<?php

declare(strict_types=1);

/*
 * This file is part of the Ferienpass package.
 *
 * (c) Richard Henkenjohann <richard@ferienpass.online>
 *
 * For more information visit the project website <https://ferienpass.online>
 * or the documentation under <https://docs.ferienpass.online>.
 */

namespace Ferienpass\CmsBundle\Controller\Fragment;

use Ferienpass\CoreBundle\Controller\AbstractPrivateFragmentController;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;

/**
 * Interstitial page for the magic login link. The signed link is opened with
 * GET (which link prefetchers and inbox scanners also do); with the firewall's
 * `check_post_only`, the login_link authenticator only acts on POST. This page
 * therefore just re-POSTs the signed parameters back to the check route — auto-
 * submitted, with a no-JS fallback button — so the single-use link is consumed
 * by a real user interaction, not a prefetch.
 */
class LoginLinkConfirm extends AbstractPrivateFragmentController
{
    public function __invoke(Request $request): Response
    {
        return $this->render('@Contao/fragment/login_link_confirm.html.twig', [
            'user' => (string) $request->attributes->get('user'),
            'expires' => (string) $request->attributes->get('expires'),
            'hash' => (string) $request->attributes->get('hash'),
        ]);
    }
}
