feat: implement global autoresponder plugin

2026-06-02 19:19:00 +02:00
commit 6f989af278
62 changed files with 2018 additions and 0 deletions
@@ -0,0 +1,15 @@
+<?php
+declare(strict_types=1);
+
+require_once PLUGIN_ROOT . '/exec/lib/CsrfGuard.php';
+
+test('csrf token is bound to user session action and time', function (): void {
+    $guard = new CsrfGuard('secret', 'alice', 'session-1');
+    $issued = $guard->issue('create');
+
+    assert_true($guard->validate('create', (string)$issued['ts'], $issued['token'], 3600, 'session-1'));
+    assert_false((new CsrfGuard('secret', 'bob', 'session-1'))->validate('create', (string)$issued['ts'], $issued['token'], 3600, 'session-1'));
+    assert_false($guard->validate('delete', (string)$issued['ts'], $issued['token'], 3600, 'session-1'));
+    assert_false($guard->validate('create', (string)($issued['ts'] - 7200), $issued['token'], 3600, 'session-1'));
+    assert_false($guard->validate('create', 'bad', $issued['token'], 3600, 'session-1'));
+});