Merge branch 'main' of github.com:NativePHP/laravel

Author: mpociot

.github/workflows/dependabot-auto-merge.yml

@@ -13,7 +13,7 @@ jobs:
 
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v1.4.0
+        uses: dependabot/fetch-metadata@v1.5.1
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 

.github/workflows/fix-php-code-style-issues.yml

@@ -19,7 +19,7 @@ jobs:
           ref: ${{ github.head_ref }}
 
       - name: Fix PHP code style issues
-        uses: aglipanci/laravel-pint-action@2.2.0
+        uses: aglipanci/laravel-pint-action@2.3.0
 
       - name: Commit changes
         uses: stefanzweifel/git-auto-commit-action@v4

.gitignore

@@ -9,3 +9,4 @@ phpstan.neon
 testbench.yaml
 vendor
 node_modules
+.DS_Store

routes/api.php

@@ -1,6 +1,7 @@
 <?php
 
 use Illuminate\Support\Facades\Route;
+use Native\Laravel\Http\Controllers\CreateSecurityCookieController;
 use Native\Laravel\Http\Controllers\DispatchEventFromAppController;
 use Native\Laravel\Http\Controllers\NativeAppBootedController;
 use Native\Laravel\Http\Middleware\PreventRegularBrowserAccess;
@@ -9,3 +10,5 @@
     Route::post('_native/api/booted', NativeAppBootedController::class);
     Route::post('_native/api/events', DispatchEventFromAppController::class);
 })->withoutMiddleware(\App\Http\Middleware\VerifyCsrfToken::class);
+
+Route::get('_native/api/cookie', CreateSecurityCookieController::class);

src/Http/Controllers/CreateSecurityCookieController.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace Native\Laravel\Http\Controllers;
+
+use Illuminate\Http\Request;
+
+class CreateSecurityCookieController
+{
+    public function __invoke(Request $request)
+    {
+        if ($request->get('secret') !== config('native-php.secret')) {
+            return abort(403);
+        }
+
+        return redirect('/')->cookie(cookie(
+            name: '_php_native',
+            value: config('native-php.secret'),
+            domain: 'localhost',
+            httpOnly: true,
+        ));
+    }
+}

src/Http/Middleware/PreventRegularBrowserAccess.php

@@ -9,6 +9,11 @@ class PreventRegularBrowserAccess
 {
     public function handle(Request $request, Closure $next)
     {
+        // Explicitly skip for the cookie-setting route
+        if ($request->path() === '_native/api/cookie') {
+            return $next($request);
+        }
+
         $cookie = $request->cookie('_php_native');
         $header = $request->header('X-NativePHP-Secret');