implement cors

Reviewed-on: #29

Dockerfile

@@ -1,4 +1,4 @@
-FROM php:7.4.7-cli-buster
+FROM php:8.1-cli-bookworm
 
 RUN apt-get update && apt-get install -y unzip
 RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer

composer.json

@@ -5,12 +5,12 @@
   "license": "GNU GPL 3.0",
   "require": {
     "vlucas/phpdotenv": "^5.5",
-    "symfony/console": "^5.4",
+    "symfony/console": "^6.3",
     "phpmailer/phpmailer": "^6.8",
-    "cocur/slugify": "^4.3"
+    "cocur/slugify": "^4.5"
   },
   "require-dev": {
-    "phpunit/phpunit": "^9.6",
+    "phpunit/phpunit": "^10.3",
     "phpstan/phpstan": "^1.10"
   },
   "autoload": {

src/Response/HttpResponse.php

@@ -55,6 +55,11 @@ class HttpResponse
 
     public function render(): void
     {
+        $this->handleCors();
+        if ($this->method === 'options') {
+            return;
+        }
+
         $match = $this->routeCollection->match($this->method, $this->parsedUrl['path']);
         if ($match === null) {
             $this->render404();
@@ -94,6 +99,7 @@ class HttpResponse
             $response = call_user_func([$controller, $handler[1]]);
         } catch (Exception $exception) {
             $this->dbConnection->rollback();
+            error_log($exception);
             $this->render500($exception);
             return;
         }
@@ -109,6 +115,56 @@ class HttpResponse
         }
     }
 
+    private function handleCors(): void
+    {
+        $origin = $this->request->header('Origin');
+        if (!$origin) {
+            return;
+        }
+
+        if (isset($this->appConfig['cors']['allow_origins'])) {
+            if (in_array($origin, $this->appConfig['cors']['allow_origins']) || in_array('*', $this->appConfig['cors']['allow_origins'])) {
+                header("Access-Control-Allow-Origin: {$origin}");
+            }
+        }
+
+        if (!empty($this->appConfig['cors']['allow_credentials'])) {
+            header('Access-Control-Allow-Credentials: true');
+        }
+
+        if ($this->method !== 'options') {
+            return;
+        }
+
+        if (isset($this->appConfig['cors']['allow_headers'])) {
+            $headers = explode(',', $this->request->header('Access-Control-Request-Headers'));
+            if (in_array('*', $this->appConfig['cors']['allow_headers'])) {
+                $allow_headers = $headers;
+            } else {
+                $allow_headers = array_intersect($this->appConfig['cors']['allow_headers'], $headers);
+            }
+
+            if (count($allow_headers) > 0) {
+                header('Access-Control-Allow-Headers: ' . join(', ', $allow_headers));
+            }
+        }
+
+        if (isset($this->appConfig['cors']['allow_methods'])) {
+            if (in_array('*', $this->appConfig['cors']['allow_methods'])) {
+                $allow_methods = ['DELETE', 'GET', 'HEAD', 'OPTIONS', 'PATCH', 'POST', 'PUT'];
+            } else {
+                $allow_methods = $this->appConfig['cors']['allow_methods'];
+            }
+
+            if (count($allow_methods) > 0) {
+                header('Access-Control-Allow-Methods: ' . join(', ', $allow_methods));
+            }
+        }
+
+        $max_age = $this->appConfig['cors']['max_age'] ?? 600;
+        header("Access-Control-Max-Age: {$max_age}");
+    }
+
     private function redirectToLogin(): void
     {
         $this->request->session()->set('redirect_after_login', $this->rawUrl);

src/Session/DatabaseSessionHandler.php

@@ -86,12 +86,12 @@ class DatabaseSessionHandler implements ISessionHandler
         return true;
     }
 
-    public function gc($maxlifetime): bool
+    public function gc($maxlifetime): int|false
     {
         // empty on purpose
         // old sessions are deleted by MaintainDatabaseCommand
 
-        return true;
+        return 1;
     }
 
     public function create_sid(): string

tests/OAuth/GoogleOAuthTest.php

@@ -17,7 +17,7 @@ final class GoogleOAuthTest extends TestCase
         $redirectUrl = 'http://example.com/oauth';
 
         $requestMock = $this->getMockBuilder(IRequest::class)
-            ->setMethods(['setUrl', 'setMethod', 'setQuery', 'setHeaders', 'send'])
+            ->onlyMethods(['setUrl', 'setMethod', 'setQuery', 'setHeaders', 'send'])
             ->getMock();
         $googleOAuth = new GoogleOAuth($requestMock);
 
@@ -48,10 +48,10 @@ final class GoogleOAuthTest extends TestCase
         $redirectUrl = 'http://example.com/oauth';
 
         $requestMock = $this->getMockBuilder(IRequest::class)
-            ->setMethods(['setUrl', 'setMethod', 'setQuery', 'setHeaders', 'send'])
+            ->onlyMethods(['setUrl', 'setMethod', 'setQuery', 'setHeaders', 'send'])
             ->getMock();
         $responseMock = $this->getMockBuilder(IResponse::class)
-            ->setMethods(['getBody', 'getHeaders'])
+            ->onlyMethods(['getBody', 'getHeaders'])
             ->getMock();
         $googleOAuth = new GoogleOAuth($requestMock);