rvr-nextgen/web.php

<?php

require 'app.php';

if (!empty($_ENV['DEV'])) {
    error_reporting(E_ALL);

    ini_set('display_errors', '1');
} else {
    ini_set('display_errors', '0');
}

Container::$routeCollection = new SokoWeb\Routing\RouteCollection();

Container::$routeCollection->get('index', '', [RVR\Controller\HomeController::class, 'getIndex']);
Container::$routeCollection->get('startSession', 'startSession.json', [RVR\Controller\HomeController::class, 'startSession']);
Container::$routeCollection->group('login', function (SokoWeb\Routing\RouteCollection $routeCollection) {
    $routeCollection->get('login', '', [RVR\Controller\LoginController::class, 'getLoginForm']);
    $routeCollection->post('login-action', '', [RVR\Controller\LoginController::class, 'login']);
    $routeCollection->get('login-google', 'google', [RVR\Controller\LoginController::class, 'getGoogleLoginRedirect']);
    $routeCollection->get('login-google-action', 'google/code', [RVR\Controller\LoginController::class, 'loginWithGoogle']);
});
Container::$routeCollection->group('oauth', function (SokoWeb\Routing\RouteCollection $routeCollection) {
    $routeCollection->get('oauth-start', 'start', [RVR\Controller\OAuthLoginController::class, 'startOauth']);
    $routeCollection->get('oauth-finish', 'finish', [RVR\Controller\OAuthLoginController::class, 'finishOauth']);
    $routeCollection->post('oauth-token', 'token', [RVR\Controller\OAuthLoginController::class, 'getToken']);
    $routeCollection->get('oauth-jwtPublicKey', 'jwtPublicKey', [RVR\Controller\OAuthLoginController::class, 'getJwtPublicKey']);
});
Container::$routeCollection->group('password', function (SokoWeb\Routing\RouteCollection $routeCollection) {
    $routeCollection->get('password-requestReset', 'requestReset', [RVR\Controller\LoginController::class, 'getRequestPasswordResetForm']);
    $routeCollection->post('password-requestReset-action', 'requestReset', [RVR\Controller\LoginController::class, 'requestPasswordReset']);
    $routeCollection->get('password-requestReset.success', 'requestReset/success', [RVR\Controller\LoginController::class, 'getRequestPasswordResetSuccess']);
    $routeCollection->get('password-reset', 'reset/{token}', [RVR\Controller\LoginController::class, 'getResetPasswordForm']);
    $routeCollection->post('password-reset.action', 'reset/{token}', [RVR\Controller\LoginController::class, 'resetPassword']);
});
Container::$routeCollection->get('logout', 'logout', [RVR\Controller\LoginController::class, 'logout']);
Container::$routeCollection->group('account', function (SokoWeb\Routing\RouteCollection $routeCollection) {
    $routeCollection->get('account', '', [RVR\Controller\UserController::class, 'getAccount']);
    $routeCollection->post('account-action', '', [RVR\Controller\UserController::class, 'saveAccount']);
    $routeCollection->get('account.googleAuthenticate', 'googleAuthenticate', [RVR\Controller\UserController::class, 'getGoogleAuthenticateRedirect']);
    $routeCollection->get('account.googleAuthenticate-action', 'googleAuthenticate/code', [RVR\Controller\UserController::class, 'authenticateWithGoogle']);
});

Container::$sessionHandler = new SokoWeb\Session\DatabaseSessionHandler();

session_set_save_handler(Container::$sessionHandler, true);
session_start([
    'gc_probability' => 0, // old sessions are deleted by MaintainDatabaseCommand
    'cookie_lifetime' => 604800,
    'cookie_path' => '/',
    'cookie_httponly' => true,
    'cookie_samesite' => 'Lax'
]);

if (isset($_COOKIE[session_name()])) {
    // extend session cookie lifetime is cookie already exists
    setcookie(session_name(), session_id(), [
        'expires' => time() + 604800,
        'path' => '/',
        'httponly' => true,
        'samesite' => 'Lax'
    ]);
}

// this is needed to handle old type of session IDs
if (!Container::$sessionHandler->validateId(session_id())) {
    session_regenerate_id(true);
}

Container::$request = new SokoWeb\Request\Request(
    $_SERVER['REQUEST_SCHEME'] . '://' . $_SERVER['HTTP_HOST'],
    $_GET,
    $_POST,
    $_SESSION,
    new RVR\Repository\UserRepository()
);

if (!Container::$request->session()->has('anti_csrf_token')) {
    Container::$request->session()->set('anti_csrf_token', bin2hex(random_bytes(16)));
}

//TODO: make a nicer logic
$antiCsrfTokenExceptions = ['oauth/token'];