Merge pull request #286 from dotkernel/develop

Develop

Author: bidi47

composer.json

@@ -29,6 +29,7 @@
         "php": "~8.5.0",
         "ext-curl": "*",
         "ext-dom": "*",
+        "akrabat/ip-address-middleware": "^2.6",
         "doctrine/data-fixtures": "^2.2",
         "doctrine/doctrine-fixtures-bundle": "^4.3",
         "dotkernel/dot-cache": "^4.0",

config/autoload/ip-address.global.php

@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+// @see https://github.com/akrabat/ip-address-middleware/blob/main/src/IpAddress.php
+return [
+    'rka' => [
+        'ip_address' => [
+            // Inspect proxy headers below instead of using REMOTE_ADDR only.
+            'check_proxy_headers' => true,
+            // Proxy IPs/CIDRs/wildcards trusted to set the headers below.
+            'trusted_proxies' => [],
+            // Request attribute the resolved IP is stored under.
+            'attribute_name' => 'ipAddress',
+            // Headers checked, in order, for the client IP.
+            'headers_to_inspect' => [
+                // nginx specific
+                'X-Real-IP',
+                'X-Forwarded-For',
+                // cloudflare specific
+                'CF-Connecting-IP',
+                'True-Client-IP',
+                // generic
+                'Forwarded',
+                'X-Forwarded',
+                'X-Cluster-Client-Ip',
+                'Client-Ip',
+            ],
+        ],
+    ],
+];

config/config.php

@@ -23,6 +23,7 @@
     \Mezzio\Router\ConfigProvider::class,
     \Mezzio\Router\FastRouteRouter\ConfigProvider::class,
     \Mezzio\Twig\ConfigProvider::class,
+    \RKA\Middleware\Mezzio\ConfigProvider::class,
 
     // Dotkernel packages
     \Dot\DependencyInjection\ConfigProvider::class,

src/App/src/Handler/PostCreateContactHandler.php

@@ -18,17 +18,30 @@
 use function is_array;
 use function is_string;
 
+/**
+ * @phpstan-type IpAddressConfigType array{
+ *      check_proxy_headers: bool,
+ *      trusted_proxies: array<non-empty-string>,
+ *      attribute_name: non-empty-string,
+ *      headers_to_inspect: array<non-empty-string>,
+ * }
+ */
 class PostCreateContactHandler implements RequestHandlerInterface
 {
+    /**
+     * @param IpAddressConfigType $ipAddressConfig
+     */
     #[Inject(
         TemplateRendererInterface::class,
         UrlHelper::class,
         ContactService::class,
+        'config.rka.ip_address',
     )]
     public function __construct(
         protected TemplateRendererInterface $template,
         protected UrlHelper $urlHelper,
         protected ContactService $contactService,
+        protected array $ipAddressConfig,
     ) {
     }
 
@@ -42,13 +55,13 @@ public function handle(ServerRequestInterface $request): ResponseInterface
         $token   = is_array($rawBody) && is_string($rawBody['cf-turnstile-response'] ?? null)
             ? $rawBody['cf-turnstile-response']
             : '';
-        $ip      = $request->getServerParams()['REMOTE_ADDR'] ?? null;
+        $ip      = (string) $request->getAttribute($this->ipAddressConfig['attribute_name']);
 
-        if (! $this->contactService->verifyTurnstile($token, is_string($ip) ? $ip : null)) {
+        if (! $this->contactService->verifyTurnstile($token, $ip)) {
             $errors['captcha'] = "We couldn't verify you're human. Please try again.";
         }
 
-        if ($errors === [] && ! $this->contactService->send($data)) {
+        if ($errors === [] && ! $this->contactService->send($data, $ip)) {
             $mailFailed = true;
         }
 

src/App/src/RoutesDelegator.php

@@ -13,6 +13,7 @@
 use Light\App\Handler\PostCreateContactHandler;
 use Mezzio\Application;
 use Psr\Container\ContainerInterface;
+use RKA\Middleware\IpAddress;
 
 use function assert;
 
@@ -28,7 +29,7 @@ public function __invoke(ContainerInterface $container, string $serviceName, cal
         $app->get('/{categorySlug}/{slug}.md', [GetMarkdownArticleHandler::class], 'app::markdown-article');
 
         $app->get('/contact/', [GetCreateContactFormHandler::class], 'app::create-contact-form');
-        $app->post('/contact/', [PostCreateContactHandler::class], 'app::create-contact');
+        $app->post('/contact/', [IpAddress::class, PostCreateContactHandler::class], 'app::create-contact');
 
         // Route name kept as `page::…` because `@layout/default.html.twig` links it by name.
         // The matching entry must stay out of `routes.page` in local.php to avoid a duplicate.

src/App/src/Service/ContactService.php

@@ -79,7 +79,7 @@ public function turnstileSiteKey(): string
         return $this->turnstile['secret_key'] !== '' ? $this->turnstile['site_key'] : '';
     }
 
-    public function verifyTurnstile(string $token, ?string $remoteIp): bool
+    public function verifyTurnstile(string $token, string $remoteIp): bool
     {
         if ($this->turnstileSiteKey() === '') {
             return true;
@@ -93,7 +93,7 @@ public function verifyTurnstile(string $token, ?string $remoteIp): bool
             'secret'   => $this->turnstile['secret_key'],
             'response' => $token,
         ];
-        if ($remoteIp) {
+        if ($remoteIp !== '') {
             $data['remoteip'] = $remoteIp;
         }
 
@@ -176,11 +176,11 @@ public function validate(array $data): array
     /**
      * @param ContactData $data
      */
-    public function send(array $data): bool
+    public function send(array $data, string $ipAddress = ''): bool
     {
         $this->mailService->getMessage()->setReplyTo($data['email'], $data['name']);
         $this->mailService->setSubject('New contact form submission on dotkernel.com');
-        $this->mailService->setBody($this->buildBody($data));
+        $this->mailService->setBody($this->buildBody($data, $ipAddress));
 
         try {
             $result = $this->mailService->send();
@@ -237,7 +237,7 @@ private function stringValue(array $raw, string $key): string
     /**
      * @param ContactData $data
      */
-    private function buildBody(array $data): string
+    private function buildBody(array $data, string $ipAddress): string
     {
         $rows = [
             'Topic'         => ContactTopicEnum::tryFrom($data['topic'])?->label() ?? '',
@@ -247,6 +247,7 @@ private function buildBody(array $data): string
             'Current stack' => $data['stack'],
             'Message'       => $data['message'],
             'Query params'  => $data['query'],
+            'IP address'    => $ipAddress,
         ];
 
         $html = '';

src/Blog/src/Entity/Category.php

@@ -58,6 +58,14 @@ public function setSlug(string $slug): void
         $this->slug = $slug;
     }
 
+    /**
+     * Visibility only controls the category sidebar widget (and the 404/410 pages, post, tag, author
+     * and page views that render it), via CategoryRepository::getCategories().
+     *
+     * It does not hide a category that has published posts: those are still listed on /categories/
+     * and in the sitemap (CategoryRepository::getCategoriesWithPublishedPosts()), and their
+     * /category/{slug}/ page is served.
+     */
     public function isVisible(): bool
     {
         return $this->isVisible;

src/Blog/src/Handler/GetCategoryCollectionHandler.php

@@ -21,7 +21,7 @@ public function __construct(
 
     public function handle(ServerRequestInterface $request): ResponseInterface
     {
-        $categories = $this->categoryRepository->getCategories();
+        $categories = $this->categoryRepository->getCategoriesWithPublishedPosts();
 
         return new HtmlResponse(
             $this->template->render('page::categories', [

src/Blog/src/Handler/GetCategoryResourceHandler.php

@@ -31,7 +31,7 @@ public function handle(ServerRequestInterface $request): ResponseInterface
         if ($category === null) {
             return $this->blogService->notFound($categories);
         }
-        if (! $category->isVisible()) {
+        if ($category->getPublishedPostsCount() === 0) {
             return $this->blogService->gone($categories);
         }
         $meta = $category;

src/Blog/src/Repository/CategoryRepository.php

@@ -42,9 +42,7 @@ public function getCategoriesWithPublishedPosts(): array
             ->from(Category::class, 'categories');
 
         $qb->where($qb->expr()->in('categories.id', $publishedCategoryIds->getDQL()))
-            ->andWhere('categories.isVisible = :visible')
-            ->setParameter('published', PostStatusEnum::Published)
-            ->setParameter('visible', true);
+            ->setParameter('published', PostStatusEnum::Published);
 
         return $qb->getQuery()->getResult();
     }