3405c1e2cc
Only SameSite=Lax protected the acknowledge and zone save/delete endpoints, even though a Csrf helper and mintable token already existed. Add GET /api/csrf (CsrfController::token) to mint/return a per-session token, check it (auth -> rbac -> csrf -> mutate) in EventDetailController::acknowledge and ZoneConfigController::save/delete, and wire app.js/zone-draw.js to fetch the token on load and send it as X-Csrf-Token on every POST.
65 lines
3.1 KiB
PHP
65 lines
3.1 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
require __DIR__ . '/../vendor/autoload.php';
|
|
|
|
use App\Config;
|
|
use App\Http\{Request, Router, Response};
|
|
use App\Db\Database;
|
|
use App\Auth\PhpSessionStore;
|
|
use App\Repository\Pdo\{PdoDeviceRepository, PdoNonceRepository, PdoRateLimiterRepository,
|
|
PdoEventRepository, PdoSnapshotRepository, PdoUserRepository, PdoZoneRepository,
|
|
PdoThresholdRepository, PdoAuditRepository};
|
|
use App\Ingest\IngestController;
|
|
use App\Api\{ConfigController, HeartbeatController};
|
|
use App\Auth\{AuthController, CsrfController};
|
|
use App\Dashboard\{EventListController, EventDetailController, SnapshotProxy, ZoneConfigController};
|
|
|
|
$cfg = Config::fromArray(require __DIR__ . '/../config.php');
|
|
$pdo = Database::connect($cfg);
|
|
$sess = new PhpSessionStore();
|
|
$now = time();
|
|
|
|
$devices = new PdoDeviceRepository($pdo);
|
|
$nonces = new PdoNonceRepository($pdo);
|
|
$rate = new PdoRateLimiterRepository($pdo);
|
|
$events = new PdoEventRepository($pdo);
|
|
$snaps = new PdoSnapshotRepository($pdo, $cfg->snapshotDir());
|
|
$users = new PdoUserRepository($pdo);
|
|
$zones = new PdoZoneRepository($pdo);
|
|
$thr = new PdoThresholdRepository($pdo);
|
|
$audit = new PdoAuditRepository($pdo);
|
|
|
|
$ingest = new IngestController($cfg, $devices, $nonces, $rate, $events, $snaps);
|
|
$config = new ConfigController($devices, $zones, $thr);
|
|
$heartbeat = new HeartbeatController($cfg, $devices);
|
|
$auth = new AuthController($users, $audit, $rate);
|
|
$csrfCtl = new CsrfController();
|
|
$list = new EventListController($events, $sess);
|
|
$detail = new EventDetailController($events, $snaps, $audit, $sess);
|
|
$proxy = new SnapshotProxy($snaps, $sess);
|
|
$zoneCtl = new ZoneConfigController($zones, $audit, $sess);
|
|
|
|
$render = function (string $view): Response {
|
|
ob_start(); require __DIR__ . '/../src/View/' . $view . '.php';
|
|
return Response::text((string)ob_get_clean());
|
|
};
|
|
|
|
$r = new Router();
|
|
$r->add('POST', '/api/events', fn(Request $q) => $ingest->handle($q, $now, (string)($_SERVER['REMOTE_ADDR'] ?? '')));
|
|
$r->add('POST', '/api/heartbeat', fn(Request $q) => $heartbeat->post($q, $now));
|
|
$r->add('GET', '/api/config', fn(Request $q) => $config->get($q));
|
|
$r->add('GET', '/api/csrf', fn(Request $q) => $csrfCtl->token($q, $sess));
|
|
$r->add('POST', '/login', fn(Request $q) => $auth->login($q, $sess, $now, (string)($_SERVER['REMOTE_ADDR'] ?? '')));
|
|
$r->add('POST', '/logout', fn(Request $q) => $auth->logout($sess));
|
|
$r->add('GET', '/api/events', fn(Request $q) => $list->json($q));
|
|
$r->add('GET', '/events/{id}', fn(Request $q, array $p) => $detail->show($q, $p));
|
|
$r->add('POST', '/events/{id}/ack', fn(Request $q, array $p) => $detail->acknowledge($q, $p));
|
|
$r->add('GET', '/api/zones/{camera}', fn(Request $q, array $p) => $zoneCtl->list($q, $p));
|
|
$r->add('POST', '/api/zones', fn(Request $q) => $zoneCtl->save($q));
|
|
$r->add('POST', '/api/zones/{id}/delete', fn(Request $q, array $p) => $zoneCtl->delete($q, $p));
|
|
$r->add('GET', '/snap/{uuid}', fn(Request $q, array $p) => $proxy->serve($q, $p));
|
|
$r->add('GET', '/', fn() => $render('events'));
|
|
$r->add('GET', '/login', fn() => $render('login'));
|
|
$r->add('GET', '/zones', fn() => $render('zones'));
|
|
|
|
$r->dispatch(Request::fromGlobals())->send();
|