsonContent;
@@ -14,7 +15,7 @@ use MapGuesser\Repository\MapRepository;
 use MapGuesser\Repository\MultiRoomRepository;
 use MapGuesser\Response\Redirect;
 
-class GameController
+class GameController implements ISecured
 {
     private IRequest $request;
 
@@ -35,6 +36,11 @@ class GameController
         $this->mapRepository = new MapRepository();
     }
 
+    public function authorize(): bool
+    {
+        return !empty($_ENV['ENABLE_GAME_FOR_GUESTS']) || $this->request->user() !== null;
+    }
+
     public function getGame(): IContent
     {
         $mapId = (int) $this->request->query('mapId');

src/Controller/GameFlowController.php

@@ -1,6 +1,7 @@
 <?php namespace MapGuesser\Controller;
 
 use DateTime;
+use MapGuesser\Interfaces\Authorization\ISecured;
 use MapGuesser\Interfaces\Request\IRequest;
 use MapGuesser\Util\Geo\Position;
 use MapGuesser\Response\JsonContent;
@@ -12,7 +13,7 @@ use MapGuesser\Repository\MultiRoomRepository;
 use MapGuesser\Repository\PlaceRepository;
 use MapGuesser\Repository\UserPlayedPlaceRepository;
 
-class GameFlowController
+class GameFlowController implements ISecured
 {
     const NUMBER_OF_ROUNDS = 5;
     const MAX_SCORE = 1000;
@@ -39,6 +40,11 @@ class GameFlowController
         $this->userPlayedPlaceRepository = new UserPlayedPlaceRepository();
     }
 
+    public function authorize(): bool
+    {
+        return !empty($_ENV['ENABLE_GAME_FOR_GUESTS']) || $this->request->user() !== null;
+    }
+
     public function initialData(): IContent
     {
         $mapId = (int) $this->request->query('mapId');

views/maps.php

@@ -62,12 +62,16 @@ TODO: condition!
                     </div>
                 </div>
                 <div class="buttonContainer">
-                    <?php if ($isAdmin): ?>
-                        <button class="button fullWidth noRightRadius playButton" data-map-id="<?= $map['id'] ?>" data-map-name="<?= htmlspecialchars($map['name']) ?>" title="Play map '<?= $map['name'] ?>'">Play this map</button>
-                        <a class="button yellow fullWidth noLeftRadius noRightRadius" href="/admin/mapEditor/<?= $map['id']; ?>" title="Edit map '<?= $map['name'] ?>'">Edit</a>
-                        <button class="button red fullWidth noLeftRadius deleteButton" data-map-id="<?= $map['id'] ?>" data-map-name="<?= htmlspecialchars($map['name']) ?>" title="Delete map '<?= $map['name'] ?>'">Delete</button>
+                    <?php if (!empty($_ENV['ENABLE_GAME_FOR_GUESTS']) || Container::$request->user()): ?>
+                        <?php if ($isAdmin): ?>
+                            <button class="button fullWidth noRightRadius playButton" data-map-id="<?= $map['id'] ?>" data-map-name="<?= htmlspecialchars($map['name']) ?>" title="Play map '<?= $map['name'] ?>'">Play this map</button>
+                            <a class="button yellow fullWidth noLeftRadius noRightRadius" href="/admin/mapEditor/<?= $map['id']; ?>" title="Edit map '<?= $map['name'] ?>'">Edit</a>
+                            <button class="button red fullWidth noLeftRadius deleteButton" data-map-id="<?= $map['id'] ?>" data-map-name="<?= htmlspecialchars($map['name']) ?>" title="Delete map '<?= $map['name'] ?>'">Delete</button>
+                        <?php else: ?>
+                            <button class="button fullWidth playButton" data-map-id="<?= $map['id'] ?>" data-map-name="<?= htmlspecialchars($map['name']) ?>" title="Play map '<?= $map['name'] ?>'">Play this map</button>
+                        <?php endif; ?>
                     <?php else: ?>
-                        <button class="button fullWidth playButton" data-map-id="<?= $map['id'] ?>" data-map-name="<?= htmlspecialchars($map['name']) ?>" title="Play map '<?= $map['name'] ?>'">Play this map</button>
+                        <a href="/login" class="button fullWidth" title="Play map '<?= $map['name'] ?>'">Play this map</a>
                     <?php endif; ?>
                 </div>
             </div>

web.php

@@ -74,13 +74,23 @@ if (isset($_COOKIE['COOKIES_CONSENT'])) {
 
     session_set_save_handler(Container::$sessionHandler, true);
     session_start([
-        'gc_maxlifetime' => 604800,
         'gc_probability' => 0, // old sessions are deleted by MaintainDatabaseCommand
-        'cookie_lifetime' => 604800, // TODO: cookie is not renewed so session can be lost
+        'cookie_lifetime' => 604800,
+        'cookie_path' => '/',
         'cookie_httponly' => true,
         'cookie_samesite' => 'Lax'
     ]);
 
+    if (isset($_COOKIE[session_name()])) {
+        // extend session cookie lifetime is cookie already exists
+        setcookie(session_name(), session_id(), [
+            'expires' => time() + 604800,
+            'path' => '/',
+            'httponly' => true,
+            'samesite' => 'Lax'
+        ]);
+    }
+
     // this is needed to handle old type of session IDs
     if (!Container::$sessionHandler->validateId(session_id())) {
         session_regenerate_id(true);