refactor: dedupe Stripe calls, add CSRF, tidy flash/constants

Author: KalbarczykDev

public/account/index.php

@@ -4,9 +4,11 @@
 $user = require_login();
 
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
-    // The delete form posts a "confirm" field; the profile form does not.
-    if (isset($_POST['confirm'])) {
-        if ($_POST['confirm'] !== 'DELETE') {
+    csrf_check();
+    $action = $_POST['action'] ?? '';
+
+    if ($action === 'delete') {
+        if (($_POST['confirm'] ?? '') !== 'DELETE') {
             header('Location: /account');
             exit;
         }
@@ -17,12 +19,18 @@
         header('Location: /?deleted=1');
         exit;
     }
-    $name = trim((string)($_POST['display_name'] ?? ''));
-    db()->prepare('UPDATE users SET display_name = ? WHERE id = ?')->execute([$name, $user['id']]);
-    header('Location: /account?saved=1');
+
+    if ($action === 'save') {
+        $name = trim((string)($_POST['display_name'] ?? ''));
+        db()->prepare('UPDATE users SET display_name = ? WHERE id = ?')->execute([$name, $user['id']]);
+        header('Location: /account?saved=1');
+        exit;
+    }
+
+    header('Location: /account');
     exit;
 }
-$saved = isset($_GET['saved']);
+$saved = flash('saved');
 layout_header('Account');
 ?>
     <p class="kicker">Settings</p>
@@ -32,6 +40,8 @@
     <?php endif; ?>
     <div class="card">
         <form method="post" action="/account">
+            <?= csrf_field() ?>
+            <input type="hidden" name="action" value="save">
             <label for="display_name">Display name</label>
             <input id="display_name" name="display_name" value="<?= htmlspecialchars((string)($user['display_name'] ?? '')) ?>">
             <label for="email">Email</label>
@@ -44,6 +54,8 @@
         <h2>Delete account</h2>
         <p>This permanently deletes your account and cancels any subscription. It cannot be undone.</p>
         <form method="post" action="/account" onsubmit="return confirm('Delete your account permanently?');">
+            <?= csrf_field() ?>
+            <input type="hidden" name="action" value="delete">
             <label for="confirm">Type DELETE to confirm</label>
             <input id="confirm" name="confirm" autocomplete="off">
             <button class="btn btn-danger" type="submit">Delete my account</button>

public/app/index.php

@@ -13,7 +13,7 @@
     <?php elseif ($status === 'cancel'): ?>
         <p class="notice">Checkout canceled.</p>
     <?php endif; ?>
-    <?php if (isset($_GET['upgrade'])): upgrade_prompt(); endif; ?>
+    <?php if (flash('upgrade')): upgrade_prompt(); endif; ?>
 
     <ul class="manifest">
         <?php if ($name !== ''): ?>

public/auth/login.php

@@ -17,13 +17,15 @@
 
 // Step 1: user asked for a link.
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    csrf_check();
     $email = filter_var(trim($_POST['email'] ?? ''), FILTER_VALIDATE_EMAIL);
     if (!$email) {
         $error = 'Enter a valid email address.';
     } else {
-        $token = create_magic_link($email);
-        $link  = config()['base_url'] . '/auth/login?token=' . urlencode($token);
-        send_mail($email, 'Your sign-in link', "Click to sign in:\n\n$link\n\nThis link expires in 15 minutes.");
+        $token   = create_magic_link($email);
+        $link    = config()['base_url'] . '/auth/login?token=' . urlencode($token);
+        $minutes = (int)(MAGIC_LINK_TTL / 60);
+        send_mail($email, 'Your sign-in link', "Click to sign in:\n\n$link\n\nThis link expires in $minutes minutes.");
         $sent = true;
     }
 }
@@ -39,6 +41,7 @@
     <?php else: ?>
         <div class="card">
             <form method="post" action="/auth/login">
+                <?= csrf_field() ?>
                 <label for="email">Email</label>
                 <input id="email" type="email" name="email" required autofocus placeholder="you@example.com">
                 <button class="btn" type="submit">Send magic link</button>

public/feedback.php

@@ -7,6 +7,7 @@
     header('Location: /');
     exit;
 }
+csrf_check();
 
 $message = trim((string)($_POST['message'] ?? ''));
 $email   = filter_var(trim((string)($_POST['email'] ?? '')), FILTER_VALIDATE_EMAIL) ?: null;

public/index.php

@@ -3,6 +3,7 @@
 
 // Email capture posts back to the landing page itself.
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    csrf_check();
     $email = filter_var(trim((string)($_POST['email'] ?? '')), FILTER_VALIDATE_EMAIL);
     if ($email) {
         // INSERT OR IGNORE: a duplicate email is a no-op, not an error.
@@ -13,7 +14,7 @@
 }
 
 $user = current_user();
-$sub  = isset($_GET['sub']);
+$sub  = flash('sub');
 layout_header('Leanplate', 'A levelsio-style PHP micro-stack. SQLite, magic links, Stripe, one VPS, no framework.');
 ?>
     <p class="kicker">PHP micro-stack template</p>
@@ -43,6 +44,7 @@
         <?php else: ?>
             <div class="card">
                 <form method="post" action="/">
+                    <?= csrf_field() ?>
                     <label for="email">Get updates</label>
                     <input id="email" type="email" name="email" required placeholder="you@example.com">
                     <button class="btn btn-secondary" type="submit">Subscribe</button>

src/app/auth.php

@@ -3,6 +3,35 @@
 // Passwordless: magic links + Google OAuth. Both resolve to find_or_create_user(email).
 declare(strict_types=1);
 
+// How long a magic link stays valid. Also reused in the email copy.
+const MAGIC_LINK_TTL = 900; // 15 minutes
+
+// --- csrf ---
+// One token per session. Put csrf_field() inside every state-changing <form>
+// and call csrf_check() at the top of its POST handler.
+
+function csrf_token(): string
+{
+    if (empty($_SESSION['csrf'])) {
+        $_SESSION['csrf'] = bin2hex(random_bytes(32));
+    }
+    return $_SESSION['csrf'];
+}
+
+function csrf_field(): string
+{
+    return '<input type="hidden" name="csrf" value="' . htmlspecialchars(csrf_token()) . '">';
+}
+
+function csrf_check(): void
+{
+    $sent = $_POST['csrf'] ?? '';
+    if (!is_string($sent) || !hash_equals(csrf_token(), $sent)) {
+        http_response_code(400);
+        exit('Bad request (invalid CSRF token). Reload the page and try again.');
+    }
+}
+
 // --- users ---
 
 function find_or_create_user(string $email): array
@@ -78,7 +107,7 @@ function create_magic_link(string $email): string
     $token = bin2hex(random_bytes(32));
     //Store only the hash so a DB leak cannot replay links.
     $hash = hash('sha256', $token);
-    $expires = gmdate('Y-m-d H:i:s', time() + 900); //15 min expiry.
+    $expires = gmdate('Y-m-d H:i:s', time() + MAGIC_LINK_TTL);
     db()->prepare('INSERT OR REPLACE INTO login_tokens(token_hash, email,expires_at) VALUES (?,?,?)')
       ->execute([$hash, $email, $expires]);
     return $token;

src/app/stripe.php

@@ -3,39 +3,51 @@
 // Stripe Checkout + webhook via raw curl. No SDK.
 declare(strict_types=1);
 
+// Reject webhooks whose signed timestamp is older than this, to limit replay.
+const STRIPE_WEBHOOK_TOLERANCE = 300; // 5 minutes
+
 function stripe_enabled(): bool
 {
     $c = config();
     return !empty($c['stripe_secret_key']) &&
   !empty($c['stripe_price_id']);
 }
 
+// One call to the Stripe REST API. Secret key is the basic-auth user.
+// Returns the decoded response, or null on transport failure.
+// $method: 'GET' | 'POST' | 'DELETE'. POST sends $fields as form-encoded body.
+function stripe_api(string $method, string $path, array $fields = []): ?array
+{
+    $opt = [
+        CURLOPT_RETURNTRANSFER => true,
+        CURLOPT_USERPWD        => config()['stripe_secret_key'] . ':',
+        CURLOPT_TIMEOUT        => 20,
+    ];
+    if ($method === 'POST') {
+        $opt[CURLOPT_POST]       = true;
+        $opt[CURLOPT_POSTFIELDS] = http_build_query($fields);
+    } elseif ($method === 'DELETE') {
+        $opt[CURLOPT_CUSTOMREQUEST] = 'DELETE';
+    }
+    $ch = curl_init('https://api.stripe.com/v1/' . $path);
+    curl_setopt_array($ch, $opt);
+    $resp = curl_exec($ch);
+    return $resp === false ? null : json_decode($resp, true);
+}
+
 // Create a subscription Checkout Session, return its hosted URL.
 function stripe_create_checkout(array $user): ?string
 {
-    $c      = config();
-    $fields = [
+    $c    = config();
+    $data = stripe_api('POST', 'checkout/sessions', [
         'mode'                  => 'subscription',
         'success_url'           => $c['base_url'] . '/app?checkout=success',
         'cancel_url'            => $c['base_url'] . '/app?checkout=cancel',
         'customer_email'        => $user['email'],
         'client_reference_id'   => (string)$user['id'], // maps the webhook back to our user
         'line_items[0][price]'  => $c['stripe_price_id'],
         'line_items[0][quantity]' => 1,
-    ];
-    $ch = curl_init('https://api.stripe.com/v1/checkout/sessions');
-    curl_setopt_array($ch, [
-        CURLOPT_RETURNTRANSFER => true,
-        CURLOPT_POST           => true,
-        CURLOPT_POSTFIELDS     => http_build_query($fields),
-        CURLOPT_USERPWD        => $c['stripe_secret_key'] . ':', // secret key as basic-auth user
-        CURLOPT_TIMEOUT        => 20,
     ]);
-    $resp = curl_exec($ch);
-    if ($resp === false) {
-        return null;
-    }
-    $data = json_decode($resp, true);
     return $data['url'] ?? null;
 }
 
@@ -56,8 +68,8 @@ function stripe_verify_webhook(string $payload, string $sigHeader, string
     if (!$t || !$sigs) {
         return false;
     }
-    // Reject anything older than 5 minutes to limit replay.
-    if (abs(time() - (int)$t) > 300) {
+    // Reject anything too old to limit replay.
+    if (abs(time() - (int)$t) > STRIPE_WEBHOOK_TOLERANCE) {
         return false;
     }
     $expected = hash_hmac('sha256', $t . '.' . $payload, $secret);
@@ -77,56 +89,24 @@ function stripe_portal_url(array $user): ?string
     if (empty($user['stripe_id']) || !stripe_enabled()) {
         return null;
     }
-    $fields = [
+    $data = stripe_api('POST', 'billing_portal/sessions', [
         'customer'   => $user['stripe_id'],
         'return_url' => $c['base_url'] . '/app',
-    ];
-    $ch = curl_init('https://api.stripe.com/v1/billing_portal/sessions');
-    curl_setopt_array($ch, [
-        CURLOPT_RETURNTRANSFER => true,
-        CURLOPT_POST           => true,
-        CURLOPT_POSTFIELDS     => http_build_query($fields),
-        CURLOPT_USERPWD        => $c['stripe_secret_key'] . ':',
-        CURLOPT_TIMEOUT        => 20,
     ]);
-    $resp = curl_exec($ch);
-    if ($resp === false) {
-        return null;
-    }
-    $data = json_decode($resp, true);
     return $data['url'] ?? null;
 }
 
 // Cancel any active subscriptions for the user's Stripe customer. No-op when
 // Stripe is unconfigured or the user has no customer id.
 function stripe_cancel_subscription(array $user): void
 {
-    $c = config();
     if (empty($user['stripe_id']) || !stripe_enabled()) {
         return;
     }
-    $ch = curl_init('https://api.stripe.com/v1/subscriptions?customer=' . urlencode((string)$user['stripe_id']) . '&status=active');
-    curl_setopt_array($ch, [
-        CURLOPT_RETURNTRANSFER => true,
-        CURLOPT_USERPWD        => $c['stripe_secret_key'] . ':',
-        CURLOPT_TIMEOUT        => 20,
-    ]);
-    $resp = curl_exec($ch);
-    if ($resp === false) {
-        return;
-    }
-    $list = json_decode($resp, true);
+    $list = stripe_api('GET', 'subscriptions?customer=' . urlencode((string)$user['stripe_id']) . '&status=active');
     foreach ($list['data'] ?? [] as $sub) {
-        if (empty($sub['id'])) {
-            continue;
+        if (!empty($sub['id'])) {
+            stripe_api('DELETE', 'subscriptions/' . $sub['id']);
         }
-        $del = curl_init('https://api.stripe.com/v1/subscriptions/' . $sub['id']);
-        curl_setopt_array($del, [
-            CURLOPT_RETURNTRANSFER => true,
-            CURLOPT_CUSTOMREQUEST  => 'DELETE',
-            CURLOPT_USERPWD        => $c['stripe_secret_key'] . ':',
-            CURLOPT_TIMEOUT        => 20,
-        ]);
-        curl_exec($del);
     }
 }

src/lib/layout.php

@@ -3,6 +3,14 @@
 // Shared HTML chrome. Plain functions, no template engine.
 declare(strict_types=1);
 
+// True when a one-shot status flag is present in the query string,
+// e.g. after a POST redirect to ...?saved=1. Keeps the ad-hoc isset() reads
+// out of the page files.
+function flash(string $key): bool
+{
+    return isset($_GET[$key]);
+}
+
 function layout_header(string $title = 'Leanplate', string $description = '', string $ogImage = ''): void
 {
     $cfg  = config();
@@ -23,7 +31,7 @@ function layout_header(string $title = 'Leanplate', string $description = '', st
         : '<a href="/auth/login">Sign in</a>';
 
     // Toast shown after the feedback modal posts (?fb=1 on any page).
-    $toast = isset($_GET['fb']) ? '<div class="toast" role="status">Thanks for the feedback.</div>' : '';
+    $toast = flash('fb') ? '<div class="toast" role="status">Thanks for the feedback.</div>' : '';
 
     echo <<<HTML
 <!doctype html>
@@ -69,6 +77,7 @@ function layout_footer(): void
     $ver     = $version !== '' ? '<p class="version">v' . htmlspecialchars($version) . '</p>' : '';
     // Trusted operator config (GA/Plausible/etc.) - intentionally not escaped.
     $snippet = (string)($cfg['analytics_snippet'] ?? '');
+    $csrf    = csrf_field();
     echo <<<HTML
     </main>
     <footer class="site-footer">
@@ -78,6 +87,7 @@ function layout_footer(): void
     <dialog id="fb-modal" class="modal">
         <h2>Feedback</h2>
         <form method="post" action="/feedback">
+            $csrf
             <label for="fb-message">What's on your mind?</label>
             <textarea id="fb-message" name="message" required></textarea>
             <label for="fb-email">Email (optional)</label>