water/server/app/miniapi/controller/AuthController.php

<?php

declare(strict_types=1);

namespace app\miniapi\controller;

use support\Request;
use support\Response;
use support\annotation\route\DisableDefaultRoute;
use app\miniapi\http\Input;
use app\miniapi\service\AuthService;
use app\miniapi\auth\LoginThrottle;
use app\miniapi\service\TestPhoneLogin;

#[DisableDefaultRoute]
final class AuthController extends BaseController
{
    public function login(Request $request): Response
    {
        // Do not trust arbitrary X-Forwarded-For headers to bypass login throttling.
        (new LoginThrottle())->consume($request->getRemoteIp());

        return $this->success($request, (new AuthService())->login(Input::json($request)));
    }

    public function logout(Request $request): Response
    {
        return $this->success($request, (new AuthService())->logout(substr($request->header('authorization'), 7)));
    }

    public function testPhone(Request $request): Response
    {
        (new LoginThrottle())->consume($request->getRemoteIp());
        $login = new TestPhoneLogin();
        $login->assertSourceAllowed($request->getRemoteIp());

        return $this->success($request, $login->login(Input::json($request)));
    }
}