breadcrumb-the-shire/core/Http/Request.php

<?php

namespace MintyPHP\Http;

use MintyPHP\I18n;
use MintyPHP\Router;

class Request
{
    public static function stripBasePath(string $path): string
    {
        $base = trim(parse_url(Router::getBaseUrl(), PHP_URL_PATH) ?: '/', '/');
        $path = ltrim($path, '/');

        if ($base !== '' && strpos($path, $base . '/') === 0) {
            return substr($path, strlen($base) + 1);
        }
        if ($base !== '' && $path === $base) {
            return '';
        }

        return $path;
    }

    public static function path(): string
    {
        $uri = $_SERVER['REQUEST_URI'] ?? '';
        $path = parse_url($uri, PHP_URL_PATH) ?: '';

        return self::stripBasePath($path);
    }

    // Returns a safe redirect target after login — guards against open-redirect attacks
    // by rejecting any value with a scheme or host (i.e. an absolute external URL).
    public static function safeReturnTarget(string $returnParam = ''): string
    {
        if ($returnParam !== '') {
            $parts = parse_url($returnParam);
            if (($parts['scheme'] ?? '') === '' && ($parts['host'] ?? '') === '') {
                $path = self::stripBasePath($parts['path'] ?? '');
                $query = isset($parts['query']) ? '?' . $parts['query'] : '';
                return $path . $query;
            }
        }

        $referer = $_SERVER['HTTP_REFERER'] ?? '';
        if ($referer !== '') {
            $parts = parse_url($referer);
            $host = $parts['host'] ?? '';
            $currentHost = $_SERVER['HTTP_HOST'] ?? '';
            if ($host === '' || $host === $currentHost) {
                $path = self::stripBasePath($parts['path'] ?? '');
                $query = isset($parts['query']) ? '?' . $parts['query'] : '';
                return $path . $query;
            }
        }

        return '';
    }

    public static function pathWithQuery(): string
    {
        $uri = $_SERVER['REQUEST_URI'] ?? '';
        $path = self::path();
        $query = parse_url($uri, PHP_URL_QUERY);

        return $path . ($query ? '?' . $query : '');
    }

    public static function stripLocale(string $path, ?array $locales = null): string
    {
        $locales = $locales ?? (defined('APP_LOCALES') ? APP_LOCALES : [I18n::$defaultLocale]);
        $path = ltrim($path, '/');
        if ($path === '') {
            return '';
        }
        $parts = explode('/', $path);
        while ($parts && $parts[0] !== '' && in_array($parts[0], $locales, true)) {
            array_shift($parts);
        }
        return implode('/', $parts);
    }

    public static function withLocale(string $path = '', ?string $locale = null): string
    {
        $locale = $locale ?? (I18n::$locale ?? I18n::$defaultLocale);
        $path = ltrim($path, '/');
        return ($locale !== '' ? $locale . '/' : '') . $path;
    }

    public static function wantsJson(): bool
    {
        $accept = $_SERVER['HTTP_ACCEPT'] ?? '';
        $requestedWith = $_SERVER['HTTP_X_REQUESTED_WITH'] ?? '';
        return stripos($accept, 'application/json') !== false || $requestedWith !== '';
    }
}