26 lines
1005 B
PHP
26 lines
1005 B
PHP
<?php
|
|
|
|
namespace App\Modules\Identity\Services;
|
|
|
|
use RuntimeException;
|
|
|
|
final class ProtectedProvisioningInput
|
|
{
|
|
public static function read($stream, string $email): array
|
|
{
|
|
try {
|
|
$raw = stream_get_contents($stream, 16385);
|
|
if (! is_string($raw) || strlen($raw) > 16384) { throw new RuntimeException(); }
|
|
$data = json_decode($raw, true, 16, JSON_THROW_ON_ERROR);
|
|
if (! is_array($data) || ($data['confirmed'] ?? null) !== true || ($data['email'] ?? null) !== $email
|
|
|| ! is_string($data['password'] ?? null) || ! is_string($data['confirmation'] ?? null)) {
|
|
throw new RuntimeException();
|
|
}
|
|
return [$data['password'], $data['confirmation']];
|
|
} catch (\Throwable) {
|
|
// Never include payload, parser errors, credentials or tokens in diagnostics.
|
|
throw new RuntimeException('Entrada protegida inválida ou não confirmada. Nada alterado.');
|
|
}
|
|
}
|
|
}
|