Feature updates

app/Actions/ViewDataAction.php

@@ -117,7 +117,7 @@ public function openSource(string $locale): Collection
         });
     }
 
-    public function contacts(string $locale): object
+    public function contacts(string $locale): \stdClass
     {
         $key = Str::slug("contacts_published_{$locale}");
 

app/Console/Commands/SendNetworkInvitesCommand.php

@@ -11,7 +11,8 @@ class SendNetworkInvitesCommand extends Command
 {
     protected $signature = 'network:invite
         {--locale= : Language of the invitation (de or en)}
-        {--email= : Only invite this email address}';
+        {--email= : Only invite this email address}
+        {--force : Send without asking for confirmation (for non-interactive environments)}';
 
     protected $description = 'Invite network users via a signed link (valid 96 hours) to manage and publish their profile';
 
@@ -46,7 +47,7 @@ public function handle(): int
             $users->map(fn (NetworkUser $user): array => [$user->name, $user->email, $user->network_key])->all(),
         );
 
-        if (! $this->confirm(sprintf('Send %d invitation(s) in %s?', $users->count(), $locale->value))) {
+        if (! $this->option('force') && ! $this->confirm(sprintf('Send %d invitation(s) in %s?', $users->count(), $locale->value))) {
             $this->info('Aborted — nothing sent.');
 
             return self::SUCCESS;

app/Helpers/Facades/HelperMoney.php

@@ -7,8 +7,8 @@
 /**
  * @see \App\Helpers\HelperMoney
  *
- * @method static string format(int|float $number, string $currency = 'CHF')
- * @method static string formatLeft(int|float $number, string $currency = 'CHF')
+ * @method static string format(int|float|null $number, string $currency = 'CHF')
+ * @method static string formatLeft(int|float|null $number, string $currency = 'CHF')
  * @method static float roundMoney(int|float $money)
  * @method static float roundMoneyUp(int|float $money)
  * @method static float roundMoneyDown(int|float $money)

app/Http/Controllers/Jobs/JobsIndexController.php

@@ -4,22 +4,14 @@
 
 use App\Actions\PageAction;
 use App\Http\Controllers\Controller;
-use Illuminate\Http\RedirectResponse;
-use Illuminate\Support\Str;
 use Illuminate\View\View;
 
 class JobsIndexController extends Controller
 {
-    /**
-     * Display the user's profile form.
-     */
-    public function __invoke(): View|RedirectResponse
+    public function __invoke(): View
     {
-        return redirect()->route(Str::slug(app()->getLocale()).'.start.index');
-
-        // @todo Notification
-        /*        return view('app.jobs.index')->with([
-                    'page' => (new PageAction(locale: null, routeName: 'jobs.index'))->default(),
-                ]);*/
+        return view('app.jobs.index')->with([
+            'page' => (new PageAction(locale: null, routeName: 'jobs.index'))->default(),
+        ]);
     }
 }

app/Http/Controllers/Legal/TermsIndexController.php

@@ -4,22 +4,14 @@
 
 use App\Actions\PageAction;
 use App\Http\Controllers\Controller;
-use Illuminate\Http\RedirectResponse;
-use Illuminate\Support\Str;
 use Illuminate\View\View;
 
 class TermsIndexController extends Controller
 {
-    /**
-     * Display the user's profile form.
-     */
-    public function __invoke(): View|RedirectResponse
+    public function __invoke(): View
     {
-        return redirect()->route(Str::slug(app()->getLocale()).'.start.index');
-
-        // @todo Notification
-        /*        return view('app.legal.terms.index')->with([
-                    'page' => (new PageAction(locale: null, routeName: 'legal.terms.index'))->default(),
-                ]);*/
+        return view('app.legal.terms.index')->with([
+            'page' => (new PageAction(locale: null, routeName: 'legal.terms.index'))->default(),
+        ]);
     }
 }

app/Http/Middleware/ValidateCsrfToken.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Foundation\Http\Middleware\ValidateCsrfToken as Middleware;
+
+class ValidateCsrfToken extends Middleware
+{
+    /**
+     * No JavaScript reads the XSRF-TOKEN cookie (forms use the @csrf field),
+     * so the unprefixed cookie is not sent at all.
+     *
+     * @var bool
+     */
+    protected $addHttpCookie = false;
+}

bootstrap/app.php

@@ -2,11 +2,13 @@
 
 use App\Http\Middleware\SecurityHeaders;
 use App\Http\Middleware\SetLanguage;
+use App\Http\Middleware\ValidateCsrfToken;
 use App\Providers\AppServiceProvider;
 use App\Providers\EventServiceProvider;
 use Illuminate\Foundation\Application;
 use Illuminate\Foundation\Configuration\Exceptions;
 use Illuminate\Foundation\Configuration\Middleware;
+use Illuminate\Foundation\Http\Middleware\ValidateCsrfToken as FrameworkValidateCsrfToken;
 use Mazedlx\FeaturePolicy\AddFeaturePolicyHeaders;
 use Spatie\Csp\AddCspHeaders;
 use Spatie\Permission\Middleware\RoleMiddleware;
@@ -30,6 +32,7 @@
             SetLanguage::class,
             CacheResponse::class,
         ]);
+        $middleware->replace(FrameworkValidateCsrfToken::class, ValidateCsrfToken::class);
         $middleware->alias([
             'role' => RoleMiddleware::class,
         ]);

composer.json

@@ -24,6 +24,7 @@
     "spatie/laravel-responsecache": "^8.0",
     "spatie/laravel-sitemap": "^8.0",
     "spatie/security-advisories-health-check": "^1.2",
+    "symfony/http-client": "^8.1",
     "symfony/postmark-mailer": "^8.1"
   },
   "require-dev": {

config/session.php

@@ -14,9 +14,12 @@
     |
     */
 
+    // The __Host- prefix requires Secure, Path=/ and no Domain attribute,
+    // so it is only applied when SESSION_SECURE_COOKIE is enabled.
     'cookie' => env(
         'SESSION_COOKIE',
-        Str::slug((string) env('APP_NAME', 'laravel'), '_').'_session'
+        (env('SESSION_SECURE_COOKIE') ? '__Host-' : '')
+            .Str::slug((string) env('APP_NAME', 'laravel'), '_').'_session'
     ),
 
 ];

database/factories/OpenSourceFactory.php

@@ -18,7 +18,8 @@ class OpenSourceFactory extends Factory
      */
     public function definition(): array
     {
-        $title = (string) fake()->unique()->words(3, true);
+        /** @var string $title words() returns a string when $asText is true */
+        $title = fake()->unique()->words(3, true);
 
         return [
             'published' => true,

database/factories/ProductFactory.php

@@ -18,7 +18,8 @@ class ProductFactory extends Factory
      */
     public function definition(): array
     {
-        $name = (string) fake()->unique()->words(3, true);
+        /** @var string $name words() returns a string when $asText is true */
+        $name = fake()->unique()->words(3, true);
 
         return [
             'published' => true,

database/factories/ServiceFactory.php

@@ -18,7 +18,8 @@ class ServiceFactory extends Factory
      */
     public function definition(): array
     {
-        $name = (string) fake()->unique()->words(3, true);
+        /** @var string $name words() returns a string when $asText is true */
+        $name = fake()->unique()->words(3, true);
 
         return [
             'published' => true,

database/factories/TechnologyFactory.php

@@ -18,7 +18,8 @@ class TechnologyFactory extends Factory
      */
     public function definition(): array
     {
-        $title = (string) fake()->unique()->words(3, true);
+        /** @var string $title words() returns a string when $asText is true */
+        $title = fake()->unique()->words(3, true);
 
         return [
             'published' => true,