38538993966

Committed 14 Oct 2026 08:58AM UTC coverage: 77.499% (+0.5%) from 77.02%

Build # 38538993966

Build Type

push

github

Committed by

web-flow

Commit Message

Merge pull request #75 from daycry/refactor/code-health-cleanup

refactor: code-health cleanup; fix OAuth info leak and bugs hidden in the PHPStan baseline

Coverage Stats

89 of 100 new or added lines in 21 files covered. (89.0%)

5497 of 7093 relevant lines covered (77.5%)

81.8 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/src/Controllers/RegisterController.php

<?php

declare(strict_types=1);

/**
 * This file is part of Daycry Auth.
 *
 * (c) Daycry <daycry9@proton.me>
 *
 * For the full copyright and license information, please view
 * the LICENSE file that was distributed with this source code.
 */

namespace Daycry\Auth\Controllers;

use CodeIgniter\Events\Events;
use CodeIgniter\Exceptions\LogicException;
use CodeIgniter\HTTP\RedirectResponse;
use CodeIgniter\HTTP\ResponseInterface;
use Daycry\Auth\Entities\User;
use Daycry\Auth\Exceptions\ValidationException;
use Daycry\Auth\Models\UserModel;
use Daycry\Auth\Validation\ValidationRules;

/**
 * Class RegisterController
 *
 * Handles displaying registration form,
 * and handling actual registration flow.
 */
class RegisterController extends BaseAuthController
{
    /**
     * Displays the registration form.
     */
    public function registerView(): ResponseInterface
    {
        // Check if already logged in
        if (($redirect = $this->redirectIfLoggedIn(config('Auth')->registerRedirect())) instanceof RedirectResponse) {
            return $redirect;
        }

        // Check if registration is allowed
        if (! setting('Auth.allowRegistration')) {
            return $this->handleError(
                $this->request->getUri()->getPath(),
                lang('Auth.registerDisabled'),
            );
        }

        // Check if there's a pending post-auth action
        if ($this->hasPostAuthAction()) {
            return $this->redirectToAuthAction();
        }

        $content = $this->view(setting('Auth.views')['register']);

        return $this->response->setBody($content);
    }

    /**
     * Attempts to register the user.
     */
    public function registerAction(): RedirectResponse
    {
        // Check if already logged in
        if (($redirect = $this->redirectIfLoggedIn(config('Auth')->registerRedirect())) instanceof RedirectResponse) {
            return $redirect;
        }

        // Check if registration is allowed
        if (! setting('Auth.allowRegistration')) {
            return $this->handleError(
                config('Auth')->registerRoute(),
                lang('Auth.registerDisabled'),
            );
        }

        // Validate input
        $rules    = $this->getValidationRules();
        $postData = $this->request->getPost();

        // Fire pre-register event before validation
        Events::trigger('pre-register', $postData);

        if (! $this->validateRequest($postData, $rules)) {
            return $this->handleValidationError(config('Auth')->registerRoute());
        }

        // Save the user
        $users             = $this->getUserProvider();
        $allowedPostFields = array_keys($rules);
        $user              = $this->getUserEntity();
        $user->fill($this->request->getPost($allowedPostFields));

        // Workaround for email only registration/login
        $user->username ??= null;

        try {
            $users->save($user);
        } catch (ValidationException) {
            return $this->handleError(
                config('Auth')->registerRoute(),
                'Registration failed',
                true,
            )->with('errors', $users->errors());
        }

        // Get complete user object with ID
        $user = $users->findById($users->getInsertID());

        // Add to default group
        $users->addToDefaultGroup($user);

        Events::trigger('register', $user);

        // Start authentication process
        $authenticator = $this->getSessionAuthenticator();
        $authenticator->startLogin($user);

        // Check for post-registration action
        $hasAction = $authenticator->startUpAction('register', $user);
        if ($hasAction) {
            return $this->redirectToAuthAction();
        }

        // Set the user active and complete login
        $user->activate();
        $authenticator->completeLogin($user);

        return $this->handleSuccess(
            config('Auth')->registerRedirect(),
            lang('Auth.registerSuccess'),
        );
    }

    /**
     * Returns the User provider
     */
    protected function getUserProvider(): UserModel
    {
        $provider = model(setting('Auth.userProvider'));

        // An explicit check, not assert(): assertions are disabled in production
        // (zend.assertions=-1), where a wrong provider would fatal later instead.
        if (! $provider instanceof UserModel) {
            throw new LogicException('Config Auth.userProvider must be ' . UserModel::class . ' or a subclass.');
        }

        return $provider;
    }

    /**
     * Returns the Entity class that should be used
     */
    protected function getUserEntity(): User
    {
        return new User();
    }

    /**
     * Returns the rules that should be used for validation.
     *
     * @return         array<string, array<string, list<string>|string>>
     * @phpstan-return array<string, array<string, string|list<string>>>
     */
    protected function getValidationRules(): array
    {
        $rules = new ValidationRules();

        return $rules->getRegistrationRules();
    }
}

1	<?php
2
3	declare(strict_types=1);
4
5	/**
6	* This file is part of Daycry Auth.
7	*
8	* (c) Daycry <daycry9@proton.me>
9	*
10	* For the full copyright and license information, please view
11	* the LICENSE file that was distributed with this source code.
12	*/
13
14	namespace Daycry\Auth\Controllers;
15
16	use CodeIgniter\Events\Events;
17	use CodeIgniter\Exceptions\LogicException;
18	use CodeIgniter\HTTP\RedirectResponse;
19	use CodeIgniter\HTTP\ResponseInterface;
20	use Daycry\Auth\Entities\User;
21	use Daycry\Auth\Exceptions\ValidationException;
22	use Daycry\Auth\Models\UserModel;
23	use Daycry\Auth\Validation\ValidationRules;
24
25	/**
26	* Class RegisterController
27	*
28	* Handles displaying registration form,
29	* and handling actual registration flow.
30	*/
31	class RegisterController extends BaseAuthController
32	{
33	/**
34	* Displays the registration form.
35	*/
36	public function registerView(): ResponseInterface	×
37	{
38	// Check if already logged in
39	if (($redirect = $this->redirectIfLoggedIn(config('Auth')->registerRedirect())) instanceof RedirectResponse) {	×
40	return $redirect;	×
41	}
42
43	// Check if registration is allowed
44	if (! setting('Auth.allowRegistration')) {	×
45	return $this->handleError(	×
46	$this->request->getUri()->getPath(),	×
47	lang('Auth.registerDisabled'),	×
48	);	×
49	}
50
51	// Check if there's a pending post-auth action
52	if ($this->hasPostAuthAction()) {	×
53	return $this->redirectToAuthAction();	×
54	}
55
56	$content = $this->view(setting('Auth.views')['register']);	×
57
58	return $this->response->setBody($content);	×
59	}
60
61	/**
62	* Attempts to register the user.
63	*/
64	public function registerAction(): RedirectResponse	×
65	{
66	// Check if already logged in
67	if (($redirect = $this->redirectIfLoggedIn(config('Auth')->registerRedirect())) instanceof RedirectResponse) {	×
68	return $redirect;	×
69	}
70
71	// Check if registration is allowed
72	if (! setting('Auth.allowRegistration')) {	×
73	return $this->handleError(	×
74	config('Auth')->registerRoute(),	×
75	lang('Auth.registerDisabled'),	×
76	);	×
77	}
78
79	// Validate input
80	$rules = $this->getValidationRules();	×
81	$postData = $this->request->getPost();	×
82
83	// Fire pre-register event before validation
84	Events::trigger('pre-register', $postData);	×
85
86	if (! $this->validateRequest($postData, $rules)) {	×
87	return $this->handleValidationError(config('Auth')->registerRoute());	×
88	}
89
90	// Save the user
91	$users = $this->getUserProvider();	×
92	$allowedPostFields = array_keys($rules);	×
93	$user = $this->getUserEntity();	×
94	$user->fill($this->request->getPost($allowedPostFields));	×
95
96	// Workaround for email only registration/login
97	$user->username ??= null;	×
98
99	try {
100	$users->save($user);	×
101	} catch (ValidationException) {	×
102	return $this->handleError(	×
103	config('Auth')->registerRoute(),	×
104	'Registration failed',	×
105	true,	×
106	)->with('errors', $users->errors());	×
107	}
108
109	// Get complete user object with ID
110	$user = $users->findById($users->getInsertID());	×
111
112	// Add to default group
113	$users->addToDefaultGroup($user);	×
114
115	Events::trigger('register', $user);	×
116
117	// Start authentication process
118	$authenticator = $this->getSessionAuthenticator();	×
119	$authenticator->startLogin($user);	×
120
121	// Check for post-registration action
122	$hasAction = $authenticator->startUpAction('register', $user);	×
123	if ($hasAction) {	×
124	return $this->redirectToAuthAction();	×
125	}
126
127	// Set the user active and complete login
128	$user->activate();	×
129	$authenticator->completeLogin($user);	×
130
131	return $this->handleSuccess(	×
132	config('Auth')->registerRedirect(),	×
133	lang('Auth.registerSuccess'),	×
134	);	×
135	}
136
137	/**
138	* Returns the User provider
139	*/
140	protected function getUserProvider(): UserModel	×
141	{
142	$provider = model(setting('Auth.userProvider'));	×
143
144	// An explicit check, not assert(): assertions are disabled in production
145	// (zend.assertions=-1), where a wrong provider would fatal later instead.
NEW 146	if (! $provider instanceof UserModel) {	×
NEW 147	throw new LogicException('Config Auth.userProvider must be ' . UserModel::class . ' or a subclass.');	×
148	}
149
150	return $provider;	×
151	}
152
153	/**
154	* Returns the Entity class that should be used
155	*/
156	protected function getUserEntity(): User	×
157	{
158	return new User();	×
159	}
160
161	/**
162	* Returns the rules that should be used for validation.
163	*
164	* @return array<string, array<string, list<string>\|string>>
165	* @phpstan-return array<string, array<string, string\|list<string>>>
166	*/
167	protected function getValidationRules(): array	×
168	{
169	$rules = new ValidationRules();	×
170
171	return $rules->getRegistrationRules();	×
172	}
173	}

daycry / auth / 38538993966

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous