create-prisma-php-app 5.1.0-alpha.3 → 5.1.0-alpha.30

package/dist/settings/run-postcss.ts

@@ -0,0 +1,205 @@
+import { execFile, spawn } from "node:child_process";
+import { mkdir, readFile, readFileSync, rm, rmSync, writeFile } from "node:fs";
+import { promisify } from "node:util";
+import { dirname, join } from "node:path";
+import process from "node:process";
+
+const mode: "watch" | "build" = process.argv[2] === "watch" ? "watch" : "build";
+const watcherPidFile = join(process.cwd(), ".pp", "postcss-watch.pid");
+const mkdirAsync = promisify(mkdir);
+const readFileAsync = promisify(readFile);
+const rmAsync = promisify(rm);
+const writeFileAsync = promisify(writeFile);
+
+const args: string[] = [
+  "--max-old-space-size=6144",
+  "./node_modules/postcss-cli/index.js",
+  "src/app/globals.css",
+  "-o",
+  "public/css/styles.css",
+];
+
+if (mode === "watch") {
+  args.push("--watch");
+}
+
+function isValidPid(value: string): boolean {
+  return /^\d+$/.test(value.trim());
+}
+
+function isProcessRunning(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function killWindowsProcessTree(pid: number): Promise<void> {
+  return new Promise((resolve) => {
+    const killer = execFile("taskkill", ["/F", "/T", "/PID", String(pid)], () =>
+      resolve(),
+    );
+
+    killer.on("error", () => resolve());
+  });
+}
+
+async function killProcessTree(pid: number): Promise<void> {
+  if (process.platform === "win32") {
+    await killWindowsProcessTree(pid);
+    return;
+  }
+
+  try {
+    process.kill(pid, "SIGTERM");
+  } catch {
+    return;
+  }
+}
+
+async function ensurePidDirectory(): Promise<void> {
+  await mkdirAsync(dirname(watcherPidFile), { recursive: true });
+}
+
+async function clearPidFile(): Promise<void> {
+  try {
+    const storedPid = (await readFileAsync(watcherPidFile, "utf8")).trim();
+    if (storedPid === String(process.pid)) {
+      await rmAsync(watcherPidFile, { force: true });
+    }
+  } catch {}
+}
+
+function clearPidFileSync(): void {
+  try {
+    const storedPid = readFileSync(watcherPidFile, "utf8").trim();
+    if (storedPid === String(process.pid)) {
+      rmSync(watcherPidFile, { force: true });
+    }
+  } catch {}
+}
+
+async function cleanupStaleWatcher(): Promise<void> {
+  if (mode !== "watch") {
+    return;
+  }
+
+  await ensurePidDirectory();
+
+  let storedPid = "";
+
+  try {
+    storedPid = (await readFileAsync(watcherPidFile, "utf8")).trim();
+  } catch {
+    return;
+  }
+
+  if (!isValidPid(storedPid)) {
+    await rmAsync(watcherPidFile, { force: true });
+    return;
+  }
+
+  const pid = Number(storedPid);
+
+  if (pid === process.pid) {
+    return;
+  }
+
+  if (!isProcessRunning(pid)) {
+    await rmAsync(watcherPidFile, { force: true });
+    return;
+  }
+
+  console.warn(
+    `[tailwind] Found stale PostCSS watcher (PID ${pid}), stopping it before restart.`,
+  );
+  await killProcessTree(pid);
+  await rmAsync(watcherPidFile, { force: true });
+}
+
+async function writePidFile(): Promise<void> {
+  if (mode !== "watch") {
+    return;
+  }
+
+  await ensurePidDirectory();
+  await writeFileAsync(watcherPidFile, `${process.pid}\n`, "utf8");
+}
+
+await cleanupStaleWatcher();
+await writePidFile();
+
+const child = spawn(process.execPath, args, {
+  stdio: "inherit",
+  windowsHide: true,
+  env: {
+    ...process.env,
+    PP_POSTCSS_MODE: mode,
+  },
+});
+
+let shuttingDown = false;
+
+child.on("error", (error) => {
+  console.error(error);
+  void shutdown(1);
+});
+
+async function shutdown(exitCode: number): Promise<void> {
+  if (shuttingDown) {
+    return;
+  }
+
+  shuttingDown = true;
+
+  if (child.pid && child.exitCode === null && !child.killed) {
+    await killProcessTree(child.pid);
+  }
+
+  await clearPidFile();
+  process.exit(exitCode);
+}
+
+child.on("exit", async (code, signal) => {
+  await clearPidFile();
+
+  if (shuttingDown) {
+    process.exit(code ?? 0);
+    return;
+  }
+
+  if (signal) {
+    try {
+      process.kill(process.pid, signal);
+    } catch {
+      process.exit(1);
+    }
+    return;
+  }
+
+  process.exit(code ?? 0);
+});
+
+process.once("SIGINT", () => {
+  void shutdown(0);
+});
+
+process.once("SIGTERM", () => {
+  void shutdown(0);
+});
+
+process.once("uncaughtException", (error) => {
+  console.error(error);
+  void shutdown(1);
+});
+
+process.once("unhandledRejection", (reason) => {
+  console.error(reason);
+  void shutdown(1);
+});
+
+process.once("exit", () => {
+  clearPidFileSync();
+});

package/dist/settings/run-tests.ts

@@ -0,0 +1,35 @@
+import { spawnSync } from "child_process";
+import { existsSync } from "fs";
+import { join } from "path";
+import prismaPhpConfigJson from "../prisma-php.json";
+import { getFileMeta } from "./utils.js";
+
+const { __dirname } = getFileMeta();
+const projectRoot = join(__dirname, "..");
+
+// The PHP binary the project is configured for (prisma-php.json), falling
+// back to whatever `php` resolves to on PATH.
+const phpExe =
+  prismaPhpConfigJson.phpRootPathExe && existsSync(prismaPhpConfigJson.phpRootPathExe)
+    ? prismaPhpConfigJson.phpRootPathExe
+    : "php";
+
+const phpunit = join(projectRoot, "vendor", "phpunit", "phpunit", "phpunit");
+
+if (!existsSync(phpunit)) {
+  console.error(
+    "PHPUnit is not installed. Run: composer install (phpunit/phpunit is a dev dependency).",
+  );
+  process.exit(1);
+}
+
+// Everything after `npm run test --` is handed to PHPUnit, so
+// `npm run test -- --filter CsrfTest` narrows the run.
+const args = [phpunit, "--configuration", join(projectRoot, "phpunit.xml"), ...process.argv.slice(2)];
+
+const result = spawnSync(phpExe, args, {
+  cwd: projectRoot,
+  stdio: "inherit",
+});
+
+process.exit(result.status ?? 1);

package/dist/src/Lib/Auth/Auth.php

@@ -16,6 +16,7 @@ use Exception;
 use InvalidArgumentException;
 use ArrayObject;
 use PP\Env;
+use PP\Security\Csrf;
 
 class Auth
 {
@@ -166,11 +167,15 @@ class Auth
     /**
      * Verifies the JWT token and returns the decoded payload if the token is valid.
      * If the token is invalid or expired, null is returned.
-     * 
-     * @param string $jwt The JWT token to verify.
-     * @return object|null Returns the decoded payload if the token is valid, or null if invalid or expired.
+     *
+     * The payload is whatever `signIn(...)` stored: a scalar such as a role
+     * string, or an object for structured user data — so the return type is
+     * `mixed`, with `null` reserved for an invalid or expired token.
+     *
+     * @param string|null $jwt The JWT token to verify.
+     * @return mixed The decoded payload, or null if invalid or expired.
      */
-    public function verifyToken(?string $jwt): ?object
+    public function verifyToken(?string $jwt): mixed
     {
         try {
             if (!$jwt) return null;
@@ -260,27 +265,9 @@ class Auth
 
     public function rotateCsrfToken(): void
     {
-        $secret = Env::string('FUNCTION_CALL_SECRET', '');
-
-        if ($secret === '') {
-            throw new InvalidArgumentException('FUNCTION_CALL_SECRET is required for CSRF protection.');
-        }
-
-        $nonce = bin2hex(random_bytes(16));
-        $signature = hash_hmac('sha256', $nonce, $secret);
-        $token = $nonce . '.' . $signature;
-
-        if (!headers_sent()) {
-            setcookie('prisma_php_csrf', $token, [
-                'expires'  => time() + 3600, // 1 hour validity
-                'path'     => '/',
-                'secure'   => $this->isHttpsRequest(),
-                'httponly' => false, // Must be FALSE so client JS can read it
-                'samesite' => 'Lax',
-            ]);
-        }
-
-        $_COOKIE['prisma_php_csrf'] = $token;
+        // The PulsePoint runtime reads the `pp_csrf` cookie family; issuing
+        // and naming live in one place so every writer stays aligned.
+        Csrf::rotate();
     }
 
     /**

package/dist/src/Lib/MCP/mcp-server.php

@@ -68,9 +68,8 @@ try {
         $port,
         $prefix,
         null,            // sslContext
-        true,            // logger
-        $enableJson      // enableJsonResponse
-        // , false        // (optional) stateless
+        $enableJson,     // enableJsonResponse
+        false            // stateless
     );
     echo $color("✓ Listening on {$base}", '32') . PHP_EOL;
     $server->listen($transport);