update to php 8.5, backup codes, etc.

modified:   Dockerfile
	modified:   composer.json
	modified:   composer.lock
	modified:   config/packages/twig.yaml
	modified:   config/services.yaml
	modified:   docs/Caddyfile
	modified:   docs/compose.yaml
	renamed:    docs/env.example -> docs/example.env
	modified:   public/index.php
	modified:   readme.md
	modified:   src/Command/GenerateBackupCodesCommand.php
	modified:   src/ConfigBag.php
	modified:   src/Data/Payload.php
	modified:   src/Enum/Scope.php
	modified:   src/Listener/AcceptListener.php
	modified:   src/Listener/AllowListener.php
	modified:   src/Listener/InterceptListener.php
	modified:   src/Listener/LoginListener.php
	modified:   src/MonitorCacheKeys.php
	modified:   src/PersistCache.php
	modified:   src/Service/BackupCodeManager.php
	modified:   src/Service/DomainManager.php
	new file:   src/Service/LoginManager.php
	modified:   src/Trait/CookieNameTrait.php
	modified:   src/Trait/GetTotpTrait.php
	modified:   src/Trait/MakeNonceTrait.php
	modified:   src/Trait/StringTrait.php
	modified:   src/Utilities.php
	modified:   templates/_script.html.twig
	modified:   templates/_style.html.twig
	modified:   templates/base.html.twig
	modified:   templates/login.html.twig

src/Data/Payload.php

@@ -4,12 +4,12 @@ declare(strict_types=1);
 namespace App\Data;
 
 use App\Enum\Scope;
+use Symfony\Component\HttpFoundation\InputBag;
 
-/* When scope is Ip but ip-access is disabled, scope is to be considered Cookie. */
-/* When using password but password is disabled, request will always fail. */
+/** when scope is IP but ip-access is disabled, scope is to be considered cookie */
 final class Payload {
     public string $id;    /* session name, identifying who is logging in */
-    public string $token; /* totp, typically six digits */
+    public string $token; /* TOTP, typically six digits */
     public string $nonce; /* random unique string, to block duplicate submissions */
     public bool   $json;  /* should we return json (for the login page) */
     public Scope  $scope; /* type of access being requested */
@@ -29,9 +29,22 @@ final class Payload {
         return null;
     }
 
+    public static function load(InputBag $input): ?Payload {
+        /* convert form data into real data */
+        if ($input->has('preauth_nonce') && $input->has('preauth_id') && $input->has('preauth_token')) {
+            return Payload::create((object)[
+                'id'    => $input->get('preauth_id'),
+                'nonce' => $input->get('preauth_nonce'),
+                'token' => $input->get('preauth_token'),
+                'json'  => false,
+            ]);
+        }
+        return null;
+    }
+
     public static function create(object $data): ?Payload {
         /* if missing required fields id, nonce, or token */
-        if (strlen($data->id ?? '') < 1 ||
+        if (strlen($data->id    ?? '') < 1 ||
             strlen($data->nonce ?? '') < 1 ||
             strlen($data->token ?? '') < 1
         ) {
@@ -50,7 +63,11 @@ final class Payload {
         return Payload::constrict($payload);
     }
 
-    public static function constrict(Payload $payload): Payload {
+    public function toString(): string {
+        return json_encode($this);
+    }
+
+    private static function constrict(Payload $payload): Payload {
         /* When scope is None, json will be considered false. */
         if ($payload->scope === Scope::None) {
             $payload->json = false;
@@ -58,8 +75,4 @@ final class Payload {
 
         return $payload;
     }
-
-    public function toString(): string {
-        return json_encode($this);
-    }
 }