Initial Kaffeekasse SaaS restart

app/Core/Csrf.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Core;
+
+final class Csrf
+{
+    public function __construct(private readonly Session $session)
+    {
+    }
+
+    public function token(): string
+    {
+        $token = $this->session->get('_csrf_token');
+
+        if (!is_string($token) || $token === '') {
+            $token = bin2hex(random_bytes(32));
+            $this->session->put('_csrf_token', $token);
+        }
+
+        return $token;
+    }
+
+    public function validate(?string $token): bool
+    {
+        $expected = $this->session->get('_csrf_token');
+
+        return is_string($expected) && is_string($token) && hash_equals($expected, $token);
+    }
+}