create-prisma-php-app 5.0.0-alpha.8 → 5.0.1

package/dist/settings/run-postcss.ts

@@ -0,0 +1,205 @@
+import { execFile, spawn } from "node:child_process";
+import { mkdir, readFile, readFileSync, rm, rmSync, writeFile } from "node:fs";
+import { promisify } from "node:util";
+import { dirname, join } from "node:path";
+import process from "node:process";
+
+const mode: "watch" | "build" = process.argv[2] === "watch" ? "watch" : "build";
+const watcherPidFile = join(process.cwd(), ".pp", "postcss-watch.pid");
+const mkdirAsync = promisify(mkdir);
+const readFileAsync = promisify(readFile);
+const rmAsync = promisify(rm);
+const writeFileAsync = promisify(writeFile);
+
+const args: string[] = [
+  "--max-old-space-size=6144",
+  "./node_modules/postcss-cli/index.js",
+  "src/app/globals.css",
+  "-o",
+  "public/css/styles.css",
+];
+
+if (mode === "watch") {
+  args.push("--watch");
+}
+
+function isValidPid(value: string): boolean {
+  return /^\d+$/.test(value.trim());
+}
+
+function isProcessRunning(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function killWindowsProcessTree(pid: number): Promise<void> {
+  return new Promise((resolve) => {
+    const killer = execFile("taskkill", ["/F", "/T", "/PID", String(pid)], () =>
+      resolve(),
+    );
+
+    killer.on("error", () => resolve());
+  });
+}
+
+async function killProcessTree(pid: number): Promise<void> {
+  if (process.platform === "win32") {
+    await killWindowsProcessTree(pid);
+    return;
+  }
+
+  try {
+    process.kill(pid, "SIGTERM");
+  } catch {
+    return;
+  }
+}
+
+async function ensurePidDirectory(): Promise<void> {
+  await mkdirAsync(dirname(watcherPidFile), { recursive: true });
+}
+
+async function clearPidFile(): Promise<void> {
+  try {
+    const storedPid = (await readFileAsync(watcherPidFile, "utf8")).trim();
+    if (storedPid === String(process.pid)) {
+      await rmAsync(watcherPidFile, { force: true });
+    }
+  } catch {}
+}
+
+function clearPidFileSync(): void {
+  try {
+    const storedPid = readFileSync(watcherPidFile, "utf8").trim();
+    if (storedPid === String(process.pid)) {
+      rmSync(watcherPidFile, { force: true });
+    }
+  } catch {}
+}
+
+async function cleanupStaleWatcher(): Promise<void> {
+  if (mode !== "watch") {
+    return;
+  }
+
+  await ensurePidDirectory();
+
+  let storedPid = "";
+
+  try {
+    storedPid = (await readFileAsync(watcherPidFile, "utf8")).trim();
+  } catch {
+    return;
+  }
+
+  if (!isValidPid(storedPid)) {
+    await rmAsync(watcherPidFile, { force: true });
+    return;
+  }
+
+  const pid = Number(storedPid);
+
+  if (pid === process.pid) {
+    return;
+  }
+
+  if (!isProcessRunning(pid)) {
+    await rmAsync(watcherPidFile, { force: true });
+    return;
+  }
+
+  console.warn(
+    `[tailwind] Found stale PostCSS watcher (PID ${pid}), stopping it before restart.`,
+  );
+  await killProcessTree(pid);
+  await rmAsync(watcherPidFile, { force: true });
+}
+
+async function writePidFile(): Promise<void> {
+  if (mode !== "watch") {
+    return;
+  }
+
+  await ensurePidDirectory();
+  await writeFileAsync(watcherPidFile, `${process.pid}\n`, "utf8");
+}
+
+await cleanupStaleWatcher();
+await writePidFile();
+
+const child = spawn(process.execPath, args, {
+  stdio: "inherit",
+  windowsHide: true,
+  env: {
+    ...process.env,
+    PP_POSTCSS_MODE: mode,
+  },
+});
+
+let shuttingDown = false;
+
+child.on("error", (error) => {
+  console.error(error);
+  void shutdown(1);
+});
+
+async function shutdown(exitCode: number): Promise<void> {
+  if (shuttingDown) {
+    return;
+  }
+
+  shuttingDown = true;
+
+  if (child.pid && child.exitCode === null && !child.killed) {
+    await killProcessTree(child.pid);
+  }
+
+  await clearPidFile();
+  process.exit(exitCode);
+}
+
+child.on("exit", async (code, signal) => {
+  await clearPidFile();
+
+  if (shuttingDown) {
+    process.exit(code ?? 0);
+    return;
+  }
+
+  if (signal) {
+    try {
+      process.kill(process.pid, signal);
+    } catch {
+      process.exit(1);
+    }
+    return;
+  }
+
+  process.exit(code ?? 0);
+});
+
+process.once("SIGINT", () => {
+  void shutdown(0);
+});
+
+process.once("SIGTERM", () => {
+  void shutdown(0);
+});
+
+process.once("uncaughtException", (error) => {
+  console.error(error);
+  void shutdown(1);
+});
+
+process.once("unhandledRejection", (reason) => {
+  console.error(reason);
+  void shutdown(1);
+});
+
+process.once("exit", () => {
+  clearPidFileSync();
+});

package/dist/settings/run-tests.ts

@@ -0,0 +1,35 @@
+import { spawnSync } from "child_process";
+import { existsSync } from "fs";
+import { join } from "path";
+import prismaPhpConfigJson from "../prisma-php.json";
+import { getFileMeta } from "./utils.js";
+
+const { __dirname } = getFileMeta();
+const projectRoot = join(__dirname, "..");
+
+// The PHP binary the project is configured for (prisma-php.json), falling
+// back to whatever `php` resolves to on PATH.
+const phpExe =
+  prismaPhpConfigJson.phpRootPathExe && existsSync(prismaPhpConfigJson.phpRootPathExe)
+    ? prismaPhpConfigJson.phpRootPathExe
+    : "php";
+
+const phpunit = join(projectRoot, "vendor", "phpunit", "phpunit", "phpunit");
+
+if (!existsSync(phpunit)) {
+  console.error(
+    "PHPUnit is not installed. Run: composer install (phpunit/phpunit is a dev dependency).",
+  );
+  process.exit(1);
+}
+
+// Everything after `npm run test --` is handed to PHPUnit, so
+// `npm run test -- --filter CsrfTest` narrows the run.
+const args = [phpunit, "--configuration", join(projectRoot, "phpunit.xml"), ...process.argv.slice(2)];
+
+const result = spawnSync(phpExe, args, {
+  cwd: projectRoot,
+  stdio: "inherit",
+});
+
+process.exit(result.status ?? 1);

package/dist/settings/swagger-config.ts

@@ -11,7 +11,7 @@ const { __dirname } = getFileMeta();
 export async function swaggerConfig(): Promise<void> {
   const outputPath = join(
     __dirname,
-    "../src/app/swagger-docs/apis/pp-swagger.json"
+    "../src/app/swagger-docs/apis/pp-swagger.json",
   );
 
   const options = {
@@ -56,8 +56,8 @@ export async function swaggerConfig(): Promise<void> {
     writeFileSync(outputPath, swaggerSpec, "utf-8");
     console.log(
       `Swagger JSON has been generated and saved to ${chalk.blue(
-        "src/app/swagger-docs/apis/pp-swagger.json"
-      )}`
+        "src/app/swagger-docs/apis/pp-swagger.json",
+      )}`,
     );
   } catch (error) {
     console.error("Error saving Swagger JSON:", error);

package/dist/settings/utils.ts

@@ -40,7 +40,7 @@ export function createSrcWatcher(
     logPrefix?: string;
     usePolling?: boolean;
     interval?: number;
-  }
+  },
 ): FSWatcher {
   const {
     exts,
@@ -87,7 +87,7 @@ export class DebouncedWorker {
   constructor(
     private work: () => Promise<void> | void,
     private debounceMs = 350,
-    private name = "worker"
+    private name = "worker",
   ) {}
 
   schedule(reason?: string) {
@@ -172,7 +172,7 @@ export function createRestartableProcess(spec: {
   function killOnWindows(pid: number): Promise<void> {
     return new Promise((resolve) => {
       const cp = execFile("taskkill", ["/F", "/T", "/PID", String(pid)], () =>
-        resolve()
+        resolve(),
       );
       cp.on("error", () => resolve());
     });

package/dist/src/Lib/Auth/Auth.php

@@ -16,12 +16,14 @@ use Exception;
 use InvalidArgumentException;
 use ArrayObject;
 use PP\Env;
+use PP\Security\Csrf;
 
 class Auth
 {
     public const PAYLOAD_NAME = 'payload_name_8639D';
     public const ROLE_NAME = 'role';
     public const PAYLOAD_SESSION_KEY = 'payload_session_key_2183A';
+    private const OAUTH_STATE_SESSION_KEY = 'oauth_state_61e4a';
 
     public static string $cookieName = '';
 
@@ -32,7 +34,10 @@ class Auth
 
     private function __construct()
     {
-        $this->secretKey = Env::string('AUTH_SECRET', 'CD24eEv4qbsC5LOzqeaWbcr58mBMSvA4Mkii8GjRiHkt');
+        $this->secretKey = Env::string('AUTH_SECRET', '');
+        if ($this->secretKey === '') {
+            throw new InvalidArgumentException('AUTH_SECRET is required for authentication.');
+        }
         self::$cookieName = self::getCookieName();
     }
 
@@ -162,11 +167,15 @@ class Auth
     /**
      * Verifies the JWT token and returns the decoded payload if the token is valid.
      * If the token is invalid or expired, null is returned.
-     * 
-     * @param string $jwt The JWT token to verify.
-     * @return object|null Returns the decoded payload if the token is valid, or null if invalid or expired.
+     *
+     * The payload is whatever `signIn(...)` stored: a scalar such as a role
+     * string, or an object for structured user data — so the return type is
+     * `mixed`, with `null` reserved for an invalid or expired token.
+     *
+     * @param string|null $jwt The JWT token to verify.
+     * @return mixed The decoded payload, or null if invalid or expired.
      */
-    public function verifyToken(?string $jwt): ?object
+    public function verifyToken(?string $jwt): mixed
     {
         try {
             if (!$jwt) return null;
@@ -256,27 +265,9 @@ class Auth
 
     public function rotateCsrfToken(): void
     {
-        $secret = Env::string('FUNCTION_CALL_SECRET', '');
-
-        if (empty($secret)) {
-            return;
-        }
-
-        $nonce = bin2hex(random_bytes(16));
-        $signature = hash_hmac('sha256', $nonce, $secret);
-        $token = $nonce . '.' . $signature;
-
-        if (!headers_sent()) {
-            setcookie('prisma_php_csrf', $token, [
-                'expires'  => time() + 3600, // 1 hour validity
-                'path'     => '/',
-                'secure'   => $this->isHttpsRequest(),
-                'httponly' => false, // Must be FALSE so client JS can read it
-                'samesite' => 'Lax',
-            ]);
-        }
-
-        $_COOKIE['prisma_php_csrf'] = $token;
+        // The PulsePoint runtime reads the `pp_csrf` cookie family; issuing
+        // and naming live in one place so every writer stays aligned.
+        Csrf::rotate();
     }
 
     /**
@@ -386,26 +377,34 @@ class Auth
     {
         $dynamicRouteParams = Request::$dynamicParams[self::PPAUTH] ?? [];
 
-        if (Request::$isGet && in_array('signin', $dynamicRouteParams)) {
+        if (Request::$isGet && in_array('signin', $dynamicRouteParams, true)) {
             foreach ($providers as $provider) {
-                if ($provider instanceof GithubProvider && in_array('github', $dynamicRouteParams)) {
-                    $githubAuthUrl = "https://github.com/login/oauth/authorize?scope=user:email%20read:user&client_id={$provider->clientId}";
+                if ($provider instanceof GithubProvider && in_array('github', $dynamicRouteParams, true)) {
+                    $state = $this->createOAuthState('github');
+                    $githubAuthUrl = "https://github.com/login/oauth/authorize?scope=user:email%20read:user&client_id={$provider->clientId}&state=" . urlencode($state);
                     Request::redirect($githubAuthUrl);
-                } elseif ($provider instanceof GoogleProvider && in_array('google', $dynamicRouteParams)) {
+                } elseif ($provider instanceof GoogleProvider && in_array('google', $dynamicRouteParams, true)) {
+                    $state = $this->createOAuthState('google');
                     $googleAuthUrl = "https://accounts.google.com/o/oauth2/v2/auth?"
                         . "scope=" . urlencode('email profile') . "&"
                         . "response_type=code&"
                         . "client_id=" . urlencode($provider->clientId) . "&"
-                        . "redirect_uri=" . urlencode($provider->redirectUri);
+                        . "redirect_uri=" . urlencode($provider->redirectUri) . "&"
+                        . "state=" . urlencode($state);
                     Request::redirect($googleAuthUrl);
                 }
             }
         }
 
         $authCode = Validator::string($_GET['code'] ?? '');
+        $authState = Validator::string($_GET['state'] ?? '', false);
+
+        if (Request::$isGet && in_array('callback', $dynamicRouteParams, true) && $authCode !== '') {
+            if (in_array('github', $dynamicRouteParams, true)) {
+                if (!$this->consumeOAuthState('github', $authState)) {
+                    exit("Error occurred. Please try again.");
+                }
 
-        if (Request::$isGet && in_array('callback', $dynamicRouteParams) && isset($authCode)) {
-            if (in_array('github', $dynamicRouteParams)) {
                 $provider = $this->findProvider($providers, GithubProvider::class);
 
                 if (!$provider) {
@@ -413,7 +412,11 @@ class Auth
                 }
 
                 return $this->githubProvider($provider, $authCode);
-            } elseif (in_array('google', $dynamicRouteParams)) {
+            } elseif (in_array('google', $dynamicRouteParams, true)) {
+                if (!$this->consumeOAuthState('google', $authState)) {
+                    exit("Error occurred. Please try again.");
+                }
+
                 $provider = $this->findProvider($providers, GoogleProvider::class);
 
                 if (!$provider) {
@@ -554,6 +557,31 @@ class Auth
         }
     }
 
+    private function createOAuthState(string $provider): string
+    {
+        $state = bin2hex(random_bytes(16));
+        $_SESSION[self::OAUTH_STATE_SESSION_KEY][$provider] = $state;
+
+        return $state;
+    }
+
+    private function consumeOAuthState(string $provider, string $state): bool
+    {
+        $expectedState = $_SESSION[self::OAUTH_STATE_SESSION_KEY][$provider] ?? '';
+
+        if (!is_string($expectedState) || $expectedState === '' || $state === '' || !hash_equals($expectedState, $state)) {
+            return false;
+        }
+
+        unset($_SESSION[self::OAUTH_STATE_SESSION_KEY][$provider]);
+
+        if (empty($_SESSION[self::OAUTH_STATE_SESSION_KEY])) {
+            unset($_SESSION[self::OAUTH_STATE_SESSION_KEY]);
+        }
+
+        return true;
+    }
+
     private static function getCookieName(): string
     {
         $authCookieName = Env::string('AUTH_COOKIE_NAME', 'auth_cookie_name_d36e5');

package/dist/src/Lib/MCP/mcp-server.php

@@ -68,9 +68,8 @@ try {
         $port,
         $prefix,
         null,            // sslContext
-        true,            // logger
-        $enableJson      // enableJsonResponse
-        // , false        // (optional) stateless
+        $enableJson,     // enableJsonResponse
+        false            // stateless
     );
     echo $color("✓ Listening on {$base}", '32') . PHP_EOL;
     $server->listen($transport);

package/dist/src/Lib/Middleware/CorsMiddleware.php

@@ -16,6 +16,11 @@ final class CorsMiddleware
         }
 
         $cfg = self::buildConfig($overrides);
+        $cfg = self::allowImplicitLoopbackOrigin($origin, $cfg);
+
+        if ($cfg['allowCredentials'] && self::listHasWildcard($cfg['allowedOrigins'])) {
+            return;
+        }
 
         if (!self::isAllowedOrigin($origin, $cfg['allowedOrigins'])) {
             return;
@@ -82,6 +87,20 @@ final class CorsMiddleware
         return $cfg;
     }
 
+    private static function allowImplicitLoopbackOrigin(string $origin, array $cfg): array
+    {
+        if ($cfg['allowedOrigins'] !== []) {
+            return $cfg;
+        }
+
+        if (!self::isImplicitLoopbackOrigin($origin)) {
+            return $cfg;
+        }
+
+        $cfg['allowedOrigins'] = [self::normalize($origin)];
+        return $cfg;
+    }
+
     private static function parseList(string $raw): array
     {
         $raw = trim($raw);
@@ -101,6 +120,59 @@ final class CorsMiddleware
         return rtrim($origin, '/');
     }
 
+    private static function isImplicitLoopbackOrigin(string $origin): bool
+    {
+        $originParts = parse_url(self::normalize($origin));
+        if (!is_array($originParts)) {
+            return false;
+        }
+
+        $originHost = strtolower((string) ($originParts['host'] ?? ''));
+        $originScheme = strtolower((string) ($originParts['scheme'] ?? ''));
+        $requestHost = self::getRequestHost();
+        $requestScheme = self::isHttpsRequest() ? 'https' : 'http';
+
+        if (
+            $originHost === '' ||
+            $requestHost === '' ||
+            $originHost !== $requestHost ||
+            $originScheme !== $requestScheme
+        ) {
+            return false;
+        }
+
+        return self::isLoopbackHost($originHost);
+    }
+
+    private static function getRequestHost(): string
+    {
+        $host = (string) ($_SERVER['HTTP_HOST'] ?? $_SERVER['SERVER_NAME'] ?? '');
+        if ($host === '') {
+            return '';
+        }
+
+        $parts = parse_url('http://' . $host);
+        if (is_array($parts) && isset($parts['host'])) {
+            return strtolower((string) $parts['host']);
+        }
+
+        return strtolower(explode(':', $host, 2)[0]);
+    }
+
+    private static function isLoopbackHost(string $host): bool
+    {
+        return in_array(trim(strtolower($host), '[]'), ['localhost', '127.0.0.1', '::1'], true);
+    }
+
+    private static function isHttpsRequest(): bool
+    {
+        return (
+            (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ||
+            (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') ||
+            (isset($_SERVER['SERVER_PORT']) && (int) $_SERVER['SERVER_PORT'] === 443)
+        );
+    }
+
     private static function isAllowedOrigin(string $origin, array $list): bool
     {
         $o = self::normalize($origin);