blitz-php / framework

src/Middlewares/EncryptCookies.php

<?php

/**
 * This file is part of Blitz PHP framework.
 *
 * (c) 2022 Dimitri Sitchet Tomkeu <devcode.dst@gmail.com>
 *
 * For the full copyright and license information, please view
 * the LICENSE file that was distributed with this source code.
 */

namespace BlitzPHP\Middlewares;

use BlitzPHP\Contracts\Security\EncrypterInterface;
use BlitzPHP\Contracts\Session\CookieInterface;
use BlitzPHP\Contracts\Session\CookieManagerInterface;
use BlitzPHP\Http\Request;
use BlitzPHP\Http\Response;
use BlitzPHP\Session\Cookie\CookieCollection;
use BlitzPHP\Session\Cookie\CookieValuePrefix;
use Exception;
use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;

class EncryptCookies implements MiddlewareInterface
{
    /**
     * Les noms des cookies qui ne doivent pas être cryptés.
     *
     * @var list<string>

The type BlitzPHP\Middlewares\list was not found. Maybe you did not declare it correctly or list all dependencies?

     */
    protected array $except = [];

    /**
     * Indique si les cookies doivent être sérialisés.
     */
    protected static bool $serialize = false;

    /**
     * Créez une nouvelle instance CookieGuard.
     */
    public function __construct(protected EncrypterInterface $encrypter, protected CookieManagerInterface $cookieManager)
    {
    }

    /**
     * Désactivez le cryptage pour le(s) nom(s) de cookie donné(s).
     */
    public function disableFor(array|string $name): void
    {
        $this->except = array_merge($this->except, (array) $name);

It seems like array_merge($this->except, (array)$name) of type array is incompatible with the declared type BlitzPHP\Middlewares\list of property $except.

    }

    /**
     * @param Request $request
     */
    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
    {
        return $this->encrypt($handler->handle($this->decrypt($request)));
    }

    /**
     * Décryptez les cookies sur requete.
     */
    protected function decrypt(Request $request): Request
    {
        $cookies = new CookieCollection();

        foreach ($request->getCookieParams() as $name => $cookie) {
            if ($this->isDisabled($name)) {
                continue;
            }

            try {
                $value = $this->decryptCookie($name, $cookie);
                $value = $this->validateValue($name, $value);
                $cookies->add($this->cookieManager->make($name, $value));
            } catch (Exception) {

Consider adding a comment why this CATCH block is empty.

            }
        }

        return $request->withCookieCollection($cookies);
    }

    /**
     * Validez et supprimez le préfixe de valeur du cookie de la valeur.
     *
     * @return array|string|null
     */
    protected function validateValue(string $key, array|string $value)
    {
        return is_array($value)

The condition is_array($value) is always true.

                    ? $this->validateArray($key, $value)
                    : CookieValuePrefix::validate($key, $value, $this->encrypter->getKey());
    }

    /**
     * Validez et supprimez le préfixe de valeur du cookie de toutes les valeurs d'un tableau.
     */
    protected function validateArray(string $key, array $value): array
    {
        $validated = [];

        foreach ($value as $index => $subValue) {
            $validated[$index] = $this->validateValue("{$key}[{$index}]", $subValue);
        }

        return $validated;
    }

    /**
     * Décryptez le cookie donné et renvoyez la valeur.
     */
    protected function decryptCookie(string $name, array|string $cookie): array|string

The parameter $name is not used and could be removed.

    {
        return is_array($cookie)

The condition is_array($cookie) is always true.

                        ? $this->decryptArray($cookie)
                        : $this->encrypter->decrypt($cookie);
    }

    /**
     * Décryptez un cookie basé sur un tableau.
     */
    protected function decryptArray(array $cookie): array
    {
        $decrypted = [];

        foreach ($cookie as $key => $value) {
            if (is_string($value)) {
                $decrypted[$key] = $this->encrypter->decrypt($value);
            }

            if (is_array($value)) {
                $decrypted[$key] = $this->decryptArray($value);
            }
        }

        return $decrypted;
    }

    /**
     * Chiffrez les cookies sur une réponse sortante.
     *
     * @param Response $response
     */
    protected function encrypt(ResponseInterface $response): Response
    {
        foreach ($response->getCookieCollection() as $cookie) {

The method getCookieCollection() does not exist on Psr\Http\Message\ResponseInterface. It seems like you code against a sub-type of Psr\Http\Message\ResponseInterface such as BlitzPHP\Http\Response.

            if ($this->isDisabled($cookie->getName())) {
                continue;
            }

            $response = $response->withCookie($this->duplicate(

The method withCookie() does not exist on Psr\Http\Message\ResponseInterface. It seems like you code against a sub-type of Psr\Http\Message\ResponseInterface such as BlitzPHP\Http\Response.

                $cookie,
                $this->encrypter->encrypt(
                    CookieValuePrefix::create($cookie->getName(), $this->encrypter->getKey()) . $cookie->getValue(),
                )
            ));
        }

        return $response;
    }

    /**
     * Dupliquez un cookie avec une nouvelle valeur.
     */
    protected function duplicate(CookieInterface $cookie, mixed $value): CookieInterface
    {
        return $cookie->withValue($value);
    }

    /**
     * Déterminez si le cryptage a été désactivé pour le cookie donné.
     */
    public function isDisabled(string $name): bool
    {
        return in_array($name, $this->except, true);
    }

    /**
     * Déterminez si le contenu du cookie doit être sérialisé.
     */
    public static function serialized(string $name): bool

The parameter $name is not used and could be removed.

    {
        return static::$serialize;
    }
}