- Removed CSRF form validation from FormHandler / added to FormContext formExecute method.

- CRSF tokens are now consumed if a form return execute value is (bool) true, preventing double form send

composer.json

@@ -10,12 +10,12 @@
         }
     ],
     "require": {
-        "mcnd/picea": "dev-master"
+        "mcnd/picea": "^1.4.0"
     },
     "repositories": [
         {
-            "type": "vcs",
-            "url": "https://github.com/mcNdave/picea.git"
+            "type": "composer",
+            "url": "https://git.mcnd.ca/api/packages/mcndave/composer"
         }
     ],
     "autoload": {

src/Method/FormContext.php

@@ -76,6 +76,17 @@ class FormContext implements FormContextInterface
         return true;
     }
 
+    public function formExecute($returnValue) : void
+    {
+        $this->formExecutionStatus = $returnValue;
+        $this->formExecuted = true;
+
+        if ($returnValue) {
+            $this->consumeCsrfToken();
+        }
+    }
+
+
     public function executed() : bool
     {
         return $this->formExecutionStatus === false ? false : $this->formExecuted;
@@ -109,6 +120,17 @@ class FormContext implements FormContextInterface
         return $this->formExecutionStatus;
     }
 
+    public function consumeCsrfToken() {
+        if (! $this->formSkipCsrf) {
+            $token = $this->get('picea-ui-form')[$this->formName] ?? false;
+
+            if ( $token ) {
+                # token is consumed
+                $_SESSION["picea-ui.form:{$this->formName}"] = array_diff($_SESSION["picea-ui.form:{$this->formName}"], [ $token ]);
+            }
+        }
+    }
+
     public function getRequest() : ServerRequestInterface
     {
         return $this->formContextRequest;

src/Method/FormHandler.php

@@ -50,8 +50,8 @@ class FormHandler {
 
         if ( $this->sent && $this->context->formSent() ) {
             if ( $this->validationStatus = $this->form->validate($this->context) ) {
-                $this->context->formExecutionStatus = $this->executionStatus = $this->form->execute($this->context);
-                $this->context->formExecuted = true;
+                $this->executionStatus = $this->form->execute($this->context);
+                $this->context->formExecute($this->executionStatus);
             }
         }
     }