88 lines
3.8 KiB
PHP
88 lines
3.8 KiB
PHP
<?php
|
|
|
|
use Illuminate\Foundation\Application;
|
|
use Illuminate\Foundation\Configuration\Exceptions;
|
|
use Illuminate\Foundation\Configuration\Middleware;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\Log;
|
|
use Illuminate\Support\Facades\Route;
|
|
use Illuminate\Validation\ValidationException;
|
|
use Symfony\Component\HttpKernel\Exception\HttpException;
|
|
use Uwil\LaravelCommon\Helpers\InertiaHelper;
|
|
|
|
return Application::configure(basePath: dirname(__DIR__))
|
|
->withRouting(
|
|
health: '/up',
|
|
web: __DIR__ . '/../routes/auth.php',
|
|
then: function (): void {
|
|
Route::middleware(['web', 'throttle:5,2'])
|
|
->post('/csp-report', function (): void {
|
|
$isCspRequest = request()->header('Content-Type') === 'application/csp-report';
|
|
abort_if(!$isCspRequest or !request()->json('csp-report') or !is_array(request()->json('csp-report')), 401);
|
|
// * Flatten if needed.
|
|
$cspReport = collect(request()->json('csp-report'))
|
|
->flatMap(fn($v, $k) => [$k => is_array($v) ? collect($v)->flatten()->implode(', ') : $v])->all();
|
|
// * Filter array keys.
|
|
$cspReport = collect(array_intersect_key($cspReport, [
|
|
'blocked-uri' => '',
|
|
'document-uri' => '',
|
|
'original-policy' => '',
|
|
'referrer' => '',
|
|
'violated-directive' => '',
|
|
]));
|
|
Log::warning(sprintf(
|
|
"CSP REPORT for %s : \n %s",
|
|
$cspReport->get('document-uri'),
|
|
$cspReport->implode("\n")
|
|
));
|
|
})->name('cspReportUri');
|
|
}
|
|
)
|
|
->withMiddleware(function (Middleware $middleware): void {
|
|
$middleware->web(append: [
|
|
\Uwil\LaravelI18n\Middlewares\ForceLocale::class,
|
|
\Uwil\LaravelCommon\Middlewares\HandleInertiaRequests::class,
|
|
\Illuminate\Http\Middleware\AddLinkHeadersForPreloadedAssets::class,
|
|
\Uwil\LaravelCommon\Middlewares\SecureHeaders::class,
|
|
\Uwil\LaravelCommon\Middlewares\TrimStrings::class,
|
|
\Uwil\LaravelCommon\Middlewares\TrustHosts::class,
|
|
\Uwil\LaravelCommon\Middlewares\TrustProxies::class,
|
|
\Uwil\LaravelBackend\Middlewares\LogoutUnpublishedUsers::class,
|
|
]);
|
|
$middleware->preventRequestForgery(except: [
|
|
'/csp-report',
|
|
]);
|
|
$middleware->alias([
|
|
'auth' => \Uwil\LaravelBackend\Middlewares\Authenticate::class,
|
|
'guest' => \Uwil\LaravelBackend\Middlewares\RedirectIfAuthenticated::class,
|
|
]);
|
|
})
|
|
->withExceptions(function (Exceptions $exceptions): void {
|
|
$exceptions->render(function (HttpException $e, Request $request) {
|
|
$status = $e->getStatusCode();
|
|
return InertiaHelper::errorRender($request, $status);
|
|
});
|
|
/**
|
|
* Automatic exception capture with Sentry.
|
|
*/
|
|
$exceptions->report(function (Throwable $e): void {
|
|
if (app()->bound('sentry')) {
|
|
resolve('sentry')->captureException($e);
|
|
}
|
|
});
|
|
/**
|
|
* Handling validation errors by excluding sensitive fields from the flash.
|
|
*/
|
|
$exceptions->render(function (ValidationException $e, Request $request) {
|
|
$safeInput = collect($request->all())
|
|
->except(['password', 'password_confirmation', 'current_password'])
|
|
->toArray();
|
|
return back()
|
|
->withInput($safeInput)
|
|
->withErrors($e->errors());
|
|
});
|
|
})
|
|
->withCommands([
|
|
\App\Console\Commands\MakeUser::class,
|
|
])
|
|
->create();
|