kaffeekasse-saas/app/bootstrap.php

<?php

declare(strict_types=1);

if (!defined('APP_ROOT')) {
    define('APP_ROOT', dirname(__DIR__));
}

// Auf echtem Webhosting (PHP-FPM/mod_php) gibt es meist keine bequeme
// Moeglichkeit, Prozess-Umgebungsvariablen zu setzen wie beim lokalen
// `source .env.local` vor dem PHP-Dev-Server. env.local.php ist die
// Produktions-Entsprechung: eine nicht eingecheckte Datei mit putenv()-
// Aufrufen, siehe env.local.example.php. Existiert sie nicht (lokale
// Entwicklung), passiert hier nichts und getenv() liest wie bisher aus
// der Shell-Umgebung.
if (is_file(APP_ROOT . '/env.local.php')) {
    require_once APP_ROOT . '/env.local.php';
}

function app_env(string $name, ?string $default = null): ?string
{
    $value = getenv($name);
    if ($value === false || $value === '') {
        return $default;
    }

    return $value;
}

// PHP und MySQL muessen dieselbe Uhr sehen. Sonst laufen alle Stellen, die
// einen in PHP berechneten Zeitstempel gegen MySQL NOW() vergleichen,
// gegeneinander - z. B. Token-Ablaeufe (Passwort-Reset, E-Mail-Verifikation)
// und die Gueltigkeit von Hinweisen. Wir pinnen die PHP-Zeitzone
// deterministisch; app_db_pdo() setzt die DB-Session auf denselben Offset.
$appTimezone = app_env('APP_TIMEZONE', 'Europe/Berlin');
if (@date_default_timezone_set((string)$appTimezone) === false) {
    date_default_timezone_set('UTC');
}

function app_is_dev(): bool
{
    return app_env('APP_ENV', 'prod') === 'dev';
}

function app_is_https(): bool
{
    return (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off')
        || (($_SERVER['SERVER_PORT'] ?? null) === '443');
}

/**
 * Sends baseline security headers on every dynamic request. Deliberately
 * does not set a Content-Security-Policy: the existing templates rely on
 * inline style="" attributes throughout (banners, table cells, etc.), and
 * locking that down would need a broader template pass. Runs once per
 * request via the auto-invocation at the bottom of this file.
 */
function app_send_security_headers(): void
{
    if (PHP_SAPI === 'cli' || headers_sent()) {
        return;
    }

    header('X-Content-Type-Options: nosniff');
    header('X-Frame-Options: DENY');
    header('Referrer-Policy: strict-origin-when-cross-origin');
    header('Permissions-Policy: geolocation=(), microphone=(), camera=()');

    if (app_is_https()) {
        header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
    }
}

/**
 * The application's own primary hostname in production (e.g.
 * app.kaffeeliste.de), configured via APP_HOST. Unset in dev, where
 * index.php should keep behaving exactly as before (no host split).
 */
function app_primary_host(): ?string
{
    return app_env('APP_HOST');
}

/**
 * Builds a URL that always points at the app's own host, even when the
 * current request came in on a different domain (e.g. the marketing
 * domain linking to /login.php). Falls back to a relative path when
 * APP_HOST isn't configured, so local dev is unaffected.
 */
function app_primary_url(string $path): string
{
    $host = app_primary_host();
    if ($host === null) {
        return ltrim($path, '/');
    }

    $scheme = app_is_https() ? 'https' : 'http';

    return $scheme . '://' . $host . '/' . ltrim($path, '/');
}

function app_start_session(): void
{
    if (PHP_SAPI === 'cli' || session_status() === PHP_SESSION_ACTIVE) {
        return;
    }

    $sessionPath = app_env('APP_SESSION_PATH', APP_ROOT . '/var/sessions');
    if ($sessionPath !== null && !is_dir($sessionPath)) {
        @mkdir($sessionPath, 0700, true);
    }

    if ($sessionPath !== null && is_dir($sessionPath) && is_writable($sessionPath)) {
        session_save_path($sessionPath);
    }

    session_set_cookie_params([
        'lifetime' => 0,
        'path' => '/',
        'domain' => '',
        'secure' => app_is_https(),
        'httponly' => true,
        'samesite' => 'Lax',
    ]);

    session_name(app_env('APP_SESSION_NAME', 'kaffeeliste_session') ?? 'kaffeeliste_session');
    session_start();
}

function app_csrf_token(): string
{
    app_start_session();

    if (!isset($_SESSION) || !is_array($_SESSION)) {
        $_SESSION = [];
    }

    if (empty($_SESSION['csrf_token']) || !is_string($_SESSION['csrf_token'])) {
        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
    }

    return $_SESSION['csrf_token'];
}

function app_csrf_field(): string
{
    return '<input type="hidden" name="csrf_token" value="'
        . htmlspecialchars(app_csrf_token(), ENT_QUOTES, 'UTF-8')
        . '">';
}

function app_verify_csrf(?string $token): bool
{
    app_start_session();

    if (!isset($_SESSION) || !is_array($_SESSION)) {
        $_SESSION = [];
    }

    return is_string($token)
        && isset($_SESSION['csrf_token'])
        && is_string($_SESSION['csrf_token'])
        && hash_equals($_SESSION['csrf_token'], $token);
}

function app_require_csrf(): void
{
    if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
        return;
    }

    if (!app_verify_csrf($_POST['csrf_token'] ?? null)) {
        http_response_code(419);
        die('CSRF validation failed.');
    }
}

app_send_security_headers();