- Removed CSRF form validation from FormHandler / added to FormContext formExecute method.

- CRSF tokens are now consumed if a form return execute value is (bool) true, preventing double form send

src/Method/FormContext.php

@@ -76,6 +76,17 @@ class FormContext implements FormContextInterface
         return true;
     }
 
+    public function formExecute($returnValue) : void
+    {
+        $this->formExecutionStatus = $returnValue;
+        $this->formExecuted = true;
+
+        if ($returnValue) {
+            $this->consumeCsrfToken();
+        }
+    }
+
+
     public function executed() : bool
     {
         return $this->formExecutionStatus === false ? false : $this->formExecuted;
@@ -109,6 +120,17 @@ class FormContext implements FormContextInterface
         return $this->formExecutionStatus;
     }
 
+    public function consumeCsrfToken() {
+        if (! $this->formSkipCsrf) {
+            $token = $this->get('picea-ui-form')[$this->formName] ?? false;
+
+            if ( $token ) {
+                # token is consumed
+                $_SESSION["picea-ui.form:{$this->formName}"] = array_diff($_SESSION["picea-ui.form:{$this->formName}"], [ $token ]);
+            }
+        }
+    }
+
     public function getRequest() : ServerRequestInterface
     {
         return $this->formContextRequest;

src/Method/FormHandler.php

@@ -50,8 +50,8 @@ class FormHandler {
 
         if ( $this->sent && $this->context->formSent() ) {
             if ( $this->validationStatus = $this->form->validate($this->context) ) {
-                $this->context->formExecutionStatus = $this->executionStatus = $this->form->execute($this->context);
+                $this->executionStatus = $this->form->execute($this->context);
-                $this->context->formExecuted = true;
+                $this->context->formExecute($this->executionStatus);
             }
         }
     }