water/server/app/miniapi/controller/AuthController.php

<?php

declare(strict_types=1);

namespace app\miniapi\controller;

use support\Request;
use support\Response;
use support\annotation\route\DisableDefaultRoute;
use app\miniapi\http\ClientIp;
use app\miniapi\http\Input;
use app\miniapi\service\AuthService;
use app\miniapi\auth\LoginThrottle;
use app\miniapi\service\TestPhoneLogin;

#[DisableDefaultRoute]
final class AuthController extends BaseController
{
    public function login(Request $request): Response
    {
        // ClientIp ignores the header unless the TCP peer is a configured proxy, so an
        // untrusted caller still cannot forge an address to bypass login throttling.
        (new LoginThrottle())->consume(ClientIp::resolve($request));

        return $this->success($request, (new AuthService())->login(Input::json($request)));
    }

    public function logout(Request $request): Response
    {
        return $this->success($request, (new AuthService())->logout(substr($request->header('authorization'), 7)));
    }

    public function testPhone(Request $request): Response
    {
        // Throttling and the source allowlist must judge the same caller; sharing one
        // resolved address here is what keeps a local proxy from opening this endpoint.
        $source = ClientIp::resolve($request);
        (new LoginThrottle())->consume($source);
        $login = new TestPhoneLogin();
        $login->assertSourceAllowed($source);

        return $this->success($request, $login->login(Input::json($request)));
    }
}