- Removed CSRF form validation from FormHandler / added to FormContext formExecute method.

- CRSF tokens are now consumed if a form return execute value is (bool) true, preventing double form send

src/Method/FormContext.php

@@ -76,6 +76,17 @@ class FormContext implements FormContextInterface
         return true;
     }
 
+    public function formExecute($returnValue) : void
+    {
+        $this->formExecutionStatus = $returnValue;
+        $this->formExecuted = true;
+
+        if ($returnValue) {
+            $this->consumeCsrfToken();
+        }
+    }
+
+
     public function executed() : bool
     {
         return $this->formExecutionStatus === false ? false : $this->formExecuted;
@@ -109,6 +120,17 @@ class FormContext implements FormContextInterface
         return $this->formExecutionStatus;
     }
 
+    public function consumeCsrfToken() {
+        if (! $this->formSkipCsrf) {
+            $token = $this->get('picea-ui-form')[$this->formName] ?? false;
+
+            if ( $token ) {
+                # token is consumed
+                $_SESSION["picea-ui.form:{$this->formName}"] = array_diff($_SESSION["picea-ui.form:{$this->formName}"], [ $token ]);
+            }
+        }
+    }
+
     public function getRequest() : ServerRequestInterface
     {
         return $this->formContextRequest;
@@ -226,7 +248,7 @@ class FormContext implements FormContextInterface
             is_null($value) => null,
             enum_exists($e) => ( $value instanceof \BackedEnum ? $value : $e::tryFrom($value) ) ?? throw new \InvalidArgumentException(sprintf("Field '\$$property' awaiting values : '%s'.", implode("', '", array_map(fn($e) => $e->value, $e::cases())))),
             function_exists($e) => $e($value),
-            class_exists($e) => new $e(...$value),
+            class_exists($e) => is_array($value) ? new $e(...$value) : new $e($value),
             interface_exists($e) => throw new \InvalidArgumentException("There is no way provided to match an interface object yet."),
             default => $value
         };
@@ -238,11 +260,12 @@ class FormContext implements FormContextInterface
         }
         elseif ($types instanceof \ReflectionIntersectionType || $types instanceof \ReflectionUnionType) {
             foreach($types->getTypes() as $type) {
-                return $cast($type->getName());
+                $value = $cast($type->getName());
+                break;
             }
         }
         elseif ($types->isBuiltin()) {
-            return $cast($types->getName());
+            $value = $cast($types->getName());
         }
 
         return $value;

src/Method/FormHandler.php

@@ -13,6 +13,7 @@ class FormHandler {
 
     public bool $validateCsrfToken = true;
 
+    # in PHP 8.5, value should be taken directly from a property get within $context->formExecutionStatus
     public /* mixed */ $executionStatus = null;
 
     public ? bool $validationStatus = null;
@@ -49,8 +50,8 @@ class FormHandler {
 
         if ( $this->sent && $this->context->formSent() ) {
             if ( $this->validationStatus = $this->form->validate($this->context) ) {
-                $this->context->formExecutionStatus = $this->executionStatus = $this->form->execute($this->context);
+                $this->executionStatus = $this->form->execute($this->context);
-                $this->context->formExecuted = true;
+                $this->context->formExecute($this->executionStatus);
             }
         }
     }