implement cors

Reviewed-on: #29

Dockerfile

@@ -1,4 +1,4 @@
-FROM php:7.4.7-cli-buster
+FROM php:8.1-cli-bookworm
 
 RUN apt-get update && apt-get install -y unzip
 RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer

composer.json

@@ -5,11 +5,12 @@
   "license": "GNU GPL 3.0",
   "require": {
     "vlucas/phpdotenv": "^5.5",
-    "symfony/console": "^5.4",
+    "symfony/console": "^6.3",
-    "phpmailer/phpmailer": "^6.8"
+    "phpmailer/phpmailer": "^6.8",
+    "cocur/slugify": "^4.5"
   },
   "require-dev": {
-    "phpunit/phpunit": "^9.6",
+    "phpunit/phpunit": "^10.3",
     "phpstan/phpstan": "^1.10"
   },
   "autoload": {

src/Database/Mysql/Connection.php

@@ -7,48 +7,52 @@ use mysqli;
 
 class Connection implements IConnection
 {
-    private mysqli $connection;
+    private string $host;
+    private string $user;
+    private string $password;
+    private string $db;
+    private int $port;
+    private string $socket;
+    private ?mysqli $connection = null;
 
     public function __construct(string $host, string $user, string $password, string $db, int $port = -1, string $socket = null)
     {
-        if ($port < 0) {
+        $this->host = $host;
-            $port = (int) ini_get('mysqli.default_port');
+        $this->user = $user;
-        }
+        $this->password = $password;
-
+        $this->db = $db;
-        if ($socket === null) {
+        $this->port = $port < 0 ? (int) ini_get('mysqli.default_port') : $port;
-            $socket = (string) ini_get('mysqli.default_socket');
+        $this->socket = $socket === null ? (string) ini_get('mysqli.default_socket') : $socket;
-        }
-
-        mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);
-        $this->connection = new mysqli($host, $user, $password, $db, $port, $socket);
-        $this->connection->set_charset('utf8mb4');
     }
 
     public function __destruct()
     {
+        if ($this->connection === null) {
+            return;
+        }
         $this->connection->close();
     }
 
     public function startTransaction(): void
     {
-        $this->connection->autocommit(false);
+        $this->getConnection()->autocommit(false);
     }
 
     public function commit(): void
     {
-        $this->connection->commit();
+        $this->getConnection()->commit();
-        $this->connection->autocommit(true);
+        $this->getConnection()->autocommit(true);
     }
 
     public function rollback(): void
     {
-        $this->connection->rollback();
+        $this->getConnection()->rollback();
-        $this->connection->autocommit(true);
+        $this->getConnection()->autocommit(true);
     }
 
     public function query(string $query): ?IResultSet
     {
-        $result = $this->connection->query($query);
+        $result = $this->getConnection()->query($query);
 
         if ($result !== true) {
             return new ResultSet($result);
@@ -59,36 +63,51 @@ class Connection implements IConnection
 
     public function multiQuery(string $query): array
     {
-        $this->connection->multi_query($query);
+        $this->getConnection()->multi_query($query);
 
         $ret = [];
         do {
-            if ($result = $this->connection->store_result()) {
+            if ($result = $this->getConnection()->store_result()) {
                 $ret[] = new ResultSet($result);
             } else {
                 $ret[] = null;
             }
 
-            $this->connection->more_results();
+            $this->getConnection()->more_results();
-        } while ($this->connection->next_result());
+        } while ($this->getConnection()->next_result());
 
         return $ret;
     }
 
     public function prepare(string $query): IStatement
     {
-        $stmt = $this->connection->prepare($query);
+        $stmt = $this->getConnection()->prepare($query);
 
         return new Statement($stmt);
     }
 
     public function lastId(): int
     {
-        return $this->connection->insert_id;
+        return $this->getConnection()->insert_id;
     }
 
     public function getAffectedRows(): int
     {
-        return $this->connection->affected_rows;
+        return $this->getConnection()->affected_rows;
+    }
+
+    private function getConnection(): mysqli
+    {
+        if ($this->connection === null) {
+            $this->createConnection();
+        }
+        return $this->connection;
+    }
+
+    private function createConnection(): void
+    {
+        mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);
+        $this->connection = new mysqli($this->host, $this->user, $this->password, $this->db, $this->port, $this->socket);
+        $this->connection->set_charset('utf8mb4');
     }
 }

src/Database/Query/Select.php

@@ -97,28 +97,28 @@ class Select
         return $this;
     }
 
-    public function where($column, string $relation = null, $value = null): Select
+    public function where($column, ?string $relation = null, $value = null): Select
     {
         $this->addWhereCondition('AND', $column, $relation, $value);
 
         return $this;
     }
 
-    public function orWhere($column, string $relation = null, $value = null): Select
+    public function orWhere($column, ?string $relation = null, $value = null): Select
     {
         $this->addWhereCondition('OR', $column, $relation, $value);
 
         return $this;
     }
 
-    public function having($column, string $relation = null, $value = null): Select
+    public function having($column, ?string $relation = null, $value = null): Select
     {
         $this->addHavingCondition('AND', $column, $relation, $value);
 
         return $this;
     }
 
-    public function orHaving($column, string $relation = null, $value = null): Select
+    public function orHaving($column, ?string $relation = null, $value = null): Select
     {
         $this->addHavingCondition('OR', $column, $relation, $value);
 
@@ -211,12 +211,12 @@ class Select
         $this->joins[] = [$type, $table, $column1, $relation, $column2];
     }
 
-    private function addWhereCondition(string $logic, $column, string $relation, $value): void
+    private function addWhereCondition(string $logic, $column, ?string $relation, $value): void
     {
         $this->conditions[self::CONDITION_WHERE][] = [$logic, $column, $relation, $value];
     }
 
-    private function addHavingCondition(string $logic, $column, string $relation, $value): void
+    private function addHavingCondition(string $logic, $column, ?string $relation, $value): void
     {
         $this->conditions[self::CONDITION_HAVING][] = [$logic, $column, $relation, $value];
     }

src/Interfaces/PersistentData/IPersistentDataManager.php

@@ -12,8 +12,12 @@ interface IPersistentDataManager
 
     public function selectFromDbById($id, string $type, bool $useRelations = false, array $withRelations = []);
 
+    public function selectFromDbBySlug(string $slug, string $type, bool $useRelations = false, array $withRelations = []);
+
     public function loadRelationsFromDb(Model $model, bool $recursive = false, array $withRelations = []): void;
 
+    public function loadMultiRelationsFromDb(array $models, string $relation, bool $useRelations = false, array $withRelations = []): void;
+
     public function saveToDb(Model $model): void;
 
     public function deleteFromDb(Model $model): void;

src/Interfaces/Request/IRequest.php

@@ -4,7 +4,7 @@ use SokoWeb\Interfaces\Authentication\IUser;
 
 interface IRequest
 {
-    public function setParsedRouteParams(array &$routeParams): void;
+    public function setParsedRouteParams(array $routeParams): void;
 
     public function getBase(): string;
 

src/PersistentData/Model/Model.php

@@ -8,6 +8,8 @@ abstract class Model
 
     protected static array $relations = [];
 
+    protected static array $multiRelations = [];
+
     protected $id = null;
 
     private array $snapshot = [];
@@ -27,6 +29,11 @@ abstract class Model
         return static::$relations;
     }
 
+    public static function getMultiRelations(): array
+    {
+        return static::$multiRelations;
+    }
+
     public function setId($id): void
     {
         $this->id = $id;
@@ -41,7 +48,7 @@ abstract class Model
     {
         $array = [];
 
-        foreach (self::getFields() as $key) {
+        foreach (static::getFields() as $key) {
             $method = 'get' . str_replace('_', '', ucwords($key, '_'));
 
             if (method_exists($this, $method)) {

src/PersistentData/Model/ModelWithSlug.php

@@ -0,0 +1,32 @@
+<?php namespace SokoWeb\PersistentData\Model;
+
+use Cocur\Slugify\Slugify;
+
+abstract class ModelWithSlug extends Model
+{
+    protected static string $slugSource;
+
+    protected ?string $slug = null;
+
+    public static function getFields(): array
+    {
+        return array_merge(['id', 'slug'], static::$fields);
+    }
+
+    public function setSlug(?string $slug): void
+    {
+        $this->slug = $slug;
+    }
+
+    public function getSlug(): ?string
+    {
+        return $this->slug;
+    }
+
+    public function generateSlug(): string
+    {
+        $slugSourceGetMethod = 'get' . str_replace('_', '', ucwords(static::$slugSource, '_'));
+        $this->slug = Slugify::create()->slugify($this->$slugSourceGetMethod());
+        return $this->slug;
+    }
+}

src/PersistentData/PersistentDataManager.php

@@ -8,9 +8,12 @@ use SokoWeb\Interfaces\Database\IAuditLogger;
 use SokoWeb\Interfaces\Database\IResultSet;
 use SokoWeb\Interfaces\PersistentData\IPersistentDataManager;
 use SokoWeb\PersistentData\Model\Model;
+use SokoWeb\PersistentData\Model\ModelWithSlug;
 
 class PersistentDataManager implements IPersistentDataManager
 {
+    const SLUG_MAX_LENGTH = 255;
+
     private IConnection $dbConnection;
 
     private ?IAuditLogger $auditLogger;
@@ -58,6 +61,14 @@ class PersistentDataManager implements IPersistentDataManager
         return $this->selectFromDb($select, $type, $useRelations, $withRelations);
     }
 
+    public function selectFromDbBySlug(string $slug, string $type, bool $useRelations = false, array $withRelations = [])
+    {
+        $select = new Select($this->dbConnection);
+        $select->where('slug', '=', $slug);
+
+        return $this->selectFromDb($select, $type, $useRelations, $withRelations);
+    }
+
     public function loadRelationsFromDb(Model $model, bool $recursive = false, array $withRelations = []): void
     {
         $relations = $model::getRelations();
@@ -81,6 +92,40 @@ class PersistentDataManager implements IPersistentDataManager
         }
     }
 
+    public function loadMultiRelationsFromDb(array $models, string $relation, bool $useRelations = false, array $withRelations = []): void
+    {
+        if (count($models) === 0) {
+            return;
+        }
+
+        $parentModelType = get_class($models[0]);
+        $relationModelsSetter = 'set' . str_replace('_', '', ucwords($relation, '_'));
+        [$relationModelType, $reverseRelation] = call_user_func([$parentModelType, 'getMultiRelations'])[$relation];
+        $reverseRelationIdGetter = 'get' . str_replace('_', '', ucwords($reverseRelation, '_')) . 'Id';
+
+        $parentModelsById = [];
+        foreach ($models as $model) {
+            $parentModelsById[$model->getId()] = $model;
+        }
+
+        $select = new Select($this->dbConnection);
+        $select->where($reverseRelation . '_id', 'IN', array_keys($parentModelsById));
+
+        $relationsByParentModelId = [];
+        foreach ($this->selectMultipleFromDb($select, $relationModelType, $useRelations, $withRelations) as $relationModel) {
+            $reverseRelationId = $relationModel->$reverseRelationIdGetter();
+            if (!isset($relationsByParentModelId[$reverseRelationId])) {
+                $relationsByParentModelId[$reverseRelationId] = [];
+            }
+            $relationsByParentModelId[$reverseRelationId][] = $relationModel;
+        }
+
+        foreach ($parentModelsById as $parentModelId => $parentModel) {
+            $relationModels = $relationsByParentModelId[$parentModelId] ?? [];
+            $parentModel->$relationModelsSetter($relationModels);
+        }
+    }
+
     public function saveToDb(Model $model): void
     {
         $this->syncRelations($model);
@@ -103,12 +148,21 @@ class PersistentDataManager implements IPersistentDataManager
             }
 
             if (count($modified) > 0) {
+                if ($model instanceof ModelWithSlug && isset($modified['slug'])) {
+                    $diff['slug']['new'] = $modified['slug'] = $this->generateUniqueSlug($model, $modified['slug']);
+                }
+
                 $modify->setId($id);
                 $modify->setDiff($diff);
                 $modify->fill($modified);
                 $modify->save();
             }
         } else {
+            if ($model instanceof ModelWithSlug) {
+                $slug = $model->generateSlug();
+                $modified['slug'] = $this->generateUniqueSlug($model, $slug);
+            }
+
             $modify->fill($modified);
             $modify->save();
 
@@ -129,6 +183,29 @@ class PersistentDataManager implements IPersistentDataManager
         $model->resetSnapshot();
     }
 
+    private function generateUniqueSlug(ModelWithSlug $model, string $notUniqueSlug): string
+    {
+        $numbered = 1;
+
+        do {
+            if ($numbered > 1) {
+                $slug = substr($notUniqueSlug, 0, static::SLUG_MAX_LENGTH - (strlen((string)$numbered) + 1));
+                $slug = $notUniqueSlug . '_' . (string)$numbered;
+            } else {
+                $slug = substr($notUniqueSlug, 0, static::SLUG_MAX_LENGTH);
+            }
+
+            $select = new Select($this->dbConnection, $model::getTable());
+            $select->where('slug', '=', $slug);
+
+            $numbered++;
+        } while ($select->count() != 0);
+
+        $model->setSlug($slug);
+
+        return $slug;
+    }
+
     private function createSelect(Select $select, string $type, bool $useRelations = false, array $withRelations = []): Select
     {
         $table = call_user_func([$type, 'getTable']);
@@ -150,7 +227,7 @@ class PersistentDataManager implements IPersistentDataManager
 
             $columns = array_merge($columns, $this->getRelationColumns($table, $relations, $withRelations));
 
-            $this->leftJoinRelations($select, $table, $relations, $withRelations);
+            $this->leftJoinRelations($select, $table, $table, $relations, $withRelations);
             $select->columns($columns);
         } else {
             $select->columns($columns);
@@ -180,19 +257,19 @@ class PersistentDataManager implements IPersistentDataManager
         return $columns;
     }
 
-    private function leftJoinRelations(Select $select, string $table, array $relations, array $withRelations): void
+    private function leftJoinRelations(Select $select, string $table, string $tableAlias, array $relations, array $withRelations): void
     {
         foreach ($relations as $relation => $relationType) {
             $relationTableAlias = $table . '__' . $relation;
             $relationTable = call_user_func([$relationType, 'getTable']);
             $select->setTableAliases([$relationTableAlias => $relationTable]);
-            $select->leftJoin($relationTableAlias, [$relationTableAlias, 'id'], '=', [$table, $relation . '_id']);
+            $select->leftJoin($relationTableAlias, [$relationTableAlias, 'id'], '=', [$tableAlias, $relation . '_id']);
 
             $relationsOfRelation = call_user_func([$relationType, 'getRelations']);
             if (count($withRelations)) {
                 $relationsOfRelation = array_intersect_key($relationsOfRelation, array_flip($withRelations));
             }
-            $this->leftJoinRelations($select, $relationTable, $relationsOfRelation, $withRelations);
+            $this->leftJoinRelations($select, $relationTable, $relationTableAlias, $relationsOfRelation, $withRelations);
         }
     }
 
@@ -235,7 +312,10 @@ class PersistentDataManager implements IPersistentDataManager
                     $method = 'set' . str_replace('_', '', ucwords($relation, '_'));
                     $model->$method($relationModel);
                 } else {
+                    while (substr($key, 0, strlen($relation . '__')) === $relation . '__') {
                         next($data);
+                        $key = key($data);
+                    }
                 }
 
                 next($relations);

src/Request/Request.php

@@ -17,23 +17,23 @@ class Request implements IRequest
 
     private array $headers;
 
-    private Session $session;
+    private ISession $session;
 
     private ?IUser $user = null;
 
     public function __construct(
         string $base,
-        array &$get,
+        array $get,
-        array &$post,
+        array $post,
         array $headers,
-        array &$session,
+        ISession $session,
         IUserRepository $userRepository)
     {
         $this->base = $base;
-        $this->get = &$get;
+        $this->get = $get;
-        $this->post = &$post;
+        $this->post = $post;
         $this->headers = $headers;
-        $this->session = new Session($session);
+        $this->session = $session;
 
         $userId = $this->session->get('userId');
         if ($userId !== null) {
@@ -41,9 +41,9 @@ class Request implements IRequest
         }
     }
 
-    public function setParsedRouteParams(array &$routeParams): void
+    public function setParsedRouteParams(array $routeParams): void
     {
-        $this->routeParams = &$routeParams;
+        $this->routeParams = $routeParams;
     }
 
     public function getBase(): string

src/Response/HttpResponse.php

@@ -55,6 +55,11 @@ class HttpResponse
 
     public function render(): void
     {
+        $this->handleCors();
+        if ($this->method === 'options') {
+            return;
+        }
+
         $match = $this->routeCollection->match($this->method, $this->parsedUrl['path']);
         if ($match === null) {
             $this->render404();
@@ -94,6 +99,7 @@ class HttpResponse
             $response = call_user_func([$controller, $handler[1]]);
         } catch (Exception $exception) {
             $this->dbConnection->rollback();
+            error_log($exception);
             $this->render500($exception);
             return;
         }
@@ -109,6 +115,56 @@ class HttpResponse
         }
     }
 
+    private function handleCors(): void
+    {
+        $origin = $this->request->header('Origin');
+        if (!$origin) {
+            return;
+        }
+
+        if (isset($this->appConfig['cors']['allow_origins'])) {
+            if (in_array($origin, $this->appConfig['cors']['allow_origins']) || in_array('*', $this->appConfig['cors']['allow_origins'])) {
+                header("Access-Control-Allow-Origin: {$origin}");
+            }
+        }
+
+        if (!empty($this->appConfig['cors']['allow_credentials'])) {
+            header('Access-Control-Allow-Credentials: true');
+        }
+
+        if ($this->method !== 'options') {
+            return;
+        }
+
+        if (isset($this->appConfig['cors']['allow_headers'])) {
+            $headers = explode(',', $this->request->header('Access-Control-Request-Headers'));
+            if (in_array('*', $this->appConfig['cors']['allow_headers'])) {
+                $allow_headers = $headers;
+            } else {
+                $allow_headers = array_intersect($this->appConfig['cors']['allow_headers'], $headers);
+            }
+
+            if (count($allow_headers) > 0) {
+                header('Access-Control-Allow-Headers: ' . join(', ', $allow_headers));
+            }
+        }
+
+        if (isset($this->appConfig['cors']['allow_methods'])) {
+            if (in_array('*', $this->appConfig['cors']['allow_methods'])) {
+                $allow_methods = ['DELETE', 'GET', 'HEAD', 'OPTIONS', 'PATCH', 'POST', 'PUT'];
+            } else {
+                $allow_methods = $this->appConfig['cors']['allow_methods'];
+            }
+
+            if (count($allow_methods) > 0) {
+                header('Access-Control-Allow-Methods: ' . join(', ', $allow_methods));
+            }
+        }
+
+        $max_age = $this->appConfig['cors']['max_age'] ?? 600;
+        header("Access-Control-Max-Age: {$max_age}");
+    }
+
     private function redirectToLogin(): void
     {
         $this->request->session()->set('redirect_after_login', $this->rawUrl);

src/Session/DatabaseSessionHandler.php

@@ -11,13 +11,19 @@ class DatabaseSessionHandler implements ISessionHandler
 {
     private IConnection $dbConnection;
 
+    private string $table;
+
+    private DateTime $shouldBeNewerThan;
+
     private bool $exists = false;
 
     private bool $written = false;
 
-    public function __construct(IConnection $dbConnection)
+    public function __construct(IConnection $dbConnection, string $table, DateTime $shouldBeNewerThan)
     {
         $this->dbConnection = $dbConnection;
+        $this->table = $table;
+        $this->shouldBeNewerThan = $shouldBeNewerThan;
     }
 
     public function open($savePath, $sessionName): bool
@@ -32,24 +38,27 @@ class DatabaseSessionHandler implements ISessionHandler
 
     public function read($id): string
     {
-        $select = new Select($this->dbConnection, 'sessions');
+        $select = new Select($this->dbConnection, $this->table);
-        $select->columns(['data']);
+        $select->columns(['data', 'updated']);
         $select->whereId(substr($id, 0, 32));
 
         $result = $select->execute()->fetch(IResultSet::FETCH_ASSOC);
-
         if ($result === null) {
             return '';
         }
 
         $this->exists = true;
 
+        if (new DateTime($result['updated']) < $this->shouldBeNewerThan) {
+            return '';
+        }
+
         return $result['data'];
     }
 
     public function write($id, $data): bool
     {
-        $modify = new Modify($this->dbConnection, 'sessions');
+        $modify = new Modify($this->dbConnection, $this->table);
 
         if ($this->exists) {
             $modify->setId(substr($id, 0, 32));
@@ -68,7 +77,7 @@ class DatabaseSessionHandler implements ISessionHandler
 
     public function destroy($id): bool
     {
-        $modify = new Modify($this->dbConnection, 'sessions');
+        $modify = new Modify($this->dbConnection, $this->table);
         $modify->setId(substr($id, 0, 32));
         $modify->delete();
 
@@ -77,12 +86,12 @@ class DatabaseSessionHandler implements ISessionHandler
         return true;
     }
 
-    public function gc($maxlifetime): bool
+    public function gc($maxlifetime): int|false
     {
         // empty on purpose
         // old sessions are deleted by MaintainDatabaseCommand
 
-        return true;
+        return 1;
     }
 
     public function create_sid(): string
@@ -101,7 +110,7 @@ class DatabaseSessionHandler implements ISessionHandler
             return true;
         }
 
-        $modify = new Modify($this->dbConnection, 'sessions');
+        $modify = new Modify($this->dbConnection, $this->table);
 
         $modify->setId(substr($id, 0, 32));
         $modify->set('updated', (new DateTime())->format('Y-m-d H:i:s'));

src/View/Linker.php

@@ -97,8 +97,13 @@ class Linker
 
         fwrite($outputFileHandle, $extra[0]);
         while (($line = fgets($inputFileHandle)) !== false) {
+            if (preg_match('/^\s*@include\((.*)\)\s*$/', $line, $matches) === 1) {
+                $include = file_get_contents(ROOT . '/views/' . $matches[1] . '.php');
+                fwrite($outputFileHandle, $include);
+            } else {
                 fwrite($outputFileHandle, $line);
             }
+        }
         fwrite($outputFileHandle, $extra[1]);
 
         fclose($inputFileHandle);
@@ -134,7 +139,7 @@ class Linker
     {
         $output = [];
 
-        if (preg_match('/^[\w\/\.]+$/', $asset) === 1) {
+        if (preg_match('/^http(s)?/', $asset) !== 1) {
             if (
                 empty($_ENV['DEV']) &&
                 filesize(ROOT . '/public/static/' . $asset) < self::INLINE_ASSET_LIMIT

templates/web.php.tpl

@@ -14,7 +14,7 @@ Container::$routeCollection = new SokoWeb\Routing\RouteCollection();
 Container::$routeCollection->get('index', '', [{app}\Controller\HomeController::class, 'getIndex']);
 
 if (isset($_COOKIE['COOKIES_CONSENT'])) {
-    Container::$sessionHandler = new SokoWeb\Session\DatabaseSessionHandler(Container::$dbConnection);
+    Container::$sessionHandler = new SokoWeb\Session\DatabaseSessionHandler(Container::$dbConnection, 'sessions');
 
     session_set_save_handler(Container::$sessionHandler, true);
     session_start([

tests/OAuth/GoogleOAuthTest.php

@@ -17,7 +17,7 @@ final class GoogleOAuthTest extends TestCase
         $redirectUrl = 'http://example.com/oauth';
 
         $requestMock = $this->getMockBuilder(IRequest::class)
-            ->setMethods(['setUrl', 'setMethod', 'setQuery', 'setHeaders', 'send'])
+            ->onlyMethods(['setUrl', 'setMethod', 'setQuery', 'setHeaders', 'send'])
             ->getMock();
         $googleOAuth = new GoogleOAuth($requestMock);
 
@@ -48,10 +48,10 @@ final class GoogleOAuthTest extends TestCase
         $redirectUrl = 'http://example.com/oauth';
 
         $requestMock = $this->getMockBuilder(IRequest::class)
-            ->setMethods(['setUrl', 'setMethod', 'setQuery', 'setHeaders', 'send'])
+            ->onlyMethods(['setUrl', 'setMethod', 'setQuery', 'setHeaders', 'send'])
             ->getMock();
         $responseMock = $this->getMockBuilder(IResponse::class)
-            ->setMethods(['getBody', 'getHeaders'])
+            ->onlyMethods(['getBody', 'getHeaders'])
             ->getMock();
         $googleOAuth = new GoogleOAuth($requestMock);