feat(app): fresh module-platform, provider, middleware, rule and support implementation

app/Http/Middleware/EncryptCookies.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Cookie\Middleware\EncryptCookies as FrameworkEncryptCookies;
+
+/**
+ * Application hook into the framework's cookie encryption pass.
+ *
+ * It exists so the app owns the opt-out list; nothing else is customised.
+ */
+class EncryptCookies extends FrameworkEncryptCookies
+{
+    /**
+     * Whether cookie payloads are run through PHP's serializer before being
+     * encrypted. Left off, matching the framework default.
+     *
+     * @var bool
+     */
+    protected static $serialize = false;
+
+    /**
+     * Cookie names that travel in clear text. Nothing is exempt right now.
+     *
+     * @var array
+     */
+    protected $except = [
+        //
+    ];
+}

app/Http/Middleware/PreventRequestForgery.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Foundation\Http\Middleware\PreventRequestForgery as FrameworkPreventRequestForgery;
+
+/**
+ * Application hook into the framework's CSRF token check.
+ *
+ * Only two endpoints opt out, both of them credential posts that are reached
+ * before a session token can reasonably be in hand.
+ */
+class PreventRequestForgery extends FrameworkPreventRequestForgery
+{
+    /**
+     * Whether responses carry the readable XSRF-TOKEN cookie the SPA reads
+     * back when signing its own requests.
+     *
+     * @var bool
+     */
+    protected $addHttpCookie = true;
+
+    /**
+     * Request paths the token check skips.
+     *
+     * @var array<int, string>
+     */
+    protected $except = [
+        'login',
+        'installation/session-login',
+    ];
+}

app/Http/Middleware/TrimStrings.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Foundation\Http\Middleware\TrimStrings as FrameworkTrimStrings;
+
+/**
+ * Application hook into the framework's whitespace-trimming pass over the
+ * request payload.
+ */
+class TrimStrings extends FrameworkTrimStrings
+{
+    /**
+     * Input keys handed through untouched, since a leading or trailing space
+     * is a legitimate part of the value.
+     *
+     * Note this replaces the framework list rather than extending it, so
+     * `current_password` is trimmed here even though the framework spares it.
+     *
+     * @var array
+     */
+    protected $except = [
+        'password',
+        'password_confirmation',
+    ];
+}

app/Http/Middleware/TrustProxies.php

@@ -0,0 +1,47 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Http\Middleware\TrustProxies as FrameworkTrustProxies;
+use Illuminate\Http\Request;
+
+/**
+ * Teaches the request object which upstream proxies may rewrite the client's
+ * address, host, port and scheme.
+ */
+class TrustProxies extends FrameworkTrustProxies
+{
+    /**
+     * Proxies the application accepts forwarded headers from, resolved lazily
+     * by {@see self::proxies()}.
+     *
+     * @var array
+     */
+    protected $proxies;
+
+    /**
+     * Bitmask of the forwarding headers that are honoured.
+     *
+     * @var array
+     */
+    protected $headers = Request::HEADER_X_FORWARDED_FOR
+        | Request::HEADER_X_FORWARDED_HOST
+        | Request::HEADER_X_FORWARDED_PORT
+        | Request::HEADER_X_FORWARDED_PROTO
+        | Request::HEADER_X_FORWARDED_AWS_ELB;
+
+    /**
+     * Resolve the trusted proxy list.
+     *
+     * Defaults to trusting every hop, which suits the containerised installs
+     * that sit behind an operator-controlled reverse proxy.
+     *
+     * @return string|array|null
+     */
+    protected function proxies()
+    {
+        $this->proxies = env('TRUSTED_PROXIES', '*');
+
+        return $this->proxies;
+    }
+}