token()) . '">'; } function flash(Session $session, string $key, mixed $default = null): mixed { return $session->pullFlash($key, $default); } function tenant_url(string $tenantSlug, string $path = ''): string { $suffix = $path === '' ? '' : '/' . ltrim($path, '/'); return '/t/' . rawurlencode($tenantSlug) . $suffix; } function money_from_cents(int $amountCents): string { return number_format($amountCents / 100, 2, ',', '.') . ' EUR'; } function secure_password_hash(string $password): string { $algo = defined('PASSWORD_ARGON2ID') ? PASSWORD_ARGON2ID : PASSWORD_BCRYPT; return password_hash($password, $algo); } function normalize_datetime_input(?string $value): string { $value = trim((string) $value); if ($value === '') { return gmdate('Y-m-d H:i:s'); } $normalized = str_replace('T', ' ', $value); if (preg_match('/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}$/', $normalized)) { return $normalized . ':00'; } return $normalized; } function request_origin_matches_host(): bool { $host = $_SERVER['HTTP_HOST'] ?? ''; if ($host === '') { return true; } foreach (['HTTP_ORIGIN', 'HTTP_REFERER'] as $header) { if (!empty($_SERVER[$header])) { $originHost = parse_url((string) $_SERVER[$header], PHP_URL_HOST); if (is_string($originHost) && $originHost !== '' && !hash_equals($host, $originHost)) { return false; } } } return true; }