fix(http): properly handle cookies lifecycle (#1416)

Author: innocenzi

packages/http/src/Cookie/CookieManager.php

@@ -7,9 +7,11 @@
 use Tempest\Clock\Clock;
 use Tempest\Core\AppConfig;
 use Tempest\DateTime\DateTimeInterface;
+use Tempest\Support\Str;
 
-use function Tempest\Support\str;
-
+/**
+ * Manages cookies that will be sent to the client.
+ */
 final class CookieManager
 {
     /** @var \Tempest\Http\Cookie\Cookie[] */
@@ -31,12 +33,15 @@ public function get(string $key): ?Cookie
         return $this->cookies[$key] ?? null;
     }
 
+    /**
+     * Adds or updates a cookie that will be sent to the client in this request.
+     */
     public function set(string $key, string $value, DateTimeInterface|int|null $expiresAt = null): Cookie
     {
         $cookie = $this->get($key) ?? new Cookie(
             key: $key,
-            secure: str($this->appConfig->baseUri)->startsWith('https'),
             path: '/',
+            secure: Str\starts_with($this->appConfig->baseUri, 'https'),
             httpOnly: true,
             sameSite: SameSite::LAX,
         );
@@ -49,6 +54,9 @@ public function set(string $key, string $value, DateTimeInterface|int|null $expi
         return $cookie;
     }
 
+    /**
+     * Adds a cookie that will be sent to the client in this request.
+     */
     public function add(Cookie $cookie): void
     {
         if ($cookie->expiresAt !== null) {

packages/http/src/Cookie/CookieManagerInitializer.php

@@ -15,15 +15,9 @@
     #[Singleton]
     public function initialize(Container $container): CookieManager
     {
-        $cookieManager = new CookieManager(
+        return new CookieManager(
             appConfig: $container->get(AppConfig::class),
             clock: $container->get(Clock::class),
         );
-
-        foreach ($_COOKIE as $key => $value) {
-            $cookieManager->add(new Cookie($key, $value));
-        }
-
-        return $cookieManager;
     }
 }

packages/http/src/Input/StdinInputStream.php

@@ -23,7 +23,7 @@ public function parse(): array
             ->mapWithKeys(function (string $item) {
                 $parts = explode('=', $item, 2);
 
-                $key = $parts[0];
+                $key = urldecode($parts[0]);
 
                 $value = $_POST[str_replace('.', '_', $key)] ?? $parts[1] ?? '';
 

packages/http/src/IsRequest.php

@@ -42,10 +42,13 @@ trait IsRequest
     private(set) array $files;
 
     #[SkipValidation]
-    public array $cookies {
-        get => get(CookieManager::class)->all();
+    public Session $session {
+        get => get(Session::class);
     }
 
+    #[SkipValidation]
+    public array $cookies = [];
+
     public function __construct(
         Method $method,
         string $uri,
@@ -88,10 +91,7 @@ public function getSessionValue(string $name): mixed
 
     public function getCookie(string $name): ?Cookie
     {
-        /** @var CookieManager $cookies */
-        $cookies = get(CookieManager::class);
-
-        return $cookies->get($name);
+        return $this->cookies[$name] ?? null;
     }
 
     private function resolvePath(): string

packages/http/src/Mappers/PsrRequestToGenericRequestMapper.php

@@ -6,11 +6,13 @@
 
 use Psr\Http\Message\ServerRequestInterface as PsrRequest;
 use Psr\Http\Message\UploadedFileInterface;
+use Tempest\Http\Cookie\Cookie;
 use Tempest\Http\GenericRequest;
 use Tempest\Http\Method;
 use Tempest\Http\RequestHeaders;
 use Tempest\Http\Upload;
 use Tempest\Mapper\Mapper;
+use Tempest\Support\Arr;
 
 use function Tempest\map;
 use function Tempest\Support\arr;
@@ -53,6 +55,7 @@ public function map(mixed $from, mixed $to): GenericRequest
             'path' => $from->getUri()->getPath(),
             'query' => $query,
             'files' => $uploads,
+            'cookies' => Arr\map_iterable($_COOKIE, static fn (string $value, string $key) => new Cookie($key, $value)),
             ...$data,
             ...$uploads,
         ])

packages/http/src/Session/Config/FileSessionConfig.php

@@ -17,8 +17,6 @@ public function __construct(
         public string $path,
 
         public Duration $expiration,
-
-        public string $sessionIdResolver = CookieSessionIdResolver::class,
     ) {}
 
     public function createManager(Container $container): FileSessionManager

packages/http/src/Session/Resolvers/CookieSessionIdResolver.php

@@ -10,6 +10,7 @@
 use Tempest\Http\Cookie\Cookie;
 use Tempest\Http\Cookie\CookieManager;
 use Tempest\Http\Cookie\SameSite;
+use Tempest\Http\Request;
 use Tempest\Http\Session\SessionConfig;
 use Tempest\Http\Session\SessionId;
 use Tempest\Http\Session\SessionIdResolver;
@@ -20,6 +21,7 @@
 {
     public function __construct(
         private AppConfig $appConfig,
+        private Request $request,
         private CookieManager $cookies,
         private SessionConfig $sessionConfig,
         private Clock $clock,
@@ -32,7 +34,7 @@ public function resolve(): SessionId
             ->append('_session_id')
             ->toString();
 
-        $id = $this->cookies->get($sessionKey)->value ?? null;
+        $id = $this->request->getCookie($sessionKey)?->value;
 
         if (! $id) {
             $id = (string) Uuid::v4();

packages/http/src/Session/Session.php

@@ -11,16 +11,20 @@
 
 final class Session
 {
-    public const string VALIDATION_ERRORS = 'validation_errors';
+    public const string VALIDATION_ERRORS = '#validation_errors';
 
-    public const string ORIGINAL_VALUES = 'original_values';
+    public const string ORIGINAL_VALUES = '#original_values';
 
-    public const string PREVIOUS_URL = '_previous_url';
+    public const string PREVIOUS_URL = '#previous_url';
 
-    public const string CSRF_TOKEN_KEY = '_csrf_token';
+    public const string CSRF_TOKEN_KEY = '#csrf_token';
 
     private array $expiredKeys = [];
 
+    private SessionManager $manager {
+        get => get(SessionManager::class);
+    }
+
     /**
      * Session token used for cross-site request forgery protection.
      */
@@ -43,17 +47,23 @@ public function __construct(
 
     public function set(string $key, mixed $value): void
     {
-        $this->getSessionManager()->set($this->id, $key, $value);
+        $this->manager->set($this->id, $key, $value);
     }
 
+    /**
+     * Stores a value in the session that will be available for the next request only.
+     */
     public function flash(string $key, mixed $value): void
     {
-        $this->getSessionManager()->set($this->id, $key, new FlashValue($value));
+        $this->manager->set($this->id, $key, new FlashValue($value));
     }
 
+    /**
+     * Reflashes all flash values in the session, making them available for the next request.
+     */
     public function reflash(): void
     {
-        foreach ($this->getSessionManager()->all($this->id) as $key => $value) {
+        foreach ($this->manager->all($this->id) as $key => $value) {
             if (! ($value instanceof FlashValue))
                 continue;
 
@@ -63,7 +73,7 @@ public function reflash(): void
 
     public function get(string $key, mixed $default = null): mixed
     {
-        $value = $this->getSessionManager()->get($this->id, $key, $default);
+        $value = $this->manager->get($this->id, $key, $default);
 
         if ($value instanceof FlashValue) {
             $this->expiredKeys[$key] = $key;
@@ -75,14 +85,17 @@ public function get(string $key, mixed $default = null): mixed
 
     public function getPreviousUrl(): string
     {
-        return $this->get(self::PREVIOUS_URL, '');
+        return $this->get(self::PREVIOUS_URL, default: '');
     }
 
     public function setPreviousUrl(string $url): void
     {
         $this->set(self::PREVIOUS_URL, $url);
     }
 
+    /**
+     * Retrieves the value for the given key and removes it from the session.
+     */
     public function consume(string $key, mixed $default = null): mixed
     {
         $value = $this->get($key, $default);
@@ -94,33 +107,28 @@ public function consume(string $key, mixed $default = null): mixed
 
     public function all(): array
     {
-        return $this->getSessionManager()->all($this->id);
+        return $this->manager->all($this->id);
     }
 
     public function remove(string $key): void
     {
-        $this->getSessionManager()->remove($this->id, $key);
+        $this->manager->remove($this->id, $key);
     }
 
     public function destroy(): void
     {
-        $this->getSessionManager()->destroy($this->id);
+        $this->manager->destroy($this->id);
     }
 
     public function isValid(): bool
     {
-        return $this->getSessionManager()->isValid($this->id);
+        return $this->manager->isValid($this->id);
     }
 
     public function cleanup(): void
     {
         foreach ($this->expiredKeys as $key) {
-            $this->getSessionManager()->remove($this->id, $key);
+            $this->manager->remove($this->id, $key);
         }
     }
-
-    private function getSessionManager(): SessionManager
-    {
-        return get(SessionManager::class);
-    }
 }

packages/http/src/Session/SessionConfig.php

@@ -15,14 +15,5 @@ interface SessionConfig
         get;
     }
 
-    /**
-     * Class responsible for resolving the session identifier.
-     *
-     * @var class-string<SessionIdResolver>
-     */
-    public string $sessionIdResolver {
-        get;
-    }
-
     public function createManager(Container $container): SessionManager;
 }

packages/http/src/Session/SessionIdResolverInitializer.php

@@ -4,16 +4,25 @@
 
 namespace Tempest\Http\Session;
 
+use Tempest\Clock\Clock;
 use Tempest\Container\Container;
 use Tempest\Container\Initializer;
+use Tempest\Core\AppConfig;
+use Tempest\Http\Cookie\CookieManager;
+use Tempest\Http\Request;
+use Tempest\Http\Session\Resolvers\CookieSessionIdResolver;
 use Tempest\Http\Session\SessionConfig;
 
 final readonly class SessionIdResolverInitializer implements Initializer
 {
     public function initialize(Container $container): SessionIdResolver
     {
-        $config = $container->get(SessionConfig::class);
-
-        return $container->get($config->sessionIdResolver);
+        return new CookieSessionIdResolver(
+            appConfig: $container->get(AppConfig::class),
+            request: $container->get(Request::class),
+            cookies: $container->get(CookieManager::class),
+            sessionConfig: $container->get(SessionConfig::class),
+            clock: $container->get(Clock::class),
+        );
     }
 }